APIsecure 2023 - The world's first and only API security conference March 14 & 15, 2023 Securing your APIs with multi-facet contract testing Ian Douglas, Senior Developer Advocate at Postman ------ Check out our conferences at https://www.apidays.global/ Do you want to sponsor or talk at one of our conferences? https://apidays.typeform.com/to/ILJeAaV8 Learn more on APIscene, the global media made by the community for the community: https://www.apiscene.io Explore the API ecosystem with the API Landscape: https://apilandscape.apiscene.io/

1. All rights reserved by Postman Inc
Securing your
API with
Contract Testing
W. Ian Douglas
Sr Developer Advocate

2. @getpostman @iandouglas736
What is API Contract Testing, how does it help Security
Contract Validation Testing for API Producers
Contract Validation Testing for API Consumers
Q&A
1
2
3
4
Takeaways

3. What is an API
Contract?
LEVEL-SET
@getpostman @iandouglas736

4. ● API Planning, Design, Governance
Plan things carefully, then examine carefully.
Then examine carefully again.
● Industry Standards Validation
Ensure your API definition matches industry
standards, like OpenAPI Specification guidelines
● End-User Schema Validation
You don’t have to be a security expert here, but
knowing some basics will go a long way.
Why testing? Confidence AND Conformity
@getpostman @iandouglas736
confidence!

5. Testing Your Spec
for Conformity, and
ultimately, Security
API Producers
@getpostman @iandouglas736

6. ● Get your Spec into Postman
Doesn’t matter where/how you build it, but you’ll need to
bring it into Postman to use this automation tool.
● Fork a collection and environment into
your workspace, and configure it
This is was built by my colleague Jordan Walsh, an
employee at Postman and has great documentation
● Run the requests in that collection
… profit ?
Building an API Specification and Checking Conformity
@getpostman @iandouglas736

7. @getpostman @iandouglas736

8. @getpostman @iandouglas736

9. @getpostman @iandouglas736

10. @getpostman @iandouglas736

11. @getpostman @iandouglas736

12. @getpostman @iandouglas736

13. @getpostman @iandouglas736

14. @getpostman @iandouglas736

15. “Contract Test Generator”
“Documentation Leaking
Credentials”
CTG was made by the Postman team, the credential leaking
check may be listed as the “PostmanSecurity2” team, and can
scan your auto-generated documentation when you publish API
docs to see if you’re leaking API credentials from examples.
SEARCH TERMS IN POSTMAN

16. Testing things from
the Consumer side
API Consumer-side Testing
@getpostman @iandouglas736

17. @getpostman @iandouglas736

18. @getpostman @iandouglas736

19. @getpostman @iandouglas736

20. @getpostman @iandouglas736

21. Monitors (think of it
like a cron job) and
CLI tools for CI/CD
Automating All The Things
@getpostman @iandouglas736

22. Thank You
@getpostman @iandouglas736