API Security Checking below Enterprise Level

Help Hub
, ,
1

The Postman Intergalactic webinar of 1/25/23 indicated that anyone can use the Security API Check, even the free license. You just can’t add custom rules unless you have an Enterprise license.

However, the Rules tab does not even display for the free license, so it seems this is not the case. We have submitted a budget request for the Basic License, but it seems that most Security functionality is for the Enterprise level only.

The webinar provided this blog post link with instructions for free license users. It requires use of a third-party tool which I will have to research and make a case to have it whitelisted to install:
OWASP ZAP. API Security Testing With Postman and OWASP Zap – The Test Therapist

So, in reality Postman does not provide API Security Testing to free accounts, without a third-party tool which involves taking additional security risks. I don’t know if it is even provided for Basic Accounts. This should be made more clear.

2

As far as I get it, in this example Postman is only used to add the API endpoints (based on the requests from collection) to OWASP ZAP and then the actual security testing/scanning is done by ZAP.

3

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.

4

Hi @rhopper2020 – I wanted to follow up here!

While the Security API Check with custom rules isn’t the only way to protect your APIs, Postman includes several built-in security measures available to all users (even on Free!). From the moment you sign up, our platform is designed to help you reduce risk and protect sensitive data:

  • Secret Scanning – Proactively scans your workspaces, documentation, and connected repos for exposed credentials before collections are made public, and alerts you immediately if something is found.

  • Postman Local Vault – Stores credentials locally on your machine and never syncs them to the cloud, so even workspace admins can’t access them. The vault clears automatically on sign-out.

  • Best Practices Guidance – Built-in recommendations, like reviewing collections before publishing, avoiding saving auth headers by default, and keeping sensitive work private.

You can find more details on these features and our secure-by-design approach in this blog from our Head of Security, Sam Chehab: Postman (Free) is secure by design

2 Likes