All Collections
Quick how to's!
Targets and Scans
How to configure an API target (Postman Collection)
How to configure an API target (Postman Collection)

How to configure Probely to scan endpoints of an API with a Postman Collection.

Jaime Vasconcelos avatar
Written by Jaime Vasconcelos
Updated over a week ago

If you have a Postman Collection for an API, you can configure an API target from that Postman Collection for Probely to scan the API.

The configuration involves the following steps:

  1. Prepare the Postman Collection

  2. Configure an API target using a Postman Collection

  3. (Optional) Configure the API target with Postman Environment variables

The following sections describe these steps in detail for an example of a Postman Collection with the following requests:

  • Authenticate and obtain an authentication token

    • Needs a username and a password in the request body

  • Get a list of users

    • Needs the authentication token in the request header

  • Get user details

    • Needs the authentication token in the request header

    • Needs the user identifier as a parameter

Step 1: Prepare the Postman Collection

Prepare the Postman Collection to run the sequence of requests from start to end without errors, so it can be exported to configure an API target in Probely.

Let's start by creating some auxiliary variables for the authentication, in the Variables tab of the collection.

For our example, we have the following variables:

  • username: the hardcoded value of the username to obtain the token

  • password: the hardcoded value of the password to obtain the token

  • token: the variable to store the authentication token

To obtain the authentication token, go to the authentication request and, in the Body tab, set the payload with the username and password variables.

To store the returned authentication token in the token variable, go to the Tests tab of the authentication request, and add the following JavaScript:

var jsonData = pm.response.json();
pm.collectionVariables.set('token', jsonData.access_token)

With the token configured, add the token variable to all requests, in their Headers tab.

In our example, the request to obtain user details needs the user identifier as a parameter. We could pass a hardcoded value, but since the previous request returns a list of users, we will use the first one from the list, as follows:

  1. In the Variables tab of the Postman collection, add a new variable called user_id

  2. To set the variable value, go to the request that gets the users list and, in the Tests tab, add the following JavaScript:

    var jsonData = pm.response.json();
    pm.collectionVariables.set('user_id', jsonData.results[0].id)

  3. Finally, go to the request that gets the user details and pass the user_id variable as a parameter
    โ€‹

With all requests configured, run the collection to test it.

If there are no issues, export the collection.

Step 2: Configure an API target using a Postman Collection

After the Postman Collection is prepared and exported, add an API target (see How to configure and scan an API), and make sure the following fields are configured as follows:

  1. In Is this an API target?, select "Postman Collection"

  2. Tick the Postman Collection schema upload radio button

  3. In File, choose the file exported from Postman

Press Add and the API target should be added and ready to be scanned.

Step 3: (Optional) Configure the API target with Postman Environment variables

If the Postman Collection uses variables defined in a Postman Environment, some further configuration to the API target is necessary:

  1. Go to Postman and export the Postman Environment to a file

  2. Get the Python script to import the Postman Environment variables to Probely
    This script can be found at Probely's GitHub: https://github.com/Probely/API_Scripts/blob/master/import_postman_env.py

  3. Run the Python script and provide the following values:

    1. Target ID: the Probely identifier of the API target, which can be found in the browser URL of the API target

    2. Postman collection file: the file exported from Postman with the Environment variables

  4. Go to the Postman Environment Values section of the API target to see the newly added environment variables or, if already on the page, just refresh it

Did this answer your question?