Postman setup

ConfigView reads your Postman team through the Postman API, using a Postman API key created by a team Admin. Postman API keys cannot be scoped: a key can see whatever its owner can see. So create the key from an Admin account (ideally a dedicated service account, so it keeps working when a person leaves), and know that ConfigView only ever reads. You will end up with 1 secret in ConfigView (POSTMAN_API_KEY), plus a second (POSTMAN_REGION) only if your team is on Postman’s EU data region.

Scope of this integration today. ConfigView reads who is on your Postman team and which roles they hold (Super Admin, Admin, Billing and others, plus Guest and Partner accounts), your user groups and their members, every workspace the key can see with its visibility (personal, team, private, partner, public), who holds which role in each non-personal workspace, the secrets Postman’s Secret Scanner found, and, on Enterprise plans, the team audit log (API keys created, role changes, SCIM provisioning). ConfigView never reads collection, request, environment or mock content, never reads variable values, and never changes anything.

Step 1: Open the Postman page in ConfigView

Open ConfigView in a second browser tab and leave it open: https://{companyname}.configview.com/admin/integrations/postman

Step 2: Create an API key

Sign in to Postman as a team Admin or Super Admin (a dedicated service account is best)
Open Account settings → API keys (https://go.postman.co/settings/me/api-keys) and click Generate API Key
Name it ConfigView and choose an expiration if your team requires one
Copy the key (it starts PMAK-) into POSTMAN_API_KEY under Credentials in ConfigView and click the save icon. Postman shows the key once; if you lose it, generate a new one

Why an Admin? The team audit log, the Secret Scanner results and API key management are Admin-only, and the team user list is most complete for an Admin. A key from an ordinary member still connects, but those parts are skipped. Using the EU data region? If your team is an Enterprise team on the EU region, enter eu in POSTMAN_REGION (ConfigView then uses api.eu.postman.com). Otherwise leave it empty.

Step 3: Connect and verify

Back on https://{companyname}.configview.com/admin/integrations/postman, confirm the credential shows as saved
Click Connect. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don’t want under Collectors:

Script	Notes
API Key Owner	Whose API key ConfigView is using: their name, email, team and roles, plus the team’s Postman API usage for the month (calls allowed and left) so you can see how close the plan limit is.
Team Users	Everyone on the Postman team: name, username, email, roles and when they joined.
User Groups	The team’s user groups: name, summary, who created each, how many members it has, its roles and its managers.
Group Members	Which user belongs to which Postman group, one row per member.
Workspaces	Every Postman workspace the API key can see, with its type and visibility. Public workspaces are flagged.
Workspace Roles	Who holds which role (Viewer, Editor, Admin) in each non-personal workspace: users, groups and outside partners.
Audit Logs	The team’s audit trail kept as a permanent archive. Enterprise plans only; skipped otherwise.
Detected Secrets	Secrets Postman’s Secret Scanner found in your workspaces. The secret value is not stored. Skipped when the plan has no Secret Scanner.

Click Verify now. The health check confirms the key works, shows whose key it is and what roles that person has, reports how many API calls are left this month, and reads one page from each kind of data.

If a check fails:

“Postman API key” fails with 401. The key was revoked or has expired, was mistyped, or belongs to the other region. Generate a new key, and set POSTMAN_REGION to eu if your team is on the EU region.
“Key owner role” shows a warning. The key works but its owner is not an Admin or Super Admin. Audit logs, Secret Scanner results and some user information will be incomplete. Create the key from an Admin account.
“Audit logs” or “Secret Scanner results” is skipped. The plan does not include it (audit logs need Enterprise) or the key owner is not an Admin. The table stays empty and nothing fails.
“Monthly API quota” shows a warning. Fewer than 200 API calls are left on your plan this month. See “Things worth knowing”.

Data Tables

Once the scripts run, these tables are created in your database. Each includes a run_at column. All keep only the newest run, except postman_audit_logs, which keeps every event it has ever collected.

Table	Source	Key Columns
`postman_account`	`GET /me`	user_id, username, email, team_name, roles, monthly_call_limit, monthly_calls_remaining
`postman_users`	`GET /users`	user_id, name, username, email, roles, joined_at
`postman_groups`	`GET /groups`	group_id, name, summary, created_by, member_count, roles, managers
`postman_group_members`	`GET /groups`	group_id, group_name, user_id
`postman_workspaces`	`GET /workspaces`	workspace_id, name, type, visibility, is_public, created_by, created_at, updated_at
`postman_workspace_roles`	`GET /workspaces/{id}/roles`	workspace_id, workspace_name, workspace_visibility, role_name, principal_type, principal_id
`postman_audit_logs`	`GET /audit/logs`	event_id, action, event_at, message, actor_email, target_user_email, ip_address, details
`postman_detected_secrets`	`POST /detected-secrets-queries`	secret_type, workspace_id, workspace_visibility, resource_type, resolution, occurrences, detected_at

Things worth knowing

There is a monthly call quota, not just a per-minute limit. Postman allows 300 calls a minute, but each plan also has a monthly allowance of API calls (the free plan’s is small). A full ConfigView run costs about 6 calls, plus one per non-personal workspace and one per 100 audit events or detected secrets. The collectors stop when 5 calls remain rather than use the last of your allowance, and postman_account records how many are left. If you have many workspaces, keep the schedule to once a day. To cap the per-workspace role reads, set POSTMAN_MAX_ROLE_WORKSPACES (default 300; public and partner workspaces are read first). The workspace list is what the key owner can see. Postman returns the workspaces the key’s owner has access to, not every workspace in the team: another person’s private workspace may be missing. Public workspaces and team-visible workspaces are always visible. Personal workspaces are collected only for the key owner and have no role details. Public means public. A workspace with visibility public can be read by anyone on the internet. ConfigView sets is_public = 1 on it so you can see them, and who created them, at a glance. Partner workspaces are shared with outside organisations and appear in the role table with principal_type = partner. Audit logs need an Enterprise plan. Postman keeps the audit log for 180 days. ConfigView keeps every event it has collected, so after a few months you hold more history than Postman does. Run the collector at least every few weeks. Without an Enterprise plan the collector logs that the log is unavailable and stores nothing. Roles on a user are a list. postman_users.roles holds values such as user, admin, super-admin, billing, community-manager, flow-editor, guest and partner, separated by commas. The Postman team API does not report when someone last signed in. Secrets are never stored. For detected secrets ConfigView keeps the type, where it was found and its status, but not the secret, its hash or its masked value. Audit log details are filtered so that API keys and tokens are removed before anything is saved.

What isn’t collected

Your API key (it is only used to read) and any key, token or variable value found in an audit event
Collection, request, folder, environment, mock server, monitor and API definition content
The secret values Postman’s Secret Scanner found, their hashes and masked values
Personal workspaces of other team members, and workspace activity or usage statistics
SCIM resources (these need a separate SCIM API key; the standard team users list is used instead)

Platform

Integrations

Step 1: Open the Postman page in ConfigView

Step 2: Create an API key

Step 3: Connect and verify

Data Tables

Things worth knowing

What isn’t collected

​Step 1: Open the Postman page in ConfigView

​Step 2: Create an API key

​Step 3: Connect and verify

​Data Tables

​Things worth knowing

​What isn’t collected

Step 1: Open the Postman page in ConfigView

Step 2: Create an API key

Step 3: Connect and verify

Data Tables

Things worth knowing

What isn’t collected