> ## Documentation Index > Fetch the complete documentation index at: https://support.configview.com/llms.txt > Use this file to discover all available pages before exploring further. # Postman setup ConfigView reads your Postman team through the Postman API, using a **Postman API key** created by a team Admin. Postman API keys cannot be scoped: a key can see whatever its owner can see. So create the key from an Admin account (ideally a dedicated service account, so it keeps working when a person leaves), and know that ConfigView only ever reads. You will end up with **1 secret** in ConfigView (`POSTMAN_API_KEY`), plus a second (`POSTMAN_REGION`) only if your team is on Postman's EU data region. > **Scope of this integration today.** ConfigView reads who is on your Postman team and which roles they hold (Super Admin, Admin, Billing and others, plus Guest and Partner accounts), your user groups and their members, every workspace the key can see with its visibility (personal, team, private, partner, public), who holds which role in each non-personal workspace, the secrets Postman's Secret Scanner found, and, on Enterprise plans, the team audit log (API keys created, role changes, SCIM provisioning). ConfigView never reads collection, request, environment or mock content, never reads variable values, and never changes anything. *** ## Step 1: Open the Postman page in ConfigView Open ConfigView in a second browser tab and leave it open: `https://{companyname}.configview.com/admin/integrations/postman` *** ## Step 2: Create an API key 1. Sign in to Postman as a team **Admin** or **Super Admin** (a dedicated service account is best) 2. Open **Account settings → API keys** (`https://go.postman.co/settings/me/api-keys`) and click **Generate API Key** 3. Name it `ConfigView` and choose an expiration if your team requires one 4. Copy the key (it starts `PMAK-`) into `POSTMAN_API_KEY` under **Credentials** in ConfigView and click the save icon. Postman shows the key once; if you lose it, generate a new one **Why an Admin?** The team audit log, the Secret Scanner results and API key management are Admin-only, and the team user list is most complete for an Admin. A key from an ordinary member still connects, but those parts are skipped. **Using the EU data region?** If your team is an Enterprise team on the EU region, enter `eu` in `POSTMAN_REGION` (ConfigView then uses `api.eu.postman.com`). Otherwise leave it empty. *** ## Step 3: Connect and verify 1. Back on `https://{companyname}.configview.com/admin/integrations/postman`, confirm the credential shows as saved 2. Click **Connect**. ConfigView creates its tables and schedules every collector at your default run time. Stop any you don't want under **Collectors**: | Script | Notes | | - | - | | **API Key Owner** | Whose API key ConfigView is using: their name, email, team and roles, plus the team's Postman API usage for the month (calls allowed and left) so you can see how close the plan limit is. | | **Team Users** | Everyone on the Postman team: name, username, email, roles and when they joined. | | **User Groups** | The team's user groups: name, summary, who created each, how many members it has, its roles and its managers. | | **Group Members** | Which user belongs to which Postman group, one row per member. | | **Workspaces** | Every Postman workspace the API key can see, with its type and visibility. Public workspaces are flagged. | | **Workspace Roles** | Who holds which role (Viewer, Editor, Admin) in each non-personal workspace: users, groups and outside partners. | | **Audit Logs** | The team's audit trail kept as a permanent archive. Enterprise plans only; skipped otherwise. | | **Detected Secrets** | Secrets Postman's Secret Scanner found in your workspaces. The secret value is not stored. Skipped when the plan has no Secret Scanner. | 3. Click **Verify now**. The health check confirms the key works, shows whose key it is and what roles that person has, reports how many API calls are left this month, and reads one page from each kind of data. If a check fails: * **"Postman API key" fails with 401.** The key was revoked or has expired, was mistyped, or belongs to the other region. Generate a new key, and set `POSTMAN_REGION` to `eu` if your team is on the EU region. * **"Key owner role" shows a warning.** The key works but its owner is not an Admin or Super Admin. Audit logs, Secret Scanner results and some user information will be incomplete. Create the key from an Admin account. * **"Audit logs" or "Secret Scanner results" is skipped.** The plan does not include it (audit logs need Enterprise) or the key owner is not an Admin. The table stays empty and nothing fails. * **"Monthly API quota" shows a warning.** Fewer than 200 API calls are left on your plan this month. See "Things worth knowing". *** ## Data Tables Once the scripts run, these tables are created in your database. Each includes a `run_at` column. All keep only the newest run, except `postman_audit_logs`, which keeps every event it has ever collected. | Table | Source | Key Columns | | - | - | - | | `postman_account` | `GET /me` | user\_id, username, email, team\_name, roles, monthly\_call\_limit, monthly\_calls\_remaining | | `postman_users` | `GET /users` | user\_id, name, username, email, roles, joined\_at | | `postman_groups` | `GET /groups` | group\_id, name, summary, created\_by, member\_count, roles, managers | | `postman_group_members` | `GET /groups` | group\_id, group\_name, user\_id | | `postman_workspaces` | `GET /workspaces` | workspace\_id, name, type, visibility, is\_public, created\_by, created\_at, updated\_at | | `postman_workspace_roles` | `GET /workspaces/{id}/roles` | workspace\_id, workspace\_name, workspace\_visibility, role\_name, principal\_type, principal\_id | | `postman_audit_logs` | `GET /audit/logs` | event\_id, action, event\_at, message, actor\_email, target\_user\_email, ip\_address, details | | `postman_detected_secrets` | `POST /detected-secrets-queries` | secret\_type, workspace\_id, workspace\_visibility, resource\_type, resolution, occurrences, detected\_at | *** ## Things worth knowing **There is a monthly call quota, not just a per-minute limit.** Postman allows 300 calls a minute, but each plan also has a **monthly** allowance of API calls (the free plan's is small). A full ConfigView run costs about 6 calls, plus one per non-personal workspace and one per 100 audit events or detected secrets. The collectors stop when 5 calls remain rather than use the last of your allowance, and `postman_account` records how many are left. If you have many workspaces, keep the schedule to once a day. To cap the per-workspace role reads, set `POSTMAN_MAX_ROLE_WORKSPACES` (default 300; public and partner workspaces are read first). **The workspace list is what the key owner can see.** Postman returns the workspaces the key's owner has access to, not every workspace in the team: another person's private workspace may be missing. Public workspaces and team-visible workspaces are always visible. Personal workspaces are collected only for the key owner and have no role details. **Public means public.** A workspace with visibility `public` can be read by anyone on the internet. ConfigView sets `is_public = 1` on it so you can see them, and who created them, at a glance. Partner workspaces are shared with outside organisations and appear in the role table with `principal_type = partner`. **Audit logs need an Enterprise plan.** Postman keeps the audit log for 180 days. ConfigView keeps every event it has collected, so after a few months you hold more history than Postman does. Run the collector at least every few weeks. Without an Enterprise plan the collector logs that the log is unavailable and stores nothing. **Roles on a user are a list.** `postman_users.roles` holds values such as `user`, `admin`, `super-admin`, `billing`, `community-manager`, `flow-editor`, `guest` and `partner`, separated by commas. The Postman team API does not report when someone last signed in. **Secrets are never stored.** For detected secrets ConfigView keeps the type, where it was found and its status, but not the secret, its hash or its masked value. Audit log details are filtered so that API keys and tokens are removed before anything is saved. ## What isn't collected * Your API key (it is only used to read) and any key, token or variable value found in an audit event * Collection, request, folder, environment, mock server, monitor and API definition content * The secret values Postman's Secret Scanner found, their hashes and masked values * Personal workspaces of other team members, and workspace activity or usage statistics * SCIM resources (these need a separate SCIM API key; the standard team users list is used instead) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.