中文
devexamples
← Workflows

阅读中文版本

Postman Collection Maintenance Workflow

Generate or update the collection from the contract, keep environments and variables out of the collection, and validate that requests still match the API.

beginner~60 minapitestingtooling

Objective

Keep a shared API collection accurate and free of embedded secrets so it stays useful for testing and onboarding.

Environment

  • A Postman collection or equivalent
  • Environment variable sets for secrets

Steps

1. Generate or update the collection

Generate or update the collection from the OpenAPI contract.

Expected state: The collection matches the API.

2. Keep secrets and environment-specific values

Keep secrets and environment-specific values in environment variables.

Expected state: The shared collection contains no credentials.

3. Add tests or assertions to key

Add tests or assertions to key requests.

Expected state: The collection verifies behavior, not just sends requests.

4. Run the collection in CI against

Run the collection in CI against staging to detect drift.

Expected state: The collection stays accurate.

Decision points

Store secrets in the collection?

  • Environment variables
  • Collection variables

Environment variables, never the shared collection; collection variables get exported and leaked.

Manual or generated collection?

  • Generated
  • Manual

Generate to avoid drift; add a manual curated folder only for exploratory examples.

Expected outcome

A contract-aligned collection with no embedded secrets, assertions on key requests, and CI verification against staging.

Verification

Confirm the collection contains no secret values and that CI collection runs pass against the current staging build.

Cleanup

Version the collection and record the contract revision used to generate it.

Overview

Keep a shared API collection accurate and free of embedded secrets so it stays useful for testing and onboarding. Confirm the collection contains no secret values and that CI collection runs pass against the current staging build.

Steps

  1. Generate or update the collection from the OpenAPI contract. Expected state: The collection matches the API.
  2. Keep secrets and environment-specific values in environment variables. Expected state: The shared collection contains no credentials.
  3. Add tests or assertions to key requests. Expected state: The collection verifies behavior, not just sends requests.
  4. Run the collection in CI against staging to detect drift. Expected state: The collection stays accurate.
{
  "info": { "name": "Orders API", "schema": "https://schema.getpostman.com/json/collection/v2.1.0/collection.json" },
  "variable": [
    { "key": "baseUrl", "value": "{{baseUrl}}" }
  ]
}

Verification

  • A contract-aligned collection with no embedded secrets, assertions on key requests, and CI verification against staging.

Decision points

  • Store secrets in the collection? Options: Environment variables; Collection variables. Recommended: Environment variables, never the shared collection; collection variables get exported and leaked.
  • Manual or generated collection? Options: Generated; Manual. Recommended: Generate to avoid drift; add a manual curated folder only for exploratory examples.