Postman

Postman

This connector works with the Postman API (https://api.postman.com, or https://api.eu.postman.com for the EU data region): workspaces, collections with their folders and requests, environments, APIs, Spec Hub specifications, mock servers and their call logs, monitors, team users and search. 35 tools: the AI can read all of these, and create or change collections, requests, environments, mocks, monitors and specs after you confirm. No tool deletes a workspace, collection, request, environment, mock, monitor or spec.

Setup (about 2 minutes)

1. In Postman open your avatar > Settings > API keys (https://go.postman.co/settings/me/api-keys) and click Generate API Key. Give it a name and copy the key; it starts with PMAK-.
2. Paste it into POSTMAN_API_KEY. It is sent in the X-Api-Key header. The key acts as your Postman user and sees what you see in every workspace.
3. Set POSTMAN_API_URL to https://api.postman.com, or to https://api.eu.postman.com if your team is on an Enterprise plan in the Postman EU data region.
4. Check the setup with postman_get_me.

Ids and uids: most objects have an id and a uid (<owner user id>-<id>). Mocks, monitors and postman_update_collection take the collection uid; postman_create_collection_request, postman_update_collection_request and postman_create_collection_folder take the plain collection id. Other reads take either.

How to work

• Who and what: postman_get_me (user id, team id, monthly usage), postman_list_workspaces (pass createdBy with your user id for "my workspaces"), postman_get_workspace (everything a workspace holds), postman_list_team_users, postman_search (find a collection, request or spec by text).
• Collections: postman_list_collections, postman_get_collection (model=minimal first for a big one), postman_get_collection_folder, postman_get_collection_request.
• Environments: postman_list_environments, postman_get_environment.
• API design: postman_list_specs, postman_get_spec, postman_list_spec_files, postman_get_spec_file, postman_get_spec_definition (whole resolved definition). Older API Builder APIs: postman_list_apis, postman_get_api.
• Mocks: postman_list_mocks, postman_get_mock, postman_get_mock_call_logs (what clients sent to the mock and what it answered).
• Monitors: postman_list_monitors, postman_get_monitor (lastRun shows the latest result).

Writes need the user's confirmation: postman_create_collection, postman_update_collection, postman_create_collection_folder, postman_create_collection_request, postman_update_collection_request, postman_create_environment, postman_update_environment, postman_create_mock, postman_create_monitor, postman_run_monitor, postman_create_spec and postman_update_spec_file. Say what will be created or changed, in which workspace, and call after the user agrees. Everything you write is visible to the workspace's members. postman_run_monitor sends the collection's real requests to their APIs and uses a monitoring run; postman_create_monitor keeps doing so on its schedule. A new mock is public unless private is true. postman_update_environment takes one kind of JSON Patch operation per call; read the environment first to get the variable positions.

Collection runs: the Postman API has no endpoint that runs a collection directly. Use a monitor (postman_create_monitor, then postman_run_monitor), or the Postman CLI in your own CI.

Secrets: environment variables of type secret come back with their values when they are shared. Collection variables and request auth may hold tokens too. Do not repeat such values unless the user asks.

Paging: postman_list_workspaces, postman_list_apis, postman_list_specs, postman_list_monitors, postman_get_mock_call_logs and postman_search return meta.nextCursor; call again with cursor set to it until it is empty. postman_list_collections pages with limit and offset. Dates are ISO 8601 in UTC.

Limits: Postman allows 300 requests per minute per user; postman_list_collections, postman_list_workspaces, postman_get_workspace and the monitor endpoints only 10 calls in 10 seconds. Each plan also has a monthly quota of API calls; postman_get_me shows the usage under operations. 429 with rateLimited means wait (Retry-After gives the seconds); serviceLimitExhausted means the plan's quota is used up and a team admin has to act.

Errors: 401 means the key is wrong, expired or revoked, or belongs to the other data region (check POSTMAN_API_URL). 403 means your role in that workspace does not allow the call. 404 means the id does not exist or you cannot see it. 400 names the field that is wrong, for example a collection id where a uid is needed.

Official MCP server: Postman also runs its own MCP server at https://mcp.postman.com/mcp (EU: https://mcp.eu.postman.com/mcp), with OAuth or Authorization: Bearer <API key>.

Out of scope here: deleting anything, forks and pull requests, comments, tags, governance, API catalog, private API network, SCIM, audit logs, billing and the older API Builder writes.