Connect your API gateway to the API Catalog

This page is for Postman Docs, version Latest (v12) (default). For other versions, use one of these documentation indexes: - Latest (v12) (default): https://learning.postman.com/latest-v-12/llms.txt - v11: https://learning.postman.com/v11/llms.txt

Cloud connectors discover API specifications from supported gateways and add them to the API Catalog with metadata, including associated environments and clusters. Postman also generates collections that you can use for API development.

The API Catalog supports the following API gateways:

• AWS
• Google Cloud
• Azure
• IBM API Connect

Cloud connectors are available to all Enterprise teams, and no Team Admin setup is required. Go to Service discovery in the API Catalog to connect a gateway and discover and import APIs.

The following fields are ingested from the gateway:

• id
• name
• version
• title
• description
• openAPI spec
• environment
  • id
  • name
  • version

Connect a cloud connector

To connect a gateway connector, do the following:

1. Go to the API Catalog and click Service discovery.
2. Expand Cloud Connectors.
3. Select your connector. The connector page opens, for example Connect AWS.
4. Enter the data required to connect. The required data depends on the connector you select. For more information, see the requirements for each connector below.
5. Enter the credentials and configuration required by that connector, then complete its connection flow.

After the connection succeeds, use Discover Services to scan the accounts, regions, or services you want to add. Review the preview before importing. Only selected services are added to the API Catalog.

AWS requirements

To connect to AWS, select Connect Account on the Connected AWS Accounts page. Then, under Choose authentication method, select one of the following methods.

IAM role

IAM Role is the recommended and most secure method. Postman uses a cross-account role through sts:AssumeRole with an external ID, so no long-lived credentials are stored. A CloudFormation template is provided.

To connect with an IAM role, do the following:

1. Under IAM Role configuration, select Create Cloudformation Stack to deploy the CloudFormation template in your AWS account. This creates a read-only role that Postman can assume and takes about 30 seconds. To copy the template link instead, select Copy URL.

2. Enter the Role ARN that CloudFormation created. For example, arn:aws:iam::123456789012:role/PostmanDiscoveryRole. Postman validates the Role ARN when you click Continue. It doesn’t make any AWS calls before then.

3. Enter the External ID from the CloudFormation output. This must match the external ID in the role trust policy.

4. Select Continue.

Access keys

Access keys are long-lived secrets that require manual rotation. Use an IAM user with read-only discovery permissions. Postman stores the credentials encrypted and never displays the secret after you save it.

To connect with access keys, you need to have the following:

• Access Key ID — The access key in your AWS account. You can find it in the AWS IAM Console, under IAM > Users, in the Security credentials tab.
• Secret Access Key — The secret key in your AWS account. You can find it in the AWS IAM Console, under IAM > Users, in the Security credentials tab. The key is transmitted over TLS only and is never logged.
• Session Token (optional) — Provide this if you obtained temporary credentials through sts:GetSessionToken or an AssumeRole chain. You can find it in the individual values section.
• SSO Region — The region where your AWS IAM Identity Center instance is configured. You can find it in the AWS IAM Identity Center credentials section of your team’s AWS access portal.

Enter these values under Access Keys configuration, then select Continue.

After you connect, the Connected AWS Accounts page lists your accounts with the following details:

• Account — The account name and AWS account ID.
• Authentication — The method used to connect.
• Discovered services — The number of services found by discovery.
• Integrated services — The number of discovered services that have been integrated.
• Last used — When the connection was last used.

Google Cloud requirements

To connect to Google Cloud, you need to have the following:

• Project ID — The project ID in your Google Cloud account. Select Service Accounts in the IAM & Admin menu. Select the account and click the actions menu to reveal Manage Keys. Create a new key in JSON format. The project ID will be located in this file.
• Private key ID — The private key ID in your Google Cloud account. The private key ID is located in the same JSON file created above.
• Private key — The private key in your Google Cloud account. The private key is located in the same JSON file created above.
• Client email — The client email in your Google Cloud account. The client email is located in the same JSON file created above.
• Client ID — The client ID in your Google Cloud account. The client ID is located in the same JSON file created above.

Azure requirements

To connect to Azure, you need to have the following:

• Client ID — In the Azure portal, go to Microsoft Entra ID > App registrations, select your application, and copy the Application (client) ID from Overview.
• Tenant ID — In the same app registration, copy the Directory (tenant) ID from Overview.
• Client secret — In the same app registration, click Certificates & secrets, create a client secret, and immediately copy its Value. Azure shows this value only once. Don’t copy the Secret ID.
• Subscription ID — In the Azure portal, select Subscriptions, select the subscription, and copy its Subscription ID from Overview.

IBM API Connect requirements

To connect to IBM API Connect, you need to have the following:

• API key — Select My API Keys in your profile. Create a new API key and copy the API key from the REST API example.
• Client ID — Using the same REST API example above, find the Client ID in the curl.
• Client secret — Using the same REST API example above, find the Client secret in the curl.

Discover services

After you connect an account, scan it to find services. The steps below use AWS as an example. The wizard shows two steps: Accounts, regions & services and Test & Review.

To discover services, do the following:

1. On the Connected AWS Accounts page, select Discover Services.
2. Under Accounts, select the connected accounts to scan.
3. Under Regions, select the regions to scan. All regions are selected by default. To find a region, enter its name in Filter regions. Regions are grouped by geography, such as AMERICAS and EUROPE.
4. Under Services, select the services to scan. All services are selected by default. For AWS, the options are Elastic Kubernetes Service and AWS Lambda (COMPUTE), API Gateway (NETWORKING), and Elastic Beanstalk (OTHER).
5. Select Continue.

Each panel includes Select All and Deselect All to change every selection at once. Narrowing the selection reduces the size of the preview and the import.

Review the preview

Postman runs a connection test and shows the result for each check:

• Authentication — Confirms that the connection credentials work. For an IAM role, the result reads IAM Role assumed.
• Regions reachable — Shows how many of the selected regions Postman can reach.
• Service permissions — Shows how many of the selected service APIs are accessible.
• Discovering resources — Shows how many resources were discovered.

The Preview lists the discovered services with their Account, Service, Region, and Type. The list is paginated and shows 10 services at a time. To filter by service type, select a tab, such as API Gateway. To rerun the scan, select Refresh.

All discovered services are selected by default. Clear the checkboxes for any services you don’t want to bring into the catalog. The number of selected services is shown below the list. You must select at least one service to import.

Select Import to import the selected services as discovered services.

For other ways to connect APIs and services, see Connect API Catalog to your services.

Integrate discovered services

Imported services appear on the Discovered Services page, where you can review, tag, and integrate them. Services awaiting action are listed on the Pending Review tab. You can also view Blocked and Archived services.

To find a service, enter a name in Search Services, or filter by source, environment, tag, discovery time, or number of endpoints. To download the list, select Export CSV.

To integrate a service, do the following:

1. On the Pending Review tab, find the service and select Integrate.
2. Select Connect with GitHub and authorize the connection.
3. Select the Postman workspace where you want to set up the integration. To find a workspace, enter its name in Search workspaces. If the workspace you need isn’t listed, select Create new workspace.
4. Select Start setup.

Connect a Postman Insights project

If you integrate services without a connected Postman Insights project, the service dashboards can appear empty, with no live metrics, health data, or dependency graph. To avoid this, select Connect Insights Project in the recommendation banner at the top of the Discovered Services page.

With Insights connected, dashboards show request volume, P95 latency, error rate, endpoint coverage, runtime metrics, and upstream and downstream dependencies. For more information, see Postman Insights.

Next steps

After you connect your services, you can explore them in the API Catalog.