Postmanpostman.com
Postman's API program shows genuine strengths in agent usability and API design, but two areas demand immediate attention: partners and their AI agents cannot track what has changed between versions (no published changelog), and agents lack the structured context files they need to parse and act on the API surface without guesswork. Closing these gaps — a public changelog and machine-readable agent context files — will meaningfully accelerate partner integration, reduce support burden, and make the program viable for the AI-native toolchains partners increasingly rely on.
API DesignA clean, typed, well-governed API contract agents can reason about2 pass3 warn0 fail79B
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| warn | Machine-readable, versioned contractvia spec | 20.6/25 | info.version="1.0.0" set but no versioning scheme (URL / header / media type) detected. Investigated: spec 83%, cli 75%, docs 65%. | A current OpenAPI version with a declared versioning scheme lets agents reason about the contract. |
| warn | Schema coverage & depthvia sdk | 17.4/25 | 262 of 1190 public signatures use loose types (anyTypeRatio=0.220). Investigated: sdk 70%, spec 48%. | Typed, complete request/response schemas are what make agent function-calling possible. |
| pass | Security & governance hygienevia spec | 15/15 | No credential-shaped strings detected in spec. Investigated: spec 100%, wellknown 100%. | No leaked secrets, no critical lint violations, no OWASP API Top-10 spec smells, and a published vulnerability-disclosure channel. |
| warn | Auth declared & discoverablevia docs | 12.5/25 | No securitySchemes declared. Investigated: docs 50%, cli 50%, spec 25%, wellknown 0%. | Agents can only authenticate when auth is declared, scoped, and discoverable. |
| pass | Example coveragevia spec | 10/10 | 100% example coverage across params + responses. Investigated: spec 100%, docs 100%, sdk 100%, cli 100%. | Examples carry shape semantics schemas under-specify — for humans and agents alike. |
Developer ExperienceThe context both developers and agents need to integrate fast — onboarding, code samples, complete descriptions and worked examples2 pass2 warn1 fail78B
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Self-service developer portalvia docs | 29/29 | Self-service signup at https://www.postman.com/signup; no free tier or sandbox language detected. Investigated: docs 100%. | Self-serve key/account creation is the fast first call for partners, with no sales gate. |
| pass | Code samples in docsvia docs | 18/18 | Code samples present on 4/20 pages across 2 language(s); broader multi-language coverage missing. Investigated: docs 100%. | Multi-language samples shorten time-to-first-call. |
| warn | Description completenessvia sdk | 14.4/15 | 406/424 operations carry a description. Investigated: sdk 96%, spec 10%. | Complete descriptions are the context humans and agents need to use endpoints. |
| warn | Quickstart presentvia docs | 12.5/25 | Quickstart page reachable (2 variants scanned starting at https://learning.postman.com/docs/getting-started/overview/) but no runnable code sample detected in HTML or .md variant. Investigated: docs 50%. | A quickstart is the fastest path from landing page to first successful call. |
| fail | Changelog publishedvia spec | 0/13 | No changelog URL or mention found in spec metadata. Investigated: spec 0%, docs 0%. | A published changelog lets partners track changes without surprise. |
Agent DiscoveryPartners and their agents can find your APIs — llms.txt, registries, crawlable and reachable docs3 pass0 warn0 fail100A+
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | llms.txt present, valid & comprehensivevia docs | 30/30 | llms-full.txt reachable at https://learning.postman.com/api-docs/api-reference/llms-full.txt. Investigated: docs 100%, sdk 0%. | A valid, comprehensive llms.txt is the machine-readable entry point for agents. |
| pass | Registry & SDK presencevia docs | 28/28 | Indexed on Context7 (websites/learning_postman, 9228 snippets). Investigated: docs 100%, cli 100%, mcp 100%, sdk 83%, wellknown 0%. | Listing in MCP registries and publishing SDKs puts the API where agents and their tooling look. |
| pass | Crawlable / AEOvia wellknown | 12/12 | Docs paths crawlable by all monitored AI agents. Investigated: wellknown 100%. | Bots allowed plus a fresh sitemap make docs findable by agent crawlers. |
| na | Docs reachable, not hard auth-gated | —/30 | No surface produced evidence for this capability in this run. | Agents can only index and fetch docs they can reach — past auth gates and over correct HTTP semantics. |
Agent UnderstandingAgents can correctly interpret your APIs — machine-readable errors, consistent descriptions, structured data, parseable docs1 pass2 warn2 fail73B
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Machine-readable errors (RFC 9457)via docs | 28/28 | No 4xx/5xx response codes (or default error response) documented anywhere in the spec. Investigated: docs 100%, sdk 100%, spec 58%, cli 0%. | RFC 9457 problem details and a documented error-code inventory let agents parse failures without burning tokens. |
| warn | Operation purpose clarityvia spec | 23.8/25 | 71% of operations are agent-inferable (target 90%+). Investigated: spec 95%. | Agents select the right endpoint from its summary + operationId; clear, named operations make tool-selection reliable — the strongest driver of correct tool choice. |
| warn | Description consistency across surfaces | 0.9/7 | Mean pairwise description similarity across 3 surfaces (spec, docs, sdk) is 5% (threshold 35% for full credit). | Every surface tells the same story about what the product is. |
| fail | Agent instructions file (AGENTS.md)via wellknown | 0/10 | No AGENTS.md at the site root or /.well-known/. Investigated: wellknown 0%. | An AGENTS.md gives coding agents explicit setup, auth, and usage instructions to interpret and operate the API — beyond llms.txt's link index. |
| fail | Docs structured datavia docs | 0/8 | Neither JSON-LD nor OpenGraph/meta tags detected across 3 assessed pages (3 JS-rendered). Investigated: docs 0%. | Structured data (JSON-LD/schema.org) on docs pages gives agents an unambiguous parse target and is what answer engines cite. Detected on the JS-rendered head (Firecrawl) for a bounded page budget, so JS-injected JSON-LD is now caught; pages we can't render are excluded rather than failed. |
| na | Agent-navigable, token-efficient docs | —/22 | No surface produced evidence for this capability in this run. | Server-rendered, clean, small-footprint docs are what an agent can cheaply fetch and parse correctly. |
Agent UsabilityAgents have the context to use your APIs reliably, not just find them2 pass3 warn0 fail83A
| Signal | Points | Findings | Rationale | |
|---|---|---|---|---|
| pass | Idempotency documentedvia sdk | 27/27 | Built-in retry machinery is present (grep-derived). Investigated: sdk 100%, cli 25%, spec 0%, docs 0%. | Documented idempotency lets agents retry safely. |
| warn | Pagination documented & consistentvia sdk | 20.1/22 | 21/23 list method(s) return an auto-paginating iterable. Investigated: sdk 91%, spec 50%, docs 50%. | Consistent, documented pagination lets agents traverse collections. |
| pass | Sandbox separationvia sdk | 20/20 | Sandbox environments are exposed (sandbox). Investigated: sdk 100%, spec 0%, docs 0%. | An isolated environment lets agents exercise destructive operations safely. |
| warn | Rate-limit signalingvia spec | 8.8/22 | No rate-limit response headers documented. Investigated: spec 40%, docs 40%. | Machine-readable rate-limit headers let agents throttle adaptively. |
| warn | Runnable collection with test scriptsvia platform | 4.5/9 | No test scripts found in the workspace's collections. Investigated: platform 50%. | A public, maintained collection with assertions is runnable truth agents validate against. |
Resources Discovered
The public resources we found for Postman — the evidence behind the score. All discovered from public sources; nothing here requires access to your systems.
| Agent hints | Context7 (9,228) |
|---|---|
| APIs analyzed | 10 — Postman API, Reverse engineering an API, Postman Echo, Team Transfer, The Good Documentation Checklist, Copy a Workspace, Postman Assets Scaffolding, Import a HAR file, jeopardy-mongo: building and testing APIs, Visualizer Feature Templates |