---
title: Postman
slug: docs/postman
icon: {"faIcon":"fa-solid fa-user-astronaut"}
docTags: 
createdAt: 2025-02-14T17:34:33.201Z
---

# Postman

:::BlockQuote
**Edition:** Enterprise + Open Source
:::

The Postman integration scans workspaces, collections, requests, and authorization configurations in Postman for credentials and other sensitive data.

## Configuration

The Postman integration can be configured in TruffleHog under **Integrations**, or via a local configuration file (below). Setup requires a Postman API key and, optionally, the IDs of the workspaces you want to scan.

**Generating a Postman API key.** Log into Postman and go to the API keys page. Set the expiration as needed and click **Generate API Key**.

**Finding a Workspace ID.** Open the workspace in Postman and click the **⋯** menu on the far right of the page to view its ID.

![](https://api.archbee.com/api/optimize/y4okhwqsFjhjAYx3urv7j-29X_d_m7w8noPmiI2osdY-20250219-224147.jpeg)

### Web configuration

Configure this integration from the **Integrations** page in TruffleHog. You'll need a Postman API key and the IDs of the workspaces you want to scan.

### Local configuration

Multiple workspace IDs can be included. If workspaces is omitted, the scanner enumerates and scans every workspace the API key has access to.

:::BlockQuote
sources:
  \- connection:
      "@type": type.googleapis.com/sources.Postman
      token: PMAK-XXXXXXX
      workspaces:
&#x20;       \- \<workspace-id-1>
&#x20;       \- \<workspace-id-2>
&#x20;   name: Postman
&#x20;   scanPeriod: 12h
&#x20;   type: SOURCE\_TYPE\_POSTMAN
&#x20;   verify: true
:::

## Configuration options

| Field      | Type   | Required | Description                                                                                              |
| ---------- | ------ | -------- | -------------------------------------------------------------------------------------------------------- |
| token      | string | Yes      | Postman API key.                                                                                         |
| workspaces | list   | No       | Explicit list of Postman Workspace IDs to scan. Omit to enumerate all workspaces the API key can access. |

## Capabilities

| Feature                                                                              | Supported |
| ------------------------------------------------------------------------------------ | --------- |
| Scan workspaces                                                                      | ✅         |
| Scan collections                                                                     | ✅         |
| Scan folders                                                                         | ✅         |
| Scan requests                                                                        | ✅         |
| Scan saved responses                                                                 | ✅         |
| Scan environments                                                                    | ✅         |
| Scan authorization configurations (Basic Auth, Bearer Tokens, API Keys, AWS, OAuth2) | ✅         |

## Notes

- The globals environment, workspace response history, and collection descriptions are not scanned.