A CEO Take

Agents get their abilities through APIs, which makes the API layer the place to control them. If you do not control your agents, your agents control your company.

Most organizations cannot yet say which agents they trust, what those agents can reach, who is accountable when one goes wrong, or what they cost. Gateways, key vaults, and wikis were built for applications and people, not for software that calls APIs around the clock.

Earlier this year we rebuilt Postman as an AI-native API platform. We shipped the API Catalog, a system of record for your APIs and services, and the Context Graph, which gives agents an authenticated, connected view of how those APIs and services relate. Together they are the foundation of our agentic stack.

That foundation matters because agents get their abilities through APIs. They gather data, take actions, retain memory, and interact with people and other agents, all through APIs. As agents become the primary consumers of APIs, the same foundation becomes the control plane for the agent economy, and enterprise computing needs a new infrastructure layer to match.

This issue covers what we’ve recently shipped, how we use it ourselves, and what our research shows.

Abhinav Asthana

Co-founder and CEO, Postman

What Shipped

Fabric is one gateway for every AI surface. It controls what agents can discover and do, with one policy model across HTTP, gRPC, MCP, and A2A. Try it now →

Passport lets developers and AI agents call approved APIs without exposing the secrets behind them. The key stays in your secret store and resolves only through a proxy inside your network. Try it now →

Postman Context Graph API helps expand your coding agent’s abilities beyond your codebase: across service boundaries, across repos, across environments. Trace downstream impact, identify affected consumers, and catch breaking changes before you merge every line of code. Learn more →

Site-wide licensing and Private Cloud. For organizations that want to buy and run Postman their way at scale while meeting security and regulation needs. Learn more →

In the Wild

“I’m far more comfortable saying yes to agentic actors in our systems.”

Sam Chehab, Head of Information Security at Postman

How Postman governs AI agent access to 42 production systems

Every new agent Postman built meant another API key on a laptop. An internal audit found 278 of them across developer machines, CI configurations, and deployment manifests, and some keys could do far more than the agent needed. We rolled out Passport in five days. The result is zero production credentials on developer machines, every call traced to a developer, an agent, and a run, even as the agent total grew from 32 to 70 agents.

Read the case study →
or go deeper with Sam’s walkthrough of his approach →

Read our latest case studies from Cisco Meraki, ICW, Rootly, and more.

Postman Research

From the Postman AI team.

Context Graph API Benchmarking Report. We tested three frontier models across an estate of 468 repositories. On one question, file search reached 129 services and the Context Graph returned 498. Accuracy improved in 18 of 21 prompt-model pairs. Read the report →

API Scoring Portal: Are your APIs ready for AI agents? Score how well agents like Claude, ChatGPT, and Cursor can find, read, and build with your APIs, then compare reports and see where you rank. Score your API →

What’s Next

Air-gapped Postman client. Runs entirely inside your network with no connection to Postman’s cloud. General availability is planned for early 2027.

Context Graph API on MCP. Coming shortly, so any MCP client you already run can query the graph as a tool.

Experience the control layer for your agents

Book a Demo

Thanks for reading.

Abhinav

You are receiving this because you opted in to Postman communications.

Postman, Inc. · One Market Plaza, Steuart Tower, Suite 0800 · San Francisco, CA 94105

Unsubscribe ·

Abhinav from Postman

Experience the control layer for your agents