How to test API security throughout the API lifecycle with Postman and 42Crunch

Postman, the API collaboration platform for developers, advocates an API-First approach for companies. Using 42Crunch, API developers and application security teams can now implement API security design and testing as part of their API-First approach in Postman.

Kin Lane, chief Evangelist with Postman recently joined Isabelle Mauny, Field CTO at 42Crunch for a webinar to demonstrate how enterprises are automating the testing of API security for all their APIs.

Watch the webinar now

API Explosion: API-Last or API-First?

Kin pointed out that APIs have come a long way from the mid-90s when businesses such as eBay and Amazon first started to exploit the web using APIs. However, despite the fact that APIs are now everywhere, there is a strong distinction to be drawn between companies who are characterized as API-Last and those who are API-First.  Adopting an API-first strategy better prepares a business for the digital revolution impacting every industrial sector today.

API Contracts – OpenAPI and Postman Collections

Unfortunately the standards of API development vary widely and many are poorly built and left exposed to security vulnerabilities. Central to a successful API strategy is the adherence by the development teams to API contracts which define the documentation of the API that will ultimately be consumed by both internal and external customers. The OpenAPI specification and Postman Collections have evolved to assist companies build API contracts that help move APIs forward throughout the API lifecycle.

Shift-Left & Shield Right with Security as Code

Isabelle Mauny expanded on the concept of the API lifecycle and recommended that enterprises adopt a shift-left approach to protecting their APIs by introducing “security as code” as early as possible in the API design and development phases. Isabelle demonstrated how easy it is for developers to take control of implementing security as they code using 42 Crunch’s API audit and scan services that are pre-integrated into the developers’ favourite IDEs and CI/CD environments and now also integrated with Postman. Complementing this shift-left approach, is the 42Crunch API firewall that enforces API security policy at runtime. 

Watch the webinar now

Latest Resources


Webinar Series - Defending APIs with Jim Manico

Defending APIs with Jim Manico – Episode 1

Episode 1: Request Forgery on the Web – CSRF & SSRF

November 10, 2022 | 9am PST | 5pm BST

Join Jim Manico, CEO of Manicode and Colin Domoney from 42Crunch, as they deliver a 2-part webinar series to help developers better defend APIs.


42Crunch Announce OWASP Membership

42Crunch becomes a member of OWASP to Advance API Security 

By Newsdesk | November 14, 2022

November 14, 2022, San Francisco, CA –  42Crunch is pleased to announce our corporate membership of the Open Web Application Security Project (OWASP), a worldwide not-for-profit charitable organization focused on improving the security of software. At 42Crunch we have always been inspired by OWASP’s role as an enabler […]


Datasheet Cover Images P1-02

Product Datasheet Addressing API Security Challenges

APIs are the core building block of every enterprise’s digital strategy, yet they are also the number one attack surface for hackers. 42Crunch makes developers’ and security practitioners' lives easier by protecting APIs, with a platform that automates security into the API development pipeline and gives full oversight of security policy enforcement at every stage of the API lifecycle.

Ready to Learn More?

Developer-first solution for delivering API security as code.