Allow secure Postman collection retrieval through API call

[DennisR73]

Summary

Currently we offer two ways to retrieve Postman collections:

• Public shared collection
  • Pro's:
    • Simple. If a collection is updated and the JSON link is also updated the monitor automatically picks up the changes on the next cycle
  • Con's:
    • Insecure. The shared JSON link is publicly available and could contain sensitive information
  • Exported collection
  • Pro's:
    • Secure: The collection JSON file can be stored on storage where access from the monitor can be controlled
    • Controlled: Changes to the tests are not automatically released but need additional steps
  • Con's:
    • Complex. After every collection update the collection needs to be exported and updated on the secured storage location

As a third option we could allow the collection retrieval via the Postman API. The only things that would be needed as input are then Collection UID and an API key.

• Pro's:
  • Simple
  • Secure
• Con's:
  • Could be uncontrolled. Every saved change on the collection will be immediately picked up by the monitor.

curl -H "X-API-Key: PMAK-62c59xxxxxxx" https://api.getpostman.com/collections/742895-df2f2a6d-d344-43c1-a442-067a0c9d13b4

Implementation

Add two input variables:

• PM_API_KEY
• PM_COLLECTION_UID

Container configuration would either use PM_COLLECTION_URL or PM_API_KEY and PM_COLLECTION_UID.

During deployment the PM_API_KEY should be passed as a secure variable to ACI.

[DennisR73]

We could mitigate the uncontrolled deployment of changes in the API case by creating a flag on the container to only fetch the collection on start and not on every cycle. This way a container restart is required to load the new Collection.

[DennisR73]

Noticed there is a rate limit on the Postman API: 1000 / month on a free plan and 10.000 on a basic plan. Definitely need to consider this when pulling collections via the API