{"id":1884,"date":"2025-10-30T14:07:46","date_gmt":"2025-10-30T21:07:46","guid":{"rendered":"http:\/\/10kdev.net\/?p=1884"},"modified":"2025-10-30T14:07:46","modified_gmt":"2025-10-30T21:07:46","slug":"generating-openapi-and-postman-collections-with-q","status":"publish","type":"post","link":"http:\/\/10kdev.net\/?p=1884","title":{"rendered":"Generating OpenAPI and PostMan Collections with Q"},"content":{"rendered":"

Generating out descriptive schema for your existing applications that AI can well.<\/p>\n

Working on a Grails API application, I am using with BurpSuite DAST to do some security testing on a regular basis for it. I’ve needed an API list of endpoints for their API security scan feature for quite some time, that’s easy to maintain.\u00a0 We don’t have any maps of the APIs, annoying, so I thought I would ask Amazon Q to make OpenAPI bill of endpoints as well as a Postman collection of them for good measure.<\/p>\n

\n

OpenAPI<\/a> is a specification for making a kind of “schema” for your APIs.<\/p>\n

Postman<\/a> is a tool for building and testing APIS.<\/p>\n

BurpSuite DAST<\/a> – dynamic application security testing – is owned by PortSwigger.\u00a0 It’s good for penetration testing.<\/p>\n<\/blockquote>\n

\u00a0<\/p>\n

Here are the prompts I asked after opening my project:<\/p>\n

    \n
  1. can you make a postman collect of the apis in <myproject><\/li>\n
  2. can you also make an OpenAI 3.0 definition, both json and yaml<\/li>\n<\/ol>\n

    Voila – have my three files.<\/p>\n

    BurpSuite added an extra selection for an API scan type, and I hadn’t been able to use it until I had the catalog of API endpoints.<\/p>\n\n\n

    \"\"<\/a><\/figure>\n\n\n\n

    BurpSuite can take these formats to describe APIs:<\/p>\n\n\n\n

    SOAP WSDL, Postman Collection, or an OpenAPI definition in YAML or JSON format.<\/p>\n\n\n\n

    \"\"<\/a><\/figure>\n\n\n\n

    I like to work with yaml files as I work with some devops type things, Docker, and AI Specs (that use markup, I find more akin to yaml). But for grins I generated out both formats, and then the Postman collection. I didn’t try the wsdl.<\/p>\n\n\n\n

    Example content:<\/p>\n\n\n\n

    openapi: 3.0.0\ninfo:\n  title: Product Management API\n  version: 1.0.0\n  description: A sample API for managing products.\nservers:\n  - url: https:\/\/api.example.com\/v1\n    description: Production server\n  - url: http:\/\/localhost:8080\/v1\n    description: Development server\ntags:\n  - name: Products\n    description: Operations related to products\npaths:\n  \/products:\n    get:\n      tags:\n        - Products\n      summary: Get all products\n      operationId: getAllProducts\n      responses:\n        '200':\n          description: A list of products\n          content:\n            application\/json:\n              schema:\n                type: array\n                items:\n                  $ref: '#\/components\/schemas\/Product'\n    post:\n      tags:\n        - Products\n      summary: Create a new product\n      operationId: createProduct\n      requestBody:\n        required: true\n        content:\n          application\/json:\n            schema:\n              $ref: '#\/components\/schemas\/NewProduct'\n      responses:\n        '201':\n          description: Product created successfully\n          content:\n            application\/json:\n              schema:\n                $ref: '#\/components\/schemas\/Product'\n\n< and so forth .... ><\/code><\/pre>\n\n\n\n
    Here’s the file loaded into BurpSuite:<\/p>\n\n\n\n
    \"\"<\/a><\/figure>\n\n\n\n
    Then you can add authentication if you need to:<\/p>\n\n\n\n
    \"\"<\/a><\/figure>\n\n\n\n
    The Postman collection looks like this.  It actually can import an OpenAPI spec and output a Postman collection.<\/p>\n\n\n\n
    \t\"info\": {\n\t\t\"_postman_id\": \"e2c42dd8-dabe-44fd-b90c-9136d35d9167\",\n\t\t\"name\": \"Product Management API\",\n\t\t\"description\": \"A sample API for managing products.\",\n\t\t\"schema\": \"https:\/\/schema.getpostman.com\/json\/collection\/v2.1.0\/collection.json\",\n\t\t\"_exporter_id\": \"6514261\"\n\t},\n\t\"item\": [\n\t\t{\n\t\t\t\"name\": \"products\",\n\t\t\t\"item\": [\n\t\t\t\t{\n\t\t\t\t\t\"name\": \"{productId}\",\n\t\t\t\t\t\"item\": [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\"name\": \"Get a product by ID\",\n< and so forth ... ><\/code><\/pre>\n\n\n\n
    Postman Collection loaded into Postman tool — ready for use:<\/p>\n\n\n\n
    \"\"<\/a><\/figure>\n\n\n\n
    So anyway, after you have this all loaded up into BurpSuite — you can run your scan job on the endpoints and hopefully nothing major to fix.<\/p>\n\n\n\n
    \"\"<\/a><\/figure>\n\n\n\n
    \n\n\n\n
    The product test file I generated with the AI in my Chrome browser is in the following file.  You can test BurpSuite with it or import it into Postman.<\/p>\n\n\n\n
    Product_OpenAPI.yaml_<\/a>Download<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"
    Generating out descriptive schema for your existing applications that AI can well. Working on a Grails API application, I am using with BurpSuite DAST to do some security testing on a regular basis for it. I’ve needed an API list of endpoints for their API security scan feature for quite some time, that’s easy to […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[97,1],"tags":[],"_links":{"self":[{"href":"http:\/\/10kdev.net\/index.php?rest_route=\/wp\/v2\/posts\/1884"}],"collection":[{"href":"http:\/\/10kdev.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/10kdev.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/10kdev.net\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/10kdev.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1884"}],"version-history":[{"count":4,"href":"http:\/\/10kdev.net\/index.php?rest_route=\/wp\/v2\/posts\/1884\/revisions"}],"predecessor-version":[{"id":1897,"href":"http:\/\/10kdev.net\/index.php?rest_route=\/wp\/v2\/posts\/1884\/revisions\/1897"}],"wp:attachment":[{"href":"http:\/\/10kdev.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1884"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/10kdev.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1884"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/10kdev.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1884"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}