Skip to content

v0.2.0

Release Date: 2026-10-27

This release adds OCSF export for Secret Scanner findings and fixes several places where the live Postman API returns data that the TypeScript-derived spec got wrong. It has one breaking change: users.Operation usage fields are now float64.

Highlights

  • OCSF export — the new ocsf package turns Secret Scanner findings into OCSF Detection Finding events for SIEMs and data lakes
  • Live API fixes — fractional usage values, null Secret Scanner fields, and the Secret Scanner's default page size now decode correctly
  • New guides — Exporting to OCSF and Testing, plus opt-in integration tests against the live API

Breaking Changes

users.Operation Usage, Limit, and Overage change from int to float64. Some metered operations report fractional values: /me returned a test_data_storage limit of 8.88, which made Users().Me fail.

me, err := client.Users().Me(ctx)
for _, op := range me.Operations {
    // v0.1.0: op.Limit was int
    // v0.2.0: op.Limit is float64
    fmt.Printf("%s: %.2f / %.2f\n", op.Name, op.Usage, op.Limit)
}

Upgrade Guide

  • users.Operation — change any code that treats Usage, Limit, or Overage as int to use float64, or convert with int(op.Limit) if you only need whole numbers.
  • Go 1.26 — the module now requires Go 1.26 or later (up from 1.25), because the OpenTelemetry dependencies were upgraded to v1.47.0.

OCSF Export

The ocsf package maps Secret Scanner results to OCSF Detection Finding events (class_uid 2004), using the types from ocsf-schema-go. It only maps data: it makes no HTTP calls and stores nothing.

res, err := client.SecretScanner().Query(ctx, nil)
if err != nil {
    return err
}
findings := ocsf.FromQueryResult(res, nil)
Function What you get
FromQueryResult, FromDetectedSecret One finding per detected secret
FromDetectedSecretWithLocations One resource per location, plus a deep link in finding_info.src_url
FromDetectedSecretEnriched Resource names, owners, and remediation text you supply
FromActivityFeed, FromActivityFeedEntry One event per resolution change

Status comes from the Postman resolution (ACTIVE → New, REVOKED → Resolved, FALSE_POSITIVE and ACCEPTED_RISK → Suppressed). Severity is a simple default based on workspace visibility, which you can overwrite with your own risk model. See Exporting Findings to OCSF for the full mapping.

Fixes

  • Secret Scanner default limit — when you didn't set a limit, Postman echoed its default page size back as a string ("limit":"30") and the decoder rejected it. Query and Locations now send limit=100, the API's maximum, when Limit is 0. This also means fewer round-trips when paging.
  • Secret Scanner nulls — for a secret that is still active, Locations returns null for meta.cursor and for the activity feed's resolvedAt and resolvedBy. These now decode as empty values instead of failing.
  • Fractional usage — Users().Me now decodes fractional operation values (see Breaking Changes).

These fixes are made in the spec generator, not by editing the generated spec. scripts/gen-openapi now has two per-field override lists: FLOAT_FIELDS (emit number/double instead of integer) and NULLABLE_FIELDS (add nullable: true). Because the overrides live in the generator, they survive the next regeneration. Each fix also has a unit test that replays the live response.

Testing

  • New decode regression tests replay the live response shapes above.
  • New integration tests call /me, workspaces, collections, and teams on the live API. They only read data and are skipped unless POSTMAN_API_KEY is set, so go test ./... stays offline. See Testing.

Dependencies

  • Added github.com/grokify/ocsf-schema-go v0.1.0
  • Bumped go.opentelemetry.io/otel, otel/metric, and otel/trace from 1.45.0 to 1.47.0
  • Bumped indirect dependencies (golang.org/x/*, go-colorable, shopspring/decimal)

Full Changelog

See CHANGELOG.md for the complete, commit-linked list of changes.