Postman Grep

API Reference

All endpoints accept and return JSON unless noted otherwise. Base URL:

POST /api/dumps

Search the dumps database by URL. Returns matching requests with metadata.

Parameter	Type	Required	Description
`query`	string	yes	Search substring matched against the `url` column (case-insensitive)
`limit`	integer	no	Max results, default 100, max 500

Response

{"query": "example.com", "total": 2, "has_more": false, "rows": [
  {"entityId": "123-abc", "name": "Get users", "url": "https://example.com/api/users",
   "method": "GET", "headers": "...", "auth": "...", "data": "...",
   "rawModeData": "...", "description": "...", "updatedAt": "2025-01-15 12:00:00"}
]}

POST /api/publishers

Search publishers by name, public handle, or public name.

Parameter	Type	Required	Description
`query`	string	yes	Search substring (case-insensitive)
`limit`	integer	no	Max results, default 200, max 1000

Response

{"query": "acme", "total": 1, "rows": [
  {"id": 12345, "type": "team", "name": "Acme Corp", "publicHandle": "acme",
   "publicName": "Acme Corp", "publicURL": "https://...", "profileURL": "https://...",
   "isPublic": true, "isVerified": true}
]}

POST /api/search

Full-text search across dump files on disk using ripgrep. Returns file list with metadata.

Parameter	Type	Required	Description
`pattern`	string	yes	Regex pattern for ripgrep
`file_extensions`	string[]	no	Filter by file extensions, e.g. `["json"]`

Response

{"pattern": "api[_-]?key", "total": 42, "files": [
  {"path": "123-abc.json", "size": 8192, "mtime": 1700000000}
]}

GET /api/dump/<entity_id>

Read the raw dump of a specific collection from disk.

Parameter	Type	Required	Description
`entity_id`	string (path)	yes	Collection entity ID, e.g. `12345678-abcd-1234-efgh-123456789abc`

Response

{"entityId": "12345678-abcd-...", "data": { ... full collection dump ... }}

GET /postmangrep?pattern=...

Search dump files and download matching results as a streaming .tar archive.

Parameter	Type	Required	Description
`pattern`	string (query)	yes	Regex pattern for ripgrep

Returns: application/x-tar streamed attachment.

GET /xpostman/collections?ts=...

Download all collection metadata files newer than the given timestamp as a streaming archive.

Parameter	Type	Required	Description
`ts`	integer (query)	yes	Unix timestamp — only files created after this time are included

Returns: application/zip or application/gzip streamed attachment.

GET /xpostman/dumps?ts=...

Download all dump files newer than the given timestamp as a streaming archive.

Parameter	Type	Required	Description
`ts`	integer (query)	yes	Unix timestamp — only files created after this time are included

Returns: application/zip or application/gzip streamed attachment.

GET /health

Service health check. Returns search engine status.

Response

{"status": "healthy", "ripgrep_available": true,
 "search_method": "ripgrep", "zipstream_available": true}

Postman Leaked Data Search

Postman is a widely-used API development and testing platform. Developers use it to craft HTTP requests, organize them into collections, and share those collections with teammates. Postman workspaces can be made public to showcase APIs, share examples, or collaborate with the community.

How sensitive data ends up in Postman

In practice, developers frequently embed real credentials and secrets directly into their Postman requests and environments:

API keys and tokens — hardcoded in headers, query parameters, or request bodies for convenience during development and testing.
Authentication credentials — usernames, passwords, OAuth tokens, and JWT secrets stored in collection variables or environment configs.
Internal endpoints — URLs pointing to staging, development, or production infrastructure that reveal the internal network topology.
Database connection strings — including hostnames, ports, and credentials for databases, caches, and message brokers.
Cloud provider secrets — AWS access keys, GCP service account tokens, Azure connection strings, and similar cloud credentials.
Webhook URLs and signing secrets — Slack webhooks, payment gateway keys, and third-party integration tokens.

These secrets leak when a developer accidentally publishes a workspace or collection as public, or when a previously-private workspace is toggled to public visibility without sanitizing its contents first.

Security implications

Exposed Postman data presents a dual-use concern:

For attackers — leaked credentials provide direct access to APIs, cloud infrastructure, databases, and internal services. A single exposed API key can lead to data exfiltration, account takeover, lateral movement, or full infrastructure compromise.
For security auditors — Postman collections are a valuable source for asset discovery and perimeter enumeration. They reveal undocumented API endpoints, internal hostnames, technology stacks, and forgotten credentials that may not appear in traditional reconnaissance.

About this service

This tool continuously collects and indexes publicly available Postman collections and their contents. It provides full-text search across dumped request data, publisher lookup, and bulk export capabilities — enabling security teams to quickly identify exposed credentials and assess organizational exposure through Postman.