🔘Pynt for Newman (Postman CLI)

Run Pynt API security tests on a locally stored postman collection from a terminal

What is Newman?

💡 Newman is the CLI tool for running Postman collections. It enables you to automate and integrate API tests directly into your CI/CD pipelines.

Newman

---

Pynt's Integration with Newman

As part of its API security testing suit, Pynt allows seamless integration with Newman.

Pynt for Newman allows you to integrate advanced API security testing directly into your command-line workflows. By combining the power of Newman with Pynt, you can automate security scans alongside your regular API tests, ensuring that each API run is thoroughly tested for vulnerabilities.

With Pynt’s context-aware security testing capabilities, you can enhance your Postman collections with automated security checks, all executed via Newman. This integration is perfect for teams looking to streamline their security testing within their existing CI/CD processes, providing a seamless way to ensure that your APIs are protected against potential threats.

After each run, Pynt generates detailed reports that highlight any security risks found during testing, giving you the insights needed to address vulnerabilities promptly. By integrating Pynt with Newman, you can maintain the flexibility and efficiency of your command-line testing while significantly boosting your API security.

---

Setup

1. First, make sure Pynt's prerequisites are met.

2. Follow the instructions to install Pynt container here.

---

Run Pynt CLI Command for Newman

Basic usage

pynt newman --collection <path to collection>

Required arguments

--collection - Postman collection file name

Optional arguments

--environment - Postman environment file name (support multiple files)
--reporters output results to json
--host-ca - path to the CA file in PEM format to enable SSL certificate verification for pynt when running through a VPN.
--return-error - 'all-findings' (warnings, or errors), 'errors-only', 'never' (default), 

---

Example

wget https://raw.githubusercontent.com/pynt-io/pynt/main/goat_functional_tests/goat.postman_collection.json
pynt newman --collection goat.postman_collection.json

---

mTLS Support (Pynt binary only)

Pynt newman supports testing APIs that require mutual TLS (mTLS), allowing you to validate security for endpoints that enforce client certificate authentication.

To run a security test on an mTLS-protected API using Pynt Newman, use the --ssl-client-cert, --ssl-client-key, and --ssl-ca-cert flags to provide the necessary certificates.

Example

pynt newman --collection collection/goat-mtls.postman_collection.json \
  --tls-client-cert certs/client-bundle.pem \
  --tls-client-key certs/client.key \
  --host-ca certs/root.crt \

Arguments

• --tls-client-cert — Path to the client certificate (PEM format, can include full chain)

• --tls-client-key— Path to the client private key

• --host-ca— Path to the CA certificate used to validate the server certificate

Specifying Environment variables (Pynt binary only)

To define environment variables for the collection via the command line in a key=value format, use the --newman-env-var flag. You can specify one variable per flag, or include multiple flags wrapped in quotes. For example:

pynt newman --collection goat.postman_collection.json \\ 
--newman-env-var="key1=test1,env2=test" --newman-env-var v1=v2
# This will run the collection with the following env vars:
# key1=test1
# env2=test
# v1=v2

💡 Pynt CLI Troubleshooting: If you're encountering issues with Pynt's CLI, visit the Pynt CLI Troubleshooting Guide for solutions and troubleshooting tips.

💡 Still Need Help? For any questions or troubleshooting, reach out to the Pynt Community Support.