The Postman API client, Spec Hub, Collection Runner, Agent Mode, and the Postman MCP server already build, test, and govern APIs across nearly half a million organizations. This page proposes one addition: an independent, signed receipt for each consequential API-lifecycle action, so that a request result, a collection run, an agent tool call, or a governance check is provable to a partner, an auditor, or a customer. Every demo on this page runs here, in your browser. Request data, secrets, and specs stay. Only the proof crosses.
The proof is in the provenance. It does not judge.
Each surface below is a capability Postman publicly documents. The receipt does not change how the surface works. It attaches independent proof that the action happened the way the platform said, without moving the request body, the response, the secret, or the spec underneath.
Every request through the Postman client produces a status, timing, and body. A signed receipt binds a fingerprint of the request and response to the environment and policy in force, so a partner can prove what a call returned without seeing the payload.
The Collection Runner executes ordered requests, chained variables, and test assertions, ending in a test run summary. A receipt captures the ordered check outcomes and the chained-variable lineage as one signed vector a CI reviewer can re-verify offline.
Agent Mode turns natural language into API-lifecycle actions, grounded in your collections, specs, and history. Each agent tool call can carry a signed receipt of which tool ran under which approval, complementing the secret and PII redaction guardrails Postman already applies.
The Postman MCP server connects MCP-compatible agents to 100+ Postman tools across collections, environments, and workspaces. A receipt makes each MCP tool invocation independently attestable, so an agent's action on a workspace is provable after the fact.
Postman applies contract-first governance and configurable rules, with automated compliance scanning against agreed standards. A receipt records which rule ran on which spec version and the pass or fail, producing portable governance evidence.
Spec Hub, version control, and the changelog track how an API definition evolves across a workspace. A receipt binds each spec change to the actor and the prior content root, so an API's provenance is provable without exporting the definition.
Prepared for Postman as a proposed architecture. Product facts are public and source-linked in the evidence section below, and should be re-verified before external use.
Left of the line is everything inside the Postman and customer boundary. Right of the line is a partner, an auditor, or a customer. Watch what actually crosses.
Every square that crosses is a receipt, not a record. The count of secret and payload bytes that crossed is always zero. That is the whole design.
Sliders are yours to set. This is arithmetic on numbers you enter, not a forecast, a quote, or a claim about Postman's real volumes.
Whatever you put in those sliders, the last number is always zero. Proof bytes scale with actions; payload and secret bytes moved do not scale at all.
This widget builds a real signed receipt for a Postman collection-run action, verifies it in your browser, lets you tamper with a byte and watch the check fail, re-verifies from pasted JSON, and re-checks a published 5,000-frame routine soak. The signing engine is bundled and served from this same domain. Open your network tab: after load, it makes zero outbound calls except the two same-origin JSON fetches it names.
In-browser · offline The offline verifier never leaves this page except to fetch its own sample and bench file from this domain.
Every click prints the recomputed hash next to the stored hash, one line per layer. A changed byte reads FAIL in the same output; a clean receipt reads PASS. Success is labelled, never color alone. There is no server round-trip. The same engine ships as an offline command-line kit that is byte-identical to what runs here.
This is a self-contained runner that behaves like a small Collection Runner pass: an ordered set of requests, individual test checks, a variable chained from one request into the next, and a test run summary. Each pass is folded into one signed receipt you can tamper with and export. It runs deterministically in this tab and calls no Postman API, so nothing depends on an account or a login.
In-browser · deterministic The runner executes a fixed, Postman-shaped collection locally. Request and response bodies are hashed into the receipt; the bodies themselves never cross to Hive.
The collection here mirrors the two downloadable Postman collections in the collections section: relay a receipt event, group into an R3Pv vector, assess a protected API action, export evidence. The runner proves the pattern with no account; the downloadable collections run the same pattern inside Postman itself.
This is different from the offline verifier and runner by design. It drives the real Hive receipt primitives in a Postman-shaped sequence: relay a signed API request event, group it into a proof vector (R3Pv), run a Protected Flow assessment under a strict API policy pack, and export a signed evidence bundle. No account, no key, no payment beyond the calls you trigger. No payload moves and Hive never calls a Postman API.
Network state: unknown This leaves your browser and hits receipts.thehiveryiq.com. If the call is blocked by CORS or offline, the widget runs a truthful local cryptographic fallback and labels it clearly. It does not fake a live success.
The Postman-shaped payload carries an API request event kind and method only, never a secret or a body. Curl the same sequence yourself:
Plain English. Each part closes a gap a self-written test log leaves open. These are the four Filings under InkFrame v1, the same four the verifier above exercises.
Organized around the Postman surfaces this page names. Everything under Running now is live today (the verifier, runner, and live workflow above exercise it). Everything under Expansion offerings is a surface Hive could stand up with Postman, not a service running yet.
The four Filings under InkFrame v1 are the fastest path in. The canon is broader. This is the whole map, kept on this page: each primitive, the Postman surface it fits, what it does now, and what it could do next.
| Hive primitive | Postman surface | State | What it does |
|---|---|---|---|
| InkFrame v1 | All surfaces | Running now | The signed receipt frame: content-addressed roots plus a hybrid Ed25519 + ML-DSA-65 signature. The verifier above builds and checks one. |
| Proof Pre-Fill | API client · Runner | Running now | Filing A. The receipt is attached at the moment of the request or run, so it adds no delay to a Collection Runner pass. |
| InkFrame Non-Mutation | Spec Hub · testing | Running now | Filing B. One changed byte fails the check. This is the tamper test in the verifier and the runner. |
| Disclosure-Free Replay | Runner · governance | Running now | Filing C. Reconstruct the run's route from fingerprints alone, with no request body or secret. |
| Arrival Countersignature | Agent Mode · MCP | Running now | Filing D. The gateway countersigns on arrival, so what ran is what was cleared. |
| Receipt Relay | API client · Runner | Running now | Signs an event into a portable receipt. Step 1 of the live workflow above. |
| R3Pv proof vector | Collection Runner | Running now | Groups signed receipts into one signed vector: verification, policy, healing, routing, and permitted next action. |
| Protected Flow | Governance · Runner | Running now | Turns the vector into a signed decision (permit, hold, recover, escalate) under a policy pack, with a meter quote. No payload moves. |
| Evidence Export | Governance · CI | Running now | Bundles the vector, assessment, receipts, and pubkeys into a signed bundle a reviewer re-verifies offline. |
| Carnac™ | Agent Mode | Running now | Sizes how much proof an action deserves. It does not judge. |
| CarnacPrompt™ | Agent Mode | Running now | Fingerprints the prompt as a one-way SHA-256, never the words. |
| Carnac Gateway™ | MCP server | Running now | The gateway that countersigns agent and MCP tool traffic on arrival. |
| Carnac Live Ink™ | Agent Mode · client | Running now | Live-streamed proof ink for an in-progress action, sealed as it runs. |
| SmartAgent route proof | Agent Mode · MCP | Expansion | Proof for multi-step agent behavior across a tool route. |
| Protected Flow Fleets | MCP server | Expansion | Fleet-scale protected-flow decisions across many concurrent agent runs. |
| AFiR-Stream | Collection Runner | Expansion | Streaming receipt proof for high-volume CI run batches. |
| OriginProof | Spec Hub | Expansion | Origin attestation for API definitions and governance rule sets. |
| PPR · SRPR | Governance · distribution | Expansion | Provenance and settlement receipts for published API artifacts. |
| Sovereign Receipt Registry | Enterprise · audit | Expansion | Jurisdiction-held or customer-held receipt registry. |
| Provable Machines | Postman CLI · CI | Expansion | Build-time control-execution receipts for pipeline runs. |
Running now surfaces are exercised by the verifier, runner, and live workflow on this page. Expansion surfaces are options to weigh with counsel and Postman's engineering and security functions; none is a live service today.
These two collection files run the same relay, R3Pv, and Protected Flow pattern the in-page runner demonstrates, but inside Postman itself. They are a secondary path: the primary demos above need no account. Import either file into Postman, or check below that each returns HTTP 200 and parses as valid Postman collection JSON, fetched from this same domain.
hive-r3pv.postman_collection.json
Receipts, proof vectors, and signed decisions. Relay an event, group into R3Pv, derive the vector, assess under a policy pack, export evidence.
hive-protected-flow.postman_collection.json
Signed decisions plus meter quote. Assess a protected API action under a strict policy pack and export a signed evidence bundle.
These are Postman's own words and docs, public as of July 2026. Hive draws no conclusion about Postman beyond what these state, and does not imply Postman is a customer, partner, or endorser.
Is there room, beside the API client, Collection Runner, Agent Mode, and MCP server Postman already runs, for an independent proof service that signs each consequential API-lifecycle action and never moves the request data, secrets, or specs underneath? Not instead of anything Postman built. A neutral layer that makes an API action provable to a partner, an auditor, and a customer.