Postman Workspace Sharing: Missing Confirmation Prompt for Public Visibility

Answer to the core question

Postman does not currently show a mandatory confirmation dialog when a workspace is switched to public visibility. The action is immediate, and a toast/banner appears only after the share completes.

Likely explanation

Postman’s sharing flow treats the visibility change as a direct action. The product relies on a post‑action notification (toast/banner) to inform the user that the workspace is now public, rather than inserting an intermediate confirmation step.

Confirmed facts (based on observed behavior up to version 10.20.x)

• Opening the Share dialog, selecting “Public”, and clicking “Share Workspace” executes the change without any modal prompt.
• A transient banner/toast appears afterward stating that the workspace is now public.
• This behavior is consistent in both the desktop application and the web client.
• No built‑in setting exists to enable a confirmation prompt or to require admin approval for public shares.
• There is no automatic expiration or revocation mechanism for the generated public link; the link remains valid until manually revoked or the workspace visibility is changed back.

Steps to verify the current behavior

1. Open any workspace (create a test workspace with dummy data if desired).
2. Click the Share button in the top‑right corner.
3. In the sharing pane, set the Visibility dropdown to Public.
4. Press the Share Workspace button.
5. Observe that no confirmation dialog appears before the action is executed.
6. Notice a toast/banner that confirms the workspace is now public.

Recommendations for addressing the security concern

If your organization wants to prevent inadvertent public exposure, consider the following options:

• Team‑level admin approval (if available): On Postman Team or Enterprise plans, administrators can restrict who can change workspace visibility via the Admin console. Enabling a policy that only admins may set a workspace to Public adds an approval step without affecting every user’s workflow.
• Manual verification workflow: Before clicking “Share Workspace”, reviewers can double‑check the visibility setting and the contents of the workspace. A simple checklist (e.g., “No API keys or credentials in collections”) can be added to your team’s internal SOP.
• Link revocation practice: Treat the public link as a temporary resource. After sharing, periodically revisit the Share dialog and switch the visibility back to Private or Team to revoke the link. Document this as a post‑share step in your process.
• Feature request: If a confirmation dialog or admin‑approval toggle is required, submit a feature request through Postman’s support portal, referencing the need for an optional team‑level setting that requires admin approval for public shares.

Missing diagnostic detail that could change the recommendation

Knowing whether you are on a Postman Free, Team, or Enterprise plan would determine if the admin‑approval policy option is available to you. If you are on a Free plan, the only practical mitigations are manual verification and manual link revocation.