Overrides API
Inject headers, query parameters, or body fields.
Overrides live on proxies and MCP servers. Path, header, query, body, and token matches are on Predicates. An override attaches to a proxy or a direct MCP server. A proxy-backed MCP server returns 409. Create the override on the backing proxy.
Applicable overrides are merged from lowest to highest priority. An override value replaces a caller header, query parameter, or JSON body field with the same key. When multiple overrides set one key, the highest-priority value wins. Keep secrets in target credentials, not override maps.
Endpoints
| Method | Path | What it does |
|---|---|---|
| GET | /api/clients/:clientId/proxies/:proxyId/overrides | List proxy overrides |
| POST | /api/clients/:clientId/proxies/:proxyId/overrides | Create a proxy override |
| PUT | /api/clients/:clientId/proxies/:proxyId/overrides/:overrideId | Update a proxy override |
| DELETE | /api/clients/:clientId/proxies/:proxyId/overrides/:overrideId | Delete a proxy override |
| GET | /api/clients/:clientId/mcps/:mcpId/overrides | List MCP overrides |
| POST | /api/clients/:clientId/mcps/:mcpId/overrides | Create an MCP override |
List overrides
GET /api/clients/:clientId/proxies/:proxyId/overrides returns the overrides on that proxy. The MCP path returns the same shape. Add /:overrideId to return one override.
Query parameters
None.
Response attributes
| Attribute | Type | Description |
|---|---|---|
overrides | array | One or more override objects. |
overrides[].sKey | string | Override id. Pass this as overrideId on other endpoints. |
overrides[].pKey / parentId | string | Proxy or direct MCP server id. |
overrides[].userId | string | Creator user id. |
overrides[].clientId | string | Organisation id. |
overrides[].overrideHeaders | object or null | Header names and values merged into the upstream request. |
overrides[].overrideQueryParams | object or null | Query names and values merged into the upstream request. |
overrides[].overrideData | object or null | JSON body fields merged into the upstream body. |
overrides[].overrideMode | string | "all" or "conditional". |
overrides[].effect | string or null | "include" or "exclude" when conditional. |
overrides[].overrideActive | boolean | Whether the override runs. |
overrides[].priority | number | Higher numbers are evaluated first. |
overrides[].methods | array or null | HTTP methods the override applies to, or null for all. |
overrides[].path | object or null | Path predicate. |
overrides[].query | array or null | Query-parameter predicates. |
overrides[].headers | array or null | Header predicates. |
overrides[].body | array or null | JSON body predicates. |
overrides[].token | array or null | JWT claim predicates. |
overrides[].variables | array or null | Variable bindings. |
overrides[].notes | string or null | Free-text note. |
overrides[].alerts | object or null | Digest policy. |
overrides[].overrideRegion | string | Region copied from the parent. |
overrides[].createdAt | string | ISO 8601 creation time. |
overrides[].updatedAt | string | ISO 8601 last update time. |
message | string | "Success". |
Create a proxy override
POST /api/clients/:clientId/proxies/:proxyId/overrides adds maps that are merged into the upstream request. Body overrides apply to JSON bodies.
Request
curl -X POST "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/overrides" \
-H "Authorization: u-your-token" \
-H "Content-Type: application/json" \
-d '{
"overrideMode": "all",
"overrideActive": true,
"overrideHeaders": {
"X-Source": "requestrocket"
}
}'import axios from "axios";
const response = await axios.request({
method: "POST",
url: "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/overrides",
headers: {
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data: {
"overrideMode": "all",
"overrideActive": true,
"overrideHeaders": {
"X-Source": "requestrocket"
}
}
});
console.log(response.status, response.data);import requests
response = requests.request(
"POST",
"https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/overrides",
headers={
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data="{\n \"overrideMode\": \"all\",\n \"overrideActive\": true,\n \"overrideHeaders\": {\n \"X-Source\": \"requestrocket\"\n }\n}"
)
print(response.status_code, response.json())package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
payload := strings.NewReader(`{
"overrideMode": "all",
"overrideActive": true,
"overrideHeaders": {
"X-Source": "requestrocket"
}
}`)
req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/overrides", payload)
req.Header.Set("Authorization", "u-your-token")
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(resp.StatusCode, string(body))
}import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Example {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/overrides"))
.method("POST", HttpRequest.BodyPublishers.ofString("{\n \"overrideMode\": \"all\",\n \"overrideActive\": true,\n \"overrideHeaders\": {\n \"X-Source\": \"requestrocket\"\n }\n}"))
.header("Authorization", "u-your-token")
.header("Content-Type", "application/json")
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode());
System.out.println(response.body());
}
}Responses
{
"overrides": [
{
"pKey": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
"sKey": "6a2d8f04-7c19-4e53-b0a8-3f5c1d9e7b42",
"userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
"clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
"parentId": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
"overrideRegion": "us-east-2",
"overrideHeaders": {
"X-Source": "requestrocket"
},
"overrideQueryParams": null,
"overrideData": null,
"overrideMode": "all",
"effect": null,
"overrideActive": true,
"methods": null,
"path": null,
"query": null,
"headers": null,
"body": null,
"token": null,
"variables": null,
"priority": 0,
"notes": null,
"alerts": null,
"createdAt": "2026-11-02T07:30:00.000Z",
"updatedAt": "2026-11-02T07:30:00.000Z"
}
],
"message": "Success"
}{
"message": "Input failed data validation",
"errors": [
"/overrideMode: must have required property 'overrideMode'"
]
}{
"Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}{
"message": "method / endpoint not supported"
}Returns an overrides array containing the created override, with message set to "Success".
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
overrideMode | string | ✓ | "all" merges the maps on every call. "conditional" uses the predicate. |
overrideActive | boolean | ✓ | When true, the override runs. |
overrideHeaders | object | — | Map of header name to string value, merged into the upstream request. |
overrideQueryParams | object | — | Map of query-parameter name to string value, merged into the upstream request. |
overrideData | object | — | Map of JSON field name to string value, merged into the upstream JSON body. |
effect | string | — | "include" applies the maps when the predicate matches. "exclude" applies them unless the predicate matches. Used when overrideMode is "conditional". |
methods | string[] | — | HTTP methods: "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", or "OPTIONS". Omit to match every method. |
path | object | — | Path check. Same shape as Predicates. |
query | object[] | — | Query-parameter checks. Same shape as Predicates. |
headers | object[] | — | Header checks. Same shape as Predicates. |
body | object[] | — | JSON body checks. Same shape as Predicates. |
token | object[] | — | JWT claim checks. Same shape as Predicates. |
variables | object[] | — | { name, source, key } bindings. source is "headers", "params", "body", "static", or "jwtClaim". See Predicates. |
priority | number | — | Evaluation order. A higher number is evaluated first. Defaults to 0. |
notes | string | — | Free-text note stored on the override. |
alerts | object | — | Digest policy. Shape: { enabled, cadence?, alertNote? }. enabled is required inside the object. cadence is "minute", "hour", "day", or "month", and is required when enabled is true. alertNote is at most 500 characters. |
The server sets pKey, sKey, userId, clientId, parentId, overrideRegion, createdAt, and updatedAt.
Returns an overrides array. The attributes match List overrides.
Update an override
PUT /api/clients/:clientId/proxies/:proxyId/overrides/:overrideId updates one override. The MCP path takes the same body.
All fields are optional. Omit a field to leave it unchanged; send null to clear it.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
overrideMode | string | — | "all" or "conditional". |
overrideActive | boolean | — | Whether the override runs. |
overrideHeaders | object | — | Map of header name to string value. Replaces the saved header map. |
overrideQueryParams | object | — | Map of query-parameter name to string value. Replaces the saved query map. |
overrideData | object | — | Map of JSON field name to string value. Replaces the saved body map. |
effect | string | — | "include" or "exclude". |
methods | string[] | — | HTTP methods: "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", or "OPTIONS". |
path | object | — | Path check. Same shape as Predicates. |
query | object[] | — | Query-parameter checks. Same shape as Predicates. |
headers | object[] | — | Header checks. Same shape as Predicates. |
body | object[] | — | JSON body checks. Same shape as Predicates. |
token | object[] | — | JWT claim checks. Same shape as Predicates. |
variables | object[] | — | { name, source, key } bindings. See Predicates. |
priority | number | — | Evaluation order. A higher number is evaluated first. |
notes | string | — | Free-text note. |
alerts | object | — | { enabled, cadence?, alertNote? }. When the saved policy has enabled: true, cadence is required. |
Returns an overrides array with the updated override. The attributes match List overrides. updatedAt is the time of this call.
Delete an override
DELETE /api/clients/:clientId/proxies/:proxyId/overrides/:overrideId removes the override. The response message is "Override deleted successfully".