Request transforms API
Create a transform that runs before the target call.
Request and response transforms share /transforms. Set transformType to request or response. A list returns both. Response transforms are on Response transforms. Path, header, query, body, and token matches are on Predicates. A transform attaches to a proxy or a direct MCP server. A proxy-backed MCP server returns 409. Create the transform on the backing proxy.
Endpoints
| Method | Path | What it does |
|---|---|---|
| GET | /api/clients/:clientId/proxies/:proxyId/transforms | List request and response transforms |
| POST | /api/clients/:clientId/proxies/:proxyId/transforms | Create a transform. Set transformType to request |
| GET | /api/clients/:clientId/proxies/:proxyId/transforms/:transformId | Read a transform, including its code |
| PUT | /api/clients/:clientId/proxies/:proxyId/transforms/:transformId | Update a transform |
| DELETE | /api/clients/:clientId/proxies/:proxyId/transforms/:transformId | Delete a transform |
| GET | /api/clients/:clientId/mcps/:mcpId/transforms | List MCP transforms of both types |
| POST | /api/clients/:clientId/mcps/:mcpId/transforms | Create an MCP transform |
List transforms
GET /api/clients/:clientId/proxies/:proxyId/transforms returns request and response transforms for that proxy. The MCP path returns the same shape. The list omits code. GET .../transforms/:transformId returns one transform and includes code.
Query parameters
None.
Response attributes
| Attribute | Type | Description |
|---|---|---|
transforms | array | One or more transform objects. |
transforms[].sKey | string | Transform id. Pass this as transformId on other endpoints. |
transforms[].pKey / parentId | string | Proxy or direct MCP server id. |
transforms[].userId | string | Creator user id. |
transforms[].clientId | string | Organisation id. |
transforms[].transformType | string | "request" or "response". |
transforms[].transformMode | string | "all" or "conditional". |
transforms[].effect | string or null | "include" or "exclude" when conditional. |
transforms[].transformActive | boolean | Whether the transform runs. |
transforms[].priority | number | Higher numbers are evaluated first. |
transforms[].methods | array or null | HTTP methods the transform applies to, or null for all. |
transforms[].path | object or null | Path predicate. |
transforms[].query | array or null | Query-parameter predicates. |
transforms[].headers | array or null | Header predicates. |
transforms[].body | array or null | JSON body predicates. |
transforms[].token | array or null | JWT claim predicates. |
transforms[].variables | array or null | Variable bindings. |
transforms[].notes | string or null | Free-text note. |
transforms[].alerts | object or null | Digest policy. |
transforms[].code | string | Transform function source. Present on single read, create, and update. Absent from list. |
transforms[].transformRegion | string | Region copied from the parent. |
transforms[].createdAt | string | ISO 8601 creation time. |
transforms[].updatedAt | string | ISO 8601 last update time. |
message | string | "Success". |
Create a request transform
POST /api/clients/:clientId/proxies/:proxyId/transforms saves the function. Set transformType to request. Mode all runs on every call. Mode conditional uses a predicate.
Request
curl -X POST "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms" \
-H "Authorization: u-your-token" \
-H "Content-Type: application/json" \
-d '{
"transformType": "request",
"transformMode": "all",
"transformActive": true,
"code": "export default function transform(proxyContext, proxyRequest) { return { ...proxyRequest, headers: { ...proxyRequest.headers, '\''x-request-path'\'': proxyContext.path } }; }"
}'import axios from "axios";
const response = await axios.request({
method: "POST",
url: "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms",
headers: {
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data: {
"transformType": "request",
"transformMode": "all",
"transformActive": true,
"code": "export default function transform(proxyContext, proxyRequest) { return { ...proxyRequest, headers: { ...proxyRequest.headers, 'x-request-path': proxyContext.path } }; }"
}
});
console.log(response.status, response.data);import requests
response = requests.request(
"POST",
"https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms",
headers={
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data="{\n \"transformType\": \"request\",\n \"transformMode\": \"all\",\n \"transformActive\": true,\n \"code\": \"export default function transform(proxyContext, proxyRequest) { return { ...proxyRequest, headers: { ...proxyRequest.headers, 'x-request-path': proxyContext.path } }; }\"\n}"
)
print(response.status_code, response.json())package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
payload := strings.NewReader(`{
"transformType": "request",
"transformMode": "all",
"transformActive": true,
"code": "export default function transform(proxyContext, proxyRequest) { return { ...proxyRequest, headers: { ...proxyRequest.headers, 'x-request-path': proxyContext.path } }; }"
}`)
req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms", payload)
req.Header.Set("Authorization", "u-your-token")
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(resp.StatusCode, string(body))
}import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Example {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms"))
.method("POST", HttpRequest.BodyPublishers.ofString("{\n \"transformType\": \"request\",\n \"transformMode\": \"all\",\n \"transformActive\": true,\n \"code\": \"export default function transform(proxyContext, proxyRequest) { return { ...proxyRequest, headers: { ...proxyRequest.headers, 'x-request-path': proxyContext.path } }; }\"\n}"))
.header("Authorization", "u-your-token")
.header("Content-Type", "application/json")
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode());
System.out.println(response.body());
}
}Responses
{
"transforms": [
{
"pKey": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
"sKey": "3e7b1a58-0d46-4c92-8f1a-2b6d4e9c0a75",
"userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
"clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
"parentId": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
"transformRegion": "us-east-2",
"transformType": "request",
"transformMode": "all",
"effect": null,
"transformActive": true,
"priority": 0,
"notes": null,
"alerts": null,
"createdAt": "2026-11-02T07:30:00.000Z",
"updatedAt": "2026-11-02T07:30:00.000Z",
"code": "export default function transform(proxyContext, proxyRequest) { return { ...proxyRequest, headers: { ...proxyRequest.headers, 'x-request-path': proxyContext.path } }; }"
}
],
"message": "Success"
}{
"message": "code is required"
}{
"Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}{
"message": "method / endpoint not supported"
}Returns a transforms array containing the saved transform, including code, with message set to "Success".
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
transformType | string | ✓ | "request" or "response". This page uses "request". Response transforms are on Response transforms. |
transformMode | string | ✓ | "all" runs on every call. "conditional" uses the predicate. |
transformActive | boolean | ✓ | When true, the transform runs. |
code | string | ✓ | Default-exported function called as (proxyContext, proxyRequest). Return an object containing any changed method, relative url, headers, params, or data. Imports, require, fetch, and process are rejected. At most 512 KB. |
effect | string | — | "include" runs when the predicate matches. "exclude" runs unless the predicate matches. Used when transformMode is "conditional". |
methods | string[] | — | HTTP methods: "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", or "OPTIONS". Omit to match every method. |
path | object | — | Path check. Same shape as Predicates. |
query | object[] | — | Query-parameter checks. Same shape as Predicates. |
headers | object[] | — | Header checks. Same shape as Predicates. |
body | object[] | — | JSON body checks. Same shape as Predicates. |
token | object[] | — | JWT claim checks. Same shape as Predicates. |
variables | object[] | — | { name, source, key } bindings. A request transform uses "headers", "params", "body", "static", or "jwtClaim". See Predicates. |
responseHeaders | object[] | — | Response header checks. Used when transformType is "response". Same shape as Predicates. |
responseBody | object[] | — | Response body checks. Used when transformType is "response". |
responseStatus | object[] | — | Response status checks. Used when transformType is "response". Each item is { value, presence }. value is { pattern, flags? }. presence is "must_exist" or "must_absent". |
priority | number | — | Evaluation order. A higher number is evaluated first. Defaults to 0. |
notes | string | — | Free-text note stored on the transform. |
alerts | object | — | Digest policy. Shape: { enabled, cadence?, alertNote? }. enabled is required inside the object. cadence is "minute", "hour", "day", or "month", and is required when enabled is true. alertNote is at most 500 characters. |
The server sets pKey, sKey, userId, clientId, parentId, transformRegion, createdAt, and updatedAt. transformType cannot be changed later.
Returns a transforms array. The attributes match List transforms.
Update a transform
PUT /api/clients/:clientId/proxies/:proxyId/transforms/:transformId updates one transform. The type stays whatever was stored at create. The MCP path takes the same body.
All fields are optional. Omit a field to leave it unchanged; send null to clear it. Omit code to keep the current function.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
transformMode | string | — | "all" or "conditional". |
transformActive | boolean | — | Whether the transform runs. |
code | string | — | Replacement function. A default export, with no imports, at most 512 KB. |
effect | string | — | "include" or "exclude". |
methods | string[] | — | HTTP methods: "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", or "OPTIONS". |
path | object | — | Path check. Same shape as Predicates. |
query | object[] | — | Query-parameter checks. Same shape as Predicates. |
headers | object[] | — | Header checks. Same shape as Predicates. |
body | object[] | — | JSON body checks. Same shape as Predicates. |
token | object[] | — | JWT claim checks. Same shape as Predicates. |
variables | object[] | — | { name, source, key } bindings. See Predicates. |
responseHeaders | object[] | — | Response header checks. For transformType "response". |
responseBody | object[] | — | Response body checks. For transformType "response". |
responseStatus | object[] | — | { value, presence } status checks. For transformType "response". |
priority | number | — | Evaluation order. A higher number is evaluated first. |
notes | string | — | Free-text note. |
alerts | object | — | { enabled, cadence?, alertNote? }. When the saved policy has enabled: true, cadence is required. |
Returns a transforms array with the updated transform, including code. The attributes match List transforms. updatedAt is the time of this call.
Delete a transform
DELETE /api/clients/:clientId/proxies/:proxyId/transforms/:transformId removes the transform and its code. The response message is "Transform deleted successfully".