RequestRocketRequestRocketDocs
ControlRequest transforms

Request transforms API

Create a transform that runs before the target call.

Request and response transforms share /transforms. Set transformType to request or response. A list returns both. Response transforms are on Response transforms. Path, header, query, body, and token matches are on Predicates. A transform attaches to a proxy or a direct MCP server. A proxy-backed MCP server returns 409. Create the transform on the backing proxy.

Endpoints

MethodPathWhat it does
GET/api/clients/:clientId/proxies/:proxyId/transformsList request and response transforms
POST/api/clients/:clientId/proxies/:proxyId/transformsCreate a transform. Set transformType to request
GET/api/clients/:clientId/proxies/:proxyId/transforms/:transformIdRead a transform, including its code
PUT/api/clients/:clientId/proxies/:proxyId/transforms/:transformIdUpdate a transform
DELETE/api/clients/:clientId/proxies/:proxyId/transforms/:transformIdDelete a transform
GET/api/clients/:clientId/mcps/:mcpId/transformsList MCP transforms of both types
POST/api/clients/:clientId/mcps/:mcpId/transformsCreate an MCP transform

List transforms

GET /api/clients/:clientId/proxies/:proxyId/transforms returns request and response transforms for that proxy. The MCP path returns the same shape. The list omits code. GET .../transforms/:transformId returns one transform and includes code.

Query parameters

None.

Response attributes

AttributeTypeDescription
transformsarrayOne or more transform objects.
transforms[].sKeystringTransform id. Pass this as transformId on other endpoints.
transforms[].pKey / parentIdstringProxy or direct MCP server id.
transforms[].userIdstringCreator user id.
transforms[].clientIdstringOrganisation id.
transforms[].transformTypestring"request" or "response".
transforms[].transformModestring"all" or "conditional".
transforms[].effectstring or null"include" or "exclude" when conditional.
transforms[].transformActivebooleanWhether the transform runs.
transforms[].prioritynumberHigher numbers are evaluated first.
transforms[].methodsarray or nullHTTP methods the transform applies to, or null for all.
transforms[].pathobject or nullPath predicate.
transforms[].queryarray or nullQuery-parameter predicates.
transforms[].headersarray or nullHeader predicates.
transforms[].bodyarray or nullJSON body predicates.
transforms[].tokenarray or nullJWT claim predicates.
transforms[].variablesarray or nullVariable bindings.
transforms[].notesstring or nullFree-text note.
transforms[].alertsobject or nullDigest policy.
transforms[].codestringTransform function source. Present on single read, create, and update. Absent from list.
transforms[].transformRegionstringRegion copied from the parent.
transforms[].createdAtstringISO 8601 creation time.
transforms[].updatedAtstringISO 8601 last update time.
messagestring"Success".

Create a request transform

POST /api/clients/:clientId/proxies/:proxyId/transforms saves the function. Set transformType to request. Mode all runs on every call. Mode conditional uses a predicate.

Request

curl -X POST "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms" \
  -H "Authorization: u-your-token" \
  -H "Content-Type: application/json" \
  -d '{
  "transformType": "request",
  "transformMode": "all",
  "transformActive": true,
  "code": "export default function transform(proxyContext, proxyRequest) { return { ...proxyRequest, headers: { ...proxyRequest.headers, '\''x-request-path'\'': proxyContext.path } }; }"
}'
import axios from "axios";

const response = await axios.request({
  method: "POST",
  url: "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms",
  headers: {
    "Authorization": "u-your-token",
    "Content-Type": "application/json",
  },
  data: {
  "transformType": "request",
  "transformMode": "all",
  "transformActive": true,
  "code": "export default function transform(proxyContext, proxyRequest) { return { ...proxyRequest, headers: { ...proxyRequest.headers, 'x-request-path': proxyContext.path } }; }"
}
});

console.log(response.status, response.data);
import requests

response = requests.request(
    "POST",
    "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms",
    headers={
        "Authorization": "u-your-token",
        "Content-Type": "application/json",
    },
    data="{\n  \"transformType\": \"request\",\n  \"transformMode\": \"all\",\n  \"transformActive\": true,\n  \"code\": \"export default function transform(proxyContext, proxyRequest) { return { ...proxyRequest, headers: { ...proxyRequest.headers, 'x-request-path': proxyContext.path } }; }\"\n}"
)
print(response.status_code, response.json())
package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    payload := strings.NewReader(`{
  "transformType": "request",
  "transformMode": "all",
  "transformActive": true,
  "code": "export default function transform(proxyContext, proxyRequest) { return { ...proxyRequest, headers: { ...proxyRequest.headers, 'x-request-path': proxyContext.path } }; }"
}`)
    req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms", payload)
    req.Header.Set("Authorization", "u-your-token")
    req.Header.Set("Content-Type", "application/json")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms"))
            .method("POST", HttpRequest.BodyPublishers.ofString("{\n  \"transformType\": \"request\",\n  \"transformMode\": \"all\",\n  \"transformActive\": true,\n  \"code\": \"export default function transform(proxyContext, proxyRequest) { return { ...proxyRequest, headers: { ...proxyRequest.headers, 'x-request-path': proxyContext.path } }; }\"\n}"))
            .header("Authorization", "u-your-token")
            .header("Content-Type", "application/json")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "transforms": [
    {
      "pKey": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
      "sKey": "3e7b1a58-0d46-4c92-8f1a-2b6d4e9c0a75",
      "userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
      "clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
      "parentId": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
      "transformRegion": "us-east-2",
      "transformType": "request",
      "transformMode": "all",
      "effect": null,
      "transformActive": true,
      "priority": 0,
      "notes": null,
      "alerts": null,
      "createdAt": "2026-11-02T07:30:00.000Z",
      "updatedAt": "2026-11-02T07:30:00.000Z",
      "code": "export default function transform(proxyContext, proxyRequest) { return { ...proxyRequest, headers: { ...proxyRequest.headers, 'x-request-path': proxyContext.path } }; }"
    }
  ],
  "message": "Success"
}
{
  "message": "code is required"
}
{
  "message": "Unauthorized"
}
{
  "Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}
{
  "message": "method / endpoint not supported"
}

Returns a transforms array containing the saved transform, including code, with message set to "Success".

Request body

ParameterTypeRequiredDescription
transformTypestring✓"request" or "response". This page uses "request". Response transforms are on Response transforms.
transformModestring✓"all" runs on every call. "conditional" uses the predicate.
transformActiveboolean✓When true, the transform runs.
codestring✓Default-exported function called as (proxyContext, proxyRequest). Return an object containing any changed method, relative url, headers, params, or data. Imports, require, fetch, and process are rejected. At most 512 KB.
effectstring—"include" runs when the predicate matches. "exclude" runs unless the predicate matches. Used when transformMode is "conditional".
methodsstring[]—HTTP methods: "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", or "OPTIONS". Omit to match every method.
pathobject—Path check. Same shape as Predicates.
queryobject[]—Query-parameter checks. Same shape as Predicates.
headersobject[]—Header checks. Same shape as Predicates.
bodyobject[]—JSON body checks. Same shape as Predicates.
tokenobject[]—JWT claim checks. Same shape as Predicates.
variablesobject[]—{ name, source, key } bindings. A request transform uses "headers", "params", "body", "static", or "jwtClaim". See Predicates.
responseHeadersobject[]—Response header checks. Used when transformType is "response". Same shape as Predicates.
responseBodyobject[]—Response body checks. Used when transformType is "response".
responseStatusobject[]—Response status checks. Used when transformType is "response". Each item is { value, presence }. value is { pattern, flags? }. presence is "must_exist" or "must_absent".
prioritynumber—Evaluation order. A higher number is evaluated first. Defaults to 0.
notesstring—Free-text note stored on the transform.
alertsobject—Digest policy. Shape: { enabled, cadence?, alertNote? }. enabled is required inside the object. cadence is "minute", "hour", "day", or "month", and is required when enabled is true. alertNote is at most 500 characters.

The server sets pKey, sKey, userId, clientId, parentId, transformRegion, createdAt, and updatedAt. transformType cannot be changed later.

Returns a transforms array. The attributes match List transforms.

Update a transform

PUT /api/clients/:clientId/proxies/:proxyId/transforms/:transformId updates one transform. The type stays whatever was stored at create. The MCP path takes the same body.

All fields are optional. Omit a field to leave it unchanged; send null to clear it. Omit code to keep the current function.

Request body

ParameterTypeRequiredDescription
transformModestring—"all" or "conditional".
transformActiveboolean—Whether the transform runs.
codestring—Replacement function. A default export, with no imports, at most 512 KB.
effectstring—"include" or "exclude".
methodsstring[]—HTTP methods: "GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", or "OPTIONS".
pathobject—Path check. Same shape as Predicates.
queryobject[]—Query-parameter checks. Same shape as Predicates.
headersobject[]—Header checks. Same shape as Predicates.
bodyobject[]—JSON body checks. Same shape as Predicates.
tokenobject[]—JWT claim checks. Same shape as Predicates.
variablesobject[]—{ name, source, key } bindings. See Predicates.
responseHeadersobject[]—Response header checks. For transformType "response".
responseBodyobject[]—Response body checks. For transformType "response".
responseStatusobject[]—{ value, presence } status checks. For transformType "response".
prioritynumber—Evaluation order. A higher number is evaluated first.
notesstring—Free-text note.
alertsobject—{ enabled, cadence?, alertNote? }. When the saved policy has enabled: true, cadence is required.

Returns a transforms array with the updated transform, including code. The attributes match List transforms. updatedAt is the time of this call.

Delete a transform

DELETE /api/clients/:clientId/proxies/:proxyId/transforms/:transformId removes the transform and its code. The response message is "Transform deleted successfully".

Next

On this page