RequestRocketRequestRocketDocs
GovernFilters

Filters API

Retain or destroy response fields.

Filters run on 2xx JSON responses. Error payloads and binary responses pass through. Path, header, query, body, and token matches are on Predicates.

Endpoints

MethodPathWhat it does
GET/api/clients/:clientId/proxies/:proxyId/filtersList proxy filters
POST/api/clients/:clientId/proxies/:proxyId/filtersCreate a proxy filter
PUT/api/clients/:clientId/proxies/:proxyId/filters/:filterIdUpdate a proxy filter
DELETE/api/clients/:clientId/proxies/:proxyId/filters/:filterIdDelete a proxy filter
GET/api/clients/:clientId/credentials/:credentialId/filtersList credential filters
POST/api/clients/:clientId/credentials/:credentialId/filtersCreate a credential filter
GET/api/clients/:clientId/targets/:targetId/filtersList target filters
POST/api/clients/:clientId/targets/:targetId/filtersCreate a target filter
GET/api/clients/:clientId/mcps/:mcpId/filtersList MCP filters
POST/api/clients/:clientId/mcps/:mcpId/filtersCreate an MCP filter

Create a proxy filter

POST /api/clients/:clientId/proxies/:proxyId/filters adds operations. Credential and MCP paths take the same body.

Request

curl -X POST "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/filters" \
  -H "Authorization: u-your-token" \
  -H "Content-Type: application/json" \
  -d '{
  "filterActive": true,
  "operations": [
    {
      "effect": "destroy",
      "jsonPath": {
        "pattern": "^password$"
      }
    }
  ]
}'
import axios from "axios";

const response = await axios.request({
  method: "POST",
  url: "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/filters",
  headers: {
    "Authorization": "u-your-token",
    "Content-Type": "application/json",
  },
  data: {
  "filterActive": true,
  "operations": [
    {
      "effect": "destroy",
      "jsonPath": {
        "pattern": "^password$"
      }
    }
  ]
}
});

console.log(response.status, response.data);
import requests

response = requests.request(
    "POST",
    "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/filters",
    headers={
        "Authorization": "u-your-token",
        "Content-Type": "application/json",
    },
    data="{\n  \"filterActive\": true,\n  \"operations\": [\n    {\n      \"effect\": \"destroy\",\n      \"jsonPath\": {\n        \"pattern\": \"^password$\"\n      }\n    }\n  ]\n}"
)
print(response.status_code, response.json())
package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    payload := strings.NewReader(`{
  "filterActive": true,
  "operations": [
    {
      "effect": "destroy",
      "jsonPath": {
        "pattern": "^password$"
      }
    }
  ]
}`)
    req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/filters", payload)
    req.Header.Set("Authorization", "u-your-token")
    req.Header.Set("Content-Type", "application/json")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/filters"))
            .method("POST", HttpRequest.BodyPublishers.ofString("{\n  \"filterActive\": true,\n  \"operations\": [\n    {\n      \"effect\": \"destroy\",\n      \"jsonPath\": {\n        \"pattern\": \"^password$\"\n      }\n    }\n  ]\n}"))
            .header("Authorization", "u-your-token")
            .header("Content-Type", "application/json")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "filters": [
    {
      "sKey": "1c9e5a27-3d80-4b64-a2f1-7e0b4d6c8a93",
      "filterActive": true,
      "operations": [
        {
          "effect": "destroy",
          "jsonPath": {
            "pattern": "^password$"
          }
        }
      ],
      "defaultFilterOperation": "retain"
    }
  ],
  "message": "Success"
}
{
  "message": "Input failed data validation"
}
{
  "message": "Unauthorized"
}
{
  "message": "Forbidden"
}

Returns the created filter. The body is a filters array with that one record, plus message.

Response attributes

FieldTypeDescription
filtersarrayThe created filter. One record.
messagestringSuccess when the filter is saved.
sKeystringFilter id. Send it as :filterId on update and delete.
pKeystringId of the proxy, inbound credential, target, or MCP server this filter belongs to.
parentIdstringSame value as pKey.
clientIdstringOrganisation id.
userIdstringId of the user who created the filter.
filterRegionstringRegion copied from the parent.
filterActivebooleanWhether the filter runs.
operationsarrayThe retain and destroy actions that were saved.
defaultFilterOperationstringretain or destroy. retain when the field was omitted.
prioritynumber0 when omitted. A higher number runs first.
createdAtstringISO-8601 time the filter was created.
updatedAtstringISO-8601 time the filter was last saved.

Predicate fields you omit (methods, requestPath, query, headers, body, token, responseHeaders, responseBody, responseStatus, variables, notes, alerts) come back as null.

Request body

Target creates take this same body. A proxy-backed MCP server rejects the call. Put the filter on the proxy that backs it. alerts is accepted on a proxy or a direct MCP server. An inbound credential or a target rejects alerts when enabled is true.

A regex is an object with a required pattern and optional flags. Path, header, query, body, and token shapes are on Predicates.

ParameterTypeRequiredDescription
filterActiveboolean✓Whether this filter runs. Inactive filters are skipped.
operationsobject[]✓Retain and destroy actions on the JSON response. See Operation fields.
defaultFilterOperationstring—retain or destroy. What happens to a value no operation matches. Defaults to retain, which keeps it. destroy removes it.
methodsstring[]—HTTP methods this filter applies to: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS. Omit to match every method.
requestPathobject—Request path check. path is a regex and presence is must_exist or must_absent.
queryobject[]—Query parameter checks. Each item needs name and presence. value is optional. AND semantics.
headersobject[]—Request header checks. Each item needs name and presence. value is optional. AND semantics.
bodyobject[]—Request body checks. Each item needs jsonPath and presence. matchField and matchValue are optional. AND semantics.
tokenobject[]—JWT claim checks. Each item needs claim and presence. value is optional. AND semantics.
responseHeadersobject[]—Response header checks. Same shape as headers. AND semantics.
responseBodyobject[]—Response body checks. Same shape as body. AND semantics.
responseStatusobject[]—Response status checks. See Response status fields. AND semantics.
variablesobject[]—Bindings for {{name}} in patterns and operations. See Variable fields.
prioritynumber—Order among filters. A higher number runs first. Defaults to 0.
notesstring—Description stored on the filter.
alertsobject—Digest policy. enabled (boolean) is required on the object. cadence (minute, hour, day, or month) is required when enabled is true. alertNote is optional, up to 500 characters. Leave notifyTrigger unset. It applies to meters.

Operation fields

Each object in operations. When matchField is set, the operation filters rows in the array jsonPath names. When matchField is omitted, it filters that field path. If retain and destroy both match the same value, destroy wins.

ParameterTypeRequiredDescription
effectstring✓retain keeps the match. destroy removes it.
jsonPathobject✓Regex tested against the JSON dot-path. pattern is required.
matchFieldobject—Regex against a field name on an array element. Set it to filter rows.
matchValueobject—Regex against that field's value. Supports {{name}} from variables.
prioritynumber—Order among operations. A higher number runs first.
notesstring—Description of this operation.

Variable fields

Each object in variables. Write the name as {{name}} inside a pattern.

ParameterTypeRequiredDescription
namestring✓Token name.
sourcestring✓headers, params, body, static, jwtClaim, responseHeaders, responseBody, or responseStatus.
keystring✓Header name, query name, dot path, or the literal text when source is static. Still required for responseStatus, where it is ignored and the value is the status code.

Response status fields

Each object in responseStatus.

ParameterTypeRequiredDescription
valueobject✓Regex matched against the status code as text. pattern is required. A 2xx check uses a pattern that matches 200 through 299.
presencestring✓must_exist or must_absent.

List filters

GET /api/clients/:clientId/proxies/:proxyId/filters returns every filter on that proxy. The credential, target, and MCP list paths do the same for their parent. A proxy-backed MCP server rejects the call.

Query parameters

None.

Returns

Returns every filter on the parent in filters, plus message.

Response attributes

FieldTypeDescription
filtersarrayEvery filter on the parent. Each record uses the attributes described on create.
messagestringSuccess.

Update a proxy filter

PUT /api/clients/:clientId/proxies/:proxyId/filters/:filterId changes one filter. Credential, target, and direct MCP filters take the same body on their filters/:filterId path.

All fields are optional. Omit a field to leave it unchanged; send null to clear it.

Returns

Returns the updated filter in filters. updatedAt is the save time. Attributes match the create response.

Request body

Sending operations replaces the whole array. alerts follows the same proxy and direct-MCP rule as create.

ParameterTypeRequiredDescription
filterActiveboolean—Whether this filter runs.
operationsobject[]—Replaces the retain and destroy actions. Same item shape as create.
defaultFilterOperationstring—retain or destroy.
methodsstring[]—GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS.
requestPathobject—Request path check.
queryobject[]—Query parameter checks.
headersobject[]—Request header checks.
bodyobject[]—Request body checks.
tokenobject[]—JWT claim checks.
responseHeadersobject[]—Response header checks.
responseBodyobject[]—Response body checks.
responseStatusobject[]—Response status checks. Same item shape as create.
variablesobject[]—{{name}} bindings. Same item shape as create.
prioritynumber—A higher number runs first.
notesstring—Description stored on the filter.
alertsobject—Digest policy. cadence is required when enabled is true.

Next

On this page