Filters API
Retain or destroy response fields.
Filters run on 2xx JSON responses. Error payloads and binary responses pass through. Path, header, query, body, and token matches are on Predicates.
Endpoints
| Method | Path | What it does |
|---|---|---|
| GET | /api/clients/:clientId/proxies/:proxyId/filters | List proxy filters |
| POST | /api/clients/:clientId/proxies/:proxyId/filters | Create a proxy filter |
| PUT | /api/clients/:clientId/proxies/:proxyId/filters/:filterId | Update a proxy filter |
| DELETE | /api/clients/:clientId/proxies/:proxyId/filters/:filterId | Delete a proxy filter |
| GET | /api/clients/:clientId/credentials/:credentialId/filters | List credential filters |
| POST | /api/clients/:clientId/credentials/:credentialId/filters | Create a credential filter |
| GET | /api/clients/:clientId/targets/:targetId/filters | List target filters |
| POST | /api/clients/:clientId/targets/:targetId/filters | Create a target filter |
| GET | /api/clients/:clientId/mcps/:mcpId/filters | List MCP filters |
| POST | /api/clients/:clientId/mcps/:mcpId/filters | Create an MCP filter |
Create a proxy filter
POST /api/clients/:clientId/proxies/:proxyId/filters adds operations. Credential and MCP paths take the same body.
Request
curl -X POST "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/filters" \
-H "Authorization: u-your-token" \
-H "Content-Type: application/json" \
-d '{
"filterActive": true,
"operations": [
{
"effect": "destroy",
"jsonPath": {
"pattern": "^password$"
}
}
]
}'import axios from "axios";
const response = await axios.request({
method: "POST",
url: "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/filters",
headers: {
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data: {
"filterActive": true,
"operations": [
{
"effect": "destroy",
"jsonPath": {
"pattern": "^password$"
}
}
]
}
});
console.log(response.status, response.data);import requests
response = requests.request(
"POST",
"https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/filters",
headers={
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data="{\n \"filterActive\": true,\n \"operations\": [\n {\n \"effect\": \"destroy\",\n \"jsonPath\": {\n \"pattern\": \"^password$\"\n }\n }\n ]\n}"
)
print(response.status_code, response.json())package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
payload := strings.NewReader(`{
"filterActive": true,
"operations": [
{
"effect": "destroy",
"jsonPath": {
"pattern": "^password$"
}
}
]
}`)
req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/filters", payload)
req.Header.Set("Authorization", "u-your-token")
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(resp.StatusCode, string(body))
}import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Example {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/filters"))
.method("POST", HttpRequest.BodyPublishers.ofString("{\n \"filterActive\": true,\n \"operations\": [\n {\n \"effect\": \"destroy\",\n \"jsonPath\": {\n \"pattern\": \"^password$\"\n }\n }\n ]\n}"))
.header("Authorization", "u-your-token")
.header("Content-Type", "application/json")
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode());
System.out.println(response.body());
}
}Responses
{
"filters": [
{
"sKey": "1c9e5a27-3d80-4b64-a2f1-7e0b4d6c8a93",
"filterActive": true,
"operations": [
{
"effect": "destroy",
"jsonPath": {
"pattern": "^password$"
}
}
],
"defaultFilterOperation": "retain"
}
],
"message": "Success"
}{
"message": "Input failed data validation"
}{
"message": "Forbidden"
}Returns the created filter. The body is a filters array with that one record, plus message.
Response attributes
| Field | Type | Description |
|---|---|---|
filters | array | The created filter. One record. |
message | string | Success when the filter is saved. |
sKey | string | Filter id. Send it as :filterId on update and delete. |
pKey | string | Id of the proxy, inbound credential, target, or MCP server this filter belongs to. |
parentId | string | Same value as pKey. |
clientId | string | Organisation id. |
userId | string | Id of the user who created the filter. |
filterRegion | string | Region copied from the parent. |
filterActive | boolean | Whether the filter runs. |
operations | array | The retain and destroy actions that were saved. |
defaultFilterOperation | string | retain or destroy. retain when the field was omitted. |
priority | number | 0 when omitted. A higher number runs first. |
createdAt | string | ISO-8601 time the filter was created. |
updatedAt | string | ISO-8601 time the filter was last saved. |
Predicate fields you omit (methods, requestPath, query, headers, body, token, responseHeaders, responseBody, responseStatus, variables, notes, alerts) come back as null.
Request body
Target creates take this same body. A proxy-backed MCP server rejects the call. Put the filter on the proxy that backs it. alerts is accepted on a proxy or a direct MCP server. An inbound credential or a target rejects alerts when enabled is true.
A regex is an object with a required pattern and optional flags. Path, header, query, body, and token shapes are on Predicates.
| Parameter | Type | Required | Description |
|---|---|---|---|
filterActive | boolean | ✓ | Whether this filter runs. Inactive filters are skipped. |
operations | object[] | ✓ | Retain and destroy actions on the JSON response. See Operation fields. |
defaultFilterOperation | string | — | retain or destroy. What happens to a value no operation matches. Defaults to retain, which keeps it. destroy removes it. |
methods | string[] | — | HTTP methods this filter applies to: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS. Omit to match every method. |
requestPath | object | — | Request path check. path is a regex and presence is must_exist or must_absent. |
query | object[] | — | Query parameter checks. Each item needs name and presence. value is optional. AND semantics. |
headers | object[] | — | Request header checks. Each item needs name and presence. value is optional. AND semantics. |
body | object[] | — | Request body checks. Each item needs jsonPath and presence. matchField and matchValue are optional. AND semantics. |
token | object[] | — | JWT claim checks. Each item needs claim and presence. value is optional. AND semantics. |
responseHeaders | object[] | — | Response header checks. Same shape as headers. AND semantics. |
responseBody | object[] | — | Response body checks. Same shape as body. AND semantics. |
responseStatus | object[] | — | Response status checks. See Response status fields. AND semantics. |
variables | object[] | — | Bindings for {{name}} in patterns and operations. See Variable fields. |
priority | number | — | Order among filters. A higher number runs first. Defaults to 0. |
notes | string | — | Description stored on the filter. |
alerts | object | — | Digest policy. enabled (boolean) is required on the object. cadence (minute, hour, day, or month) is required when enabled is true. alertNote is optional, up to 500 characters. Leave notifyTrigger unset. It applies to meters. |
Operation fields
Each object in operations. When matchField is set, the operation filters rows in the array jsonPath names. When matchField is omitted, it filters that field path. If retain and destroy both match the same value, destroy wins.
| Parameter | Type | Required | Description |
|---|---|---|---|
effect | string | ✓ | retain keeps the match. destroy removes it. |
jsonPath | object | ✓ | Regex tested against the JSON dot-path. pattern is required. |
matchField | object | — | Regex against a field name on an array element. Set it to filter rows. |
matchValue | object | — | Regex against that field's value. Supports {{name}} from variables. |
priority | number | — | Order among operations. A higher number runs first. |
notes | string | — | Description of this operation. |
Variable fields
Each object in variables. Write the name as {{name}} inside a pattern.
| Parameter | Type | Required | Description |
|---|---|---|---|
name | string | ✓ | Token name. |
source | string | ✓ | headers, params, body, static, jwtClaim, responseHeaders, responseBody, or responseStatus. |
key | string | ✓ | Header name, query name, dot path, or the literal text when source is static. Still required for responseStatus, where it is ignored and the value is the status code. |
Response status fields
Each object in responseStatus.
| Parameter | Type | Required | Description |
|---|---|---|---|
value | object | ✓ | Regex matched against the status code as text. pattern is required. A 2xx check uses a pattern that matches 200 through 299. |
presence | string | ✓ | must_exist or must_absent. |
List filters
GET /api/clients/:clientId/proxies/:proxyId/filters returns every filter on that proxy. The credential, target, and MCP list paths do the same for their parent. A proxy-backed MCP server rejects the call.
Query parameters
None.
Returns
Returns every filter on the parent in filters, plus message.
Response attributes
| Field | Type | Description |
|---|---|---|
filters | array | Every filter on the parent. Each record uses the attributes described on create. |
message | string | Success. |
Update a proxy filter
PUT /api/clients/:clientId/proxies/:proxyId/filters/:filterId changes one filter. Credential, target, and direct MCP filters take the same body on their filters/:filterId path.
All fields are optional. Omit a field to leave it unchanged; send null to clear it.
Returns
Returns the updated filter in filters. updatedAt is the save time. Attributes match the create response.
Request body
Sending operations replaces the whole array. alerts follows the same proxy and direct-MCP rule as create.
| Parameter | Type | Required | Description |
|---|---|---|---|
filterActive | boolean | — | Whether this filter runs. |
operations | object[] | — | Replaces the retain and destroy actions. Same item shape as create. |
defaultFilterOperation | string | — | retain or destroy. |
methods | string[] | — | GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS. |
requestPath | object | — | Request path check. |
query | object[] | — | Query parameter checks. |
headers | object[] | — | Request header checks. |
body | object[] | — | Request body checks. |
token | object[] | — | JWT claim checks. |
responseHeaders | object[] | — | Response header checks. |
responseBody | object[] | — | Response body checks. |
responseStatus | object[] | — | Response status checks. Same item shape as create. |
variables | object[] | — | {{name}} bindings. Same item shape as create. |
priority | number | — | A higher number runs first. |
notes | string | — | Description stored on the filter. |
alerts | object | — | Digest policy. cadence is required when enabled is true. |