RequestRocketRequestRocketDocs
GovernResponse transforms

Response transforms API

Create a transform that runs after filters.

Response transforms use the same /transforms collection as request transforms. Set transformType to response. A list returns both types. Path, header, query, body, and token matches are on Predicates.

Endpoints

MethodPathWhat it does
GET/api/clients/:clientId/proxies/:proxyId/transformsList request and response transforms
POST/api/clients/:clientId/proxies/:proxyId/transformsCreate a transform. Set transformType to response
GET/api/clients/:clientId/proxies/:proxyId/transforms/:transformIdRead a transform, including its code
PUT/api/clients/:clientId/proxies/:proxyId/transforms/:transformIdUpdate a transform
DELETE/api/clients/:clientId/proxies/:proxyId/transforms/:transformIdDelete a transform
POST/api/clients/:clientId/mcps/:mcpId/transformsCreate an MCP response transform

Create a response transform

POST /api/clients/:clientId/proxies/:proxyId/transforms saves the function that runs after filters. Set transformType to response.

Request

curl -X POST "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms" \
  -H "Authorization: u-your-token" \
  -H "Content-Type: application/json" \
  -d '{
  "transformType": "response",
  "transformMode": "all",
  "transformActive": true,
  "code": "export default function transform(proxyContext, proxyRequest, targetResponse) { return { ...targetResponse, headers: { ...targetResponse.headers, '\''x-request-path'\'': proxyContext.path } }; }"
}'
import axios from "axios";

const response = await axios.request({
  method: "POST",
  url: "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms",
  headers: {
    "Authorization": "u-your-token",
    "Content-Type": "application/json",
  },
  data: {
  "transformType": "response",
  "transformMode": "all",
  "transformActive": true,
  "code": "export default function transform(proxyContext, proxyRequest, targetResponse) { return { ...targetResponse, headers: { ...targetResponse.headers, 'x-request-path': proxyContext.path } }; }"
}
});

console.log(response.status, response.data);
import requests

response = requests.request(
    "POST",
    "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms",
    headers={
        "Authorization": "u-your-token",
        "Content-Type": "application/json",
    },
    data="{\n  \"transformType\": \"response\",\n  \"transformMode\": \"all\",\n  \"transformActive\": true,\n  \"code\": \"export default function transform(proxyContext, proxyRequest, targetResponse) { return { ...targetResponse, headers: { ...targetResponse.headers, 'x-request-path': proxyContext.path } }; }\"\n}"
)
print(response.status_code, response.json())
package main

import (
    "fmt"
    "io"
    "net/http"
    "strings"
)

func main() {
    payload := strings.NewReader(`{
  "transformType": "response",
  "transformMode": "all",
  "transformActive": true,
  "code": "export default function transform(proxyContext, proxyRequest, targetResponse) { return { ...targetResponse, headers: { ...targetResponse.headers, 'x-request-path': proxyContext.path } }; }"
}`)
    req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms", payload)
    req.Header.Set("Authorization", "u-your-token")
    req.Header.Set("Content-Type", "application/json")
    resp, _ := http.DefaultClient.Do(req)
    defer resp.Body.Close()
    body, _ := io.ReadAll(resp.Body)
    fmt.Println(resp.StatusCode, string(body))
}
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;

public class Example {
    public static void main(String[] args) throws Exception {
        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms"))
            .method("POST", HttpRequest.BodyPublishers.ofString("{\n  \"transformType\": \"response\",\n  \"transformMode\": \"all\",\n  \"transformActive\": true,\n  \"code\": \"export default function transform(proxyContext, proxyRequest, targetResponse) { return { ...targetResponse, headers: { ...targetResponse.headers, 'x-request-path': proxyContext.path } }; }\"\n}"))
            .header("Authorization", "u-your-token")
            .header("Content-Type", "application/json")
            .build();
        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());
        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

Responses

{
  "transforms": [
    {
      "pKey": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
      "sKey": "3e7b1a58-0d46-4c92-8f1a-2b6d4e9c0a75",
      "userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
      "clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
      "parentId": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
      "transformRegion": "us-east-2",
      "transformType": "response",
      "transformMode": "all",
      "effect": null,
      "transformActive": true,
      "priority": 0,
      "notes": null,
      "alerts": null,
      "createdAt": "2026-11-02T07:30:00.000Z",
      "updatedAt": "2026-11-02T07:30:00.000Z",
      "code": "export default function transform(proxyContext, proxyRequest, targetResponse) { return { ...targetResponse, headers: { ...targetResponse.headers, 'x-request-path': proxyContext.path } }; }"
    }
  ],
  "message": "Success"
}
{
  "message": "code is required"
}
{
  "message": "Unauthorized"
}
{
  "Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}
{
  "message": "method / endpoint not supported"
}

Returns the created transform, including its source. The body is a transforms array with that one record, plus message.

Response attributes

FieldTypeDescription
transformsarrayThe created transform. One record.
messagestringSuccess when the transform is saved.
sKeystringTransform id. Send it as :transformId on read, update, and delete.
pKeystringId of the proxy or direct MCP server this transform belongs to.
parentIdstringSame value as pKey.
clientIdstringOrganisation id.
userIdstringId of the user who created the transform.
transformRegionstringRegion copied from the parent.
transformTypestringresponse for a transform created on this page.
transformModestringall or conditional.
effectstringinclude or exclude. null when omitted.
transformActivebooleanWhether the transform runs.
prioritynumber0 when omitted. A higher number runs first.
codestringThe source that was saved. Present on create, update, and read-one. A list omits it.
createdAtstringISO-8601 time the transform was created.
updatedAtstringISO-8601 time the transform was last saved.

Predicate fields you omit (methods, path, query, headers, body, token, responseHeaders, responseBody, responseStatus, variables, notes, alerts) come back as null.

Request body

Response transforms run on a proxy or a direct MCP server. A proxy-backed MCP server rejects the call. Put the transform on the proxy that backs it. The direct MCP create path takes this same body.

A regex is an object with a required pattern and optional flags. Path, header, query, body, and token shapes are on Predicates.

ParameterTypeRequiredDescription
transformTypestring✓request or response. Send response.
transformModestring✓all runs on every call. conditional runs only when the predicates match.
transformActiveboolean✓Whether this transform runs.
codestring✓Default-exported function, called as (proxyContext, proxyRequest, targetResponse). Return an object with a numeric status. headers and data carry the rest of the target response. Maximum length 524288 characters. Imports, require, fetch, and process are rejected.
effectstring—include or exclude. Used when transformMode is conditional. Defaults to include.
methodsstring[]—HTTP methods this transform applies to: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS. Omit to match every method.
pathobject—Request path check. path is a regex and presence is must_exist or must_absent.
queryobject[]—Query parameter checks. Each item needs name and presence. value is optional. AND semantics.
headersobject[]—Request header checks. Each item needs name and presence. value is optional. AND semantics.
bodyobject[]—Request body checks. Each item needs jsonPath and presence. matchField and matchValue are optional. AND semantics.
tokenobject[]—JWT claim checks. Each item needs claim and presence. value is optional. AND semantics.
responseHeadersobject[]—Response header checks. Same shape as headers. Evaluated for a response transform. AND semantics.
responseBodyobject[]—Response body checks. Same shape as body. Evaluated for a response transform. AND semantics.
responseStatusobject[]—Response status checks. See Response status fields. AND semantics.
variablesobject[]—Bindings for {{name}} in patterns. See Variable fields. Response sources are available.
prioritynumber—Order among transforms. A higher number runs first. Defaults to 0.
notesstring—Description stored on the transform.
alertsobject—Digest policy. enabled (boolean) is required on the object. cadence (minute, hour, day, or month) is required when enabled is true. alertNote is optional, up to 500 characters. Leave notifyTrigger unset. It applies to meters.

Variable fields

Each object in variables. Write the name as {{name}} inside a pattern.

ParameterTypeRequiredDescription
namestring✓Token name.
sourcestring✓headers, params, body, static, jwtClaim, responseHeaders, responseBody, or responseStatus.
keystring✓Header name, query name, dot path, or the literal text when source is static. Still required for responseStatus, where it is ignored and the value is the status code.

Response status fields

Each object in responseStatus. value is matched against the status code as text.

ParameterTypeRequiredDescription
valueobject✓Regex. pattern is required. flags is optional.
presencestring✓must_exist or must_absent.

List transforms

GET /api/clients/:clientId/proxies/:proxyId/transforms returns request and response transforms on that proxy. A direct MCP list uses the MCP path and returns both types as well. A proxy-backed MCP server rejects the call.

Query parameters

None.

Returns

Returns every transform on the parent in transforms, plus message. List records do not include code.

Response attributes

FieldTypeDescription
transformsarrayRequest and response transforms on the parent. Each record uses the attributes described on create, without code.
messagestringSuccess.

GET /api/clients/:clientId/proxies/:proxyId/transforms/:transformId returns that one transform in transforms and includes code.

Update a transform

PUT /api/clients/:clientId/proxies/:proxyId/transforms/:transformId changes one transform. A direct MCP transform takes the same body on its transforms/:transformId path.

All fields are optional. Omit a field to leave it unchanged; send null to clear it. code is the exception: send a new non-empty source to replace it. null is rejected. transformType cannot be changed.

Returns

Returns the updated transform in transforms, including code. updatedAt is the save time. Attributes match the create response.

Request body

ParameterTypeRequiredDescription
transformModestring—all or conditional.
transformActiveboolean—Whether this transform runs.
codestring—Replacement source. Same rules as create: default export, numeric status in the returned object, maximum length 524288.
effectstring—include or exclude. Used when transformMode is conditional.
methodsstring[]—GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS.
pathobject—Request path check.
queryobject[]—Query parameter checks.
headersobject[]—Request header checks.
bodyobject[]—Request body checks.
tokenobject[]—JWT claim checks.
responseHeadersobject[]—Response header checks.
responseBodyobject[]—Response body checks.
responseStatusobject[]—Response status checks. Same item shape as create.
variablesobject[]—{{name}} bindings. Same item shape as create.
prioritynumber—A higher number runs first.
notesstring—Description stored on the transform.
alertsobject—Digest policy. cadence is required when enabled is true.

Next

On this page