Response transforms API
Create a transform that runs after filters.
Response transforms use the same /transforms collection as request transforms. Set transformType to response. A list returns both types. Path, header, query, body, and token matches are on Predicates.
Endpoints
| Method | Path | What it does |
|---|---|---|
| GET | /api/clients/:clientId/proxies/:proxyId/transforms | List request and response transforms |
| POST | /api/clients/:clientId/proxies/:proxyId/transforms | Create a transform. Set transformType to response |
| GET | /api/clients/:clientId/proxies/:proxyId/transforms/:transformId | Read a transform, including its code |
| PUT | /api/clients/:clientId/proxies/:proxyId/transforms/:transformId | Update a transform |
| DELETE | /api/clients/:clientId/proxies/:proxyId/transforms/:transformId | Delete a transform |
| POST | /api/clients/:clientId/mcps/:mcpId/transforms | Create an MCP response transform |
Create a response transform
POST /api/clients/:clientId/proxies/:proxyId/transforms saves the function that runs after filters. Set transformType to response.
Request
curl -X POST "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms" \
-H "Authorization: u-your-token" \
-H "Content-Type: application/json" \
-d '{
"transformType": "response",
"transformMode": "all",
"transformActive": true,
"code": "export default function transform(proxyContext, proxyRequest, targetResponse) { return { ...targetResponse, headers: { ...targetResponse.headers, '\''x-request-path'\'': proxyContext.path } }; }"
}'import axios from "axios";
const response = await axios.request({
method: "POST",
url: "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms",
headers: {
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data: {
"transformType": "response",
"transformMode": "all",
"transformActive": true,
"code": "export default function transform(proxyContext, proxyRequest, targetResponse) { return { ...targetResponse, headers: { ...targetResponse.headers, 'x-request-path': proxyContext.path } }; }"
}
});
console.log(response.status, response.data);import requests
response = requests.request(
"POST",
"https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms",
headers={
"Authorization": "u-your-token",
"Content-Type": "application/json",
},
data="{\n \"transformType\": \"response\",\n \"transformMode\": \"all\",\n \"transformActive\": true,\n \"code\": \"export default function transform(proxyContext, proxyRequest, targetResponse) { return { ...targetResponse, headers: { ...targetResponse.headers, 'x-request-path': proxyContext.path } }; }\"\n}"
)
print(response.status_code, response.json())package main
import (
"fmt"
"io"
"net/http"
"strings"
)
func main() {
payload := strings.NewReader(`{
"transformType": "response",
"transformMode": "all",
"transformActive": true,
"code": "export default function transform(proxyContext, proxyRequest, targetResponse) { return { ...targetResponse, headers: { ...targetResponse.headers, 'x-request-path': proxyContext.path } }; }"
}`)
req, _ := http.NewRequest("POST", "https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms", payload)
req.Header.Set("Authorization", "u-your-token")
req.Header.Set("Content-Type", "application/json")
resp, _ := http.DefaultClient.Do(req)
defer resp.Body.Close()
body, _ := io.ReadAll(resp.Body)
fmt.Println(resp.StatusCode, string(body))
}import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
public class Example {
public static void main(String[] args) throws Exception {
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create("https://api.requestrocket.com/api/clients/:clientId/proxies/:proxyId/transforms"))
.method("POST", HttpRequest.BodyPublishers.ofString("{\n \"transformType\": \"response\",\n \"transformMode\": \"all\",\n \"transformActive\": true,\n \"code\": \"export default function transform(proxyContext, proxyRequest, targetResponse) { return { ...targetResponse, headers: { ...targetResponse.headers, 'x-request-path': proxyContext.path } }; }\"\n}"))
.header("Authorization", "u-your-token")
.header("Content-Type", "application/json")
.build();
HttpResponse<String> response = HttpClient.newHttpClient()
.send(request, HttpResponse.BodyHandlers.ofString());
System.out.println(response.statusCode());
System.out.println(response.body());
}
}Responses
{
"transforms": [
{
"pKey": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
"sKey": "3e7b1a58-0d46-4c92-8f1a-2b6d4e9c0a75",
"userId": "0f8e6c1a-2b7d-4c3e-9a55-1d2e3f4a5b6c",
"clientId": "b3a1c7d2-5e44-4f0a-9c1e-7d2f8a6b1c90",
"parentId": "5d8a1c30-4e72-4b19-8f6a-0c3d9e7b1a25",
"transformRegion": "us-east-2",
"transformType": "response",
"transformMode": "all",
"effect": null,
"transformActive": true,
"priority": 0,
"notes": null,
"alerts": null,
"createdAt": "2026-11-02T07:30:00.000Z",
"updatedAt": "2026-11-02T07:30:00.000Z",
"code": "export default function transform(proxyContext, proxyRequest, targetResponse) { return { ...targetResponse, headers: { ...targetResponse.headers, 'x-request-path': proxyContext.path } }; }"
}
],
"message": "Success"
}{
"message": "code is required"
}{
"Message": "User is not authorized to access this resource with an explicit deny in an identity-based policy"
}{
"message": "method / endpoint not supported"
}Returns the created transform, including its source. The body is a transforms array with that one record, plus message.
Response attributes
| Field | Type | Description |
|---|---|---|
transforms | array | The created transform. One record. |
message | string | Success when the transform is saved. |
sKey | string | Transform id. Send it as :transformId on read, update, and delete. |
pKey | string | Id of the proxy or direct MCP server this transform belongs to. |
parentId | string | Same value as pKey. |
clientId | string | Organisation id. |
userId | string | Id of the user who created the transform. |
transformRegion | string | Region copied from the parent. |
transformType | string | response for a transform created on this page. |
transformMode | string | all or conditional. |
effect | string | include or exclude. null when omitted. |
transformActive | boolean | Whether the transform runs. |
priority | number | 0 when omitted. A higher number runs first. |
code | string | The source that was saved. Present on create, update, and read-one. A list omits it. |
createdAt | string | ISO-8601 time the transform was created. |
updatedAt | string | ISO-8601 time the transform was last saved. |
Predicate fields you omit (methods, path, query, headers, body, token, responseHeaders, responseBody, responseStatus, variables, notes, alerts) come back as null.
Request body
Response transforms run on a proxy or a direct MCP server. A proxy-backed MCP server rejects the call. Put the transform on the proxy that backs it. The direct MCP create path takes this same body.
A regex is an object with a required pattern and optional flags. Path, header, query, body, and token shapes are on Predicates.
| Parameter | Type | Required | Description |
|---|---|---|---|
transformType | string | ✓ | request or response. Send response. |
transformMode | string | ✓ | all runs on every call. conditional runs only when the predicates match. |
transformActive | boolean | ✓ | Whether this transform runs. |
code | string | ✓ | Default-exported function, called as (proxyContext, proxyRequest, targetResponse). Return an object with a numeric status. headers and data carry the rest of the target response. Maximum length 524288 characters. Imports, require, fetch, and process are rejected. |
effect | string | — | include or exclude. Used when transformMode is conditional. Defaults to include. |
methods | string[] | — | HTTP methods this transform applies to: GET, POST, PUT, PATCH, DELETE, HEAD, OPTIONS. Omit to match every method. |
path | object | — | Request path check. path is a regex and presence is must_exist or must_absent. |
query | object[] | — | Query parameter checks. Each item needs name and presence. value is optional. AND semantics. |
headers | object[] | — | Request header checks. Each item needs name and presence. value is optional. AND semantics. |
body | object[] | — | Request body checks. Each item needs jsonPath and presence. matchField and matchValue are optional. AND semantics. |
token | object[] | — | JWT claim checks. Each item needs claim and presence. value is optional. AND semantics. |
responseHeaders | object[] | — | Response header checks. Same shape as headers. Evaluated for a response transform. AND semantics. |
responseBody | object[] | — | Response body checks. Same shape as body. Evaluated for a response transform. AND semantics. |
responseStatus | object[] | — | Response status checks. See Response status fields. AND semantics. |
variables | object[] | — | Bindings for {{name}} in patterns. See Variable fields. Response sources are available. |
priority | number | — | Order among transforms. A higher number runs first. Defaults to 0. |
notes | string | — | Description stored on the transform. |
alerts | object | — | Digest policy. enabled (boolean) is required on the object. cadence (minute, hour, day, or month) is required when enabled is true. alertNote is optional, up to 500 characters. Leave notifyTrigger unset. It applies to meters. |
Variable fields
Each object in variables. Write the name as {{name}} inside a pattern.
| Parameter | Type | Required | Description |
|---|---|---|---|
name | string | ✓ | Token name. |
source | string | ✓ | headers, params, body, static, jwtClaim, responseHeaders, responseBody, or responseStatus. |
key | string | ✓ | Header name, query name, dot path, or the literal text when source is static. Still required for responseStatus, where it is ignored and the value is the status code. |
Response status fields
Each object in responseStatus. value is matched against the status code as text.
| Parameter | Type | Required | Description |
|---|---|---|---|
value | object | ✓ | Regex. pattern is required. flags is optional. |
presence | string | ✓ | must_exist or must_absent. |
List transforms
GET /api/clients/:clientId/proxies/:proxyId/transforms returns request and response transforms on that proxy. A direct MCP list uses the MCP path and returns both types as well. A proxy-backed MCP server rejects the call.
Query parameters
None.
Returns
Returns every transform on the parent in transforms, plus message. List records do not include code.
Response attributes
| Field | Type | Description |
|---|---|---|
transforms | array | Request and response transforms on the parent. Each record uses the attributes described on create, without code. |
message | string | Success. |
GET /api/clients/:clientId/proxies/:proxyId/transforms/:transformId returns that one transform in transforms and includes code.
Update a transform
PUT /api/clients/:clientId/proxies/:proxyId/transforms/:transformId changes one transform. A direct MCP transform takes the same body on its transforms/:transformId path.
All fields are optional. Omit a field to leave it unchanged; send null to clear it. code is the exception: send a new non-empty source to replace it. null is rejected. transformType cannot be changed.
Returns
Returns the updated transform in transforms, including code. updatedAt is the save time. Attributes match the create response.
Request body
| Parameter | Type | Required | Description |
|---|---|---|---|
transformMode | string | — | all or conditional. |
transformActive | boolean | — | Whether this transform runs. |
code | string | — | Replacement source. Same rules as create: default export, numeric status in the returned object, maximum length 524288. |
effect | string | — | include or exclude. Used when transformMode is conditional. |
methods | string[] | — | GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS. |
path | object | — | Request path check. |
query | object[] | — | Query parameter checks. |
headers | object[] | — | Request header checks. |
body | object[] | — | Request body checks. |
token | object[] | — | JWT claim checks. |
responseHeaders | object[] | — | Response header checks. |
responseBody | object[] | — | Response body checks. |
responseStatus | object[] | — | Response status checks. Same item shape as create. |
variables | object[] | — | {{name}} bindings. Same item shape as create. |
priority | number | — | A higher number runs first. |
notes | string | — | Description stored on the transform. |
alerts | object | — | Digest policy. cadence is required when enabled is true. |