Guide
Choose what the inspector keeps
Choose whether the inspector keeps request and response bodies, and know what is always removed.
- Applies to
- All plans; durable tunnels only
- Time
- About 3 minutes
- What it changes
- Stores up to 64 KiB of each request and response body for 24 hours.
- Last reviewed
- , by Product documentation
Before you begin
What to know before you start
- Request bodies can contain secrets your app sends, such as tokens or personal data. Keep them only while you need them.
- Turning body capture on or off needs a recent sign-in and is recorded in the workspace audit log.
Steps
Step 1. Open the inspector and choose Keep bodies.
Confirm the dialog. It explains that bodies can hold secrets and how long they are kept.
You should see: New requests keep the first 64 KiB of the request body and of the response body.
To check: Send a request with a body. Its detail now shows the body.
Step 2. Choose Stop keeping bodies when you no longer need them.
You should see: New requests keep no bodies. Bodies already stored stay until they expire after 24 hours, or until you delete the requests.
You are done when
- The inspector shows request and response bodies for new requests, or no bodies when capture is off.
Undo or clean up
- Choose Stop keeping bodies, then delete the requests you do not need.
Good to know
| What | How |
|---|---|
| Header values for authorization, proxy-authorization, cookie and set-cookie | Replaced with redacted |
| Header names that contain token, secret, password, session, api-key, apikey, auth or key | Replaced with redacted |
| Query string values in the path | Replaced; the keys stay |
| The sender's full address | Only the first part is kept: the /24 for IPv4 or the /48 for IPv6 |
This happens in the relay before anything is stored, so a redacted value cannot be shown later. Bodies are not redacted: that is why they are off unless you turn them on.
Related
This page is part of Inspect and replay. Still stuck? Contact support.