HTTP echo endpoints

Create an echo resource

POST /api/mocks with {name, routes: [], echo: true}. Echo mode cannot be combined with static routes or a CRUD collection. Private sharing is the default. The response contains the resource ID, endpointUrl, expiry, managementToken and separate accessToken. Save credentials securely; tokens are never added to endpoint URLs.

{
  "name": "Client request check",
  "routes": [],
  "echo": true
}

Call and inspect the endpoint

Call /mock/{id} or append a relative path. GET, POST, PUT, PATCH, DELETE, HEAD and OPTIONS are supported. The response is HTTP 200 JSON; HEAD omits its body. A browser CORS preflight returns 204. Private callers supply X-Access-Token or workspace authorization. Management tokens cannot call private endpoints.

The JSON response contains method, path, query, headers, contentType, body, receivedAt and notice. path is the relative path after /mock/{id}. Query values can be strings or arrays. body contains kind (empty, json, text or binary), bytes, optional value and optional notice. receivedAt is the server observation time. The UI round trip is measured by the browser.

const observed = await socket.request(
  "POST", `/mock/${id}/check?source=sdk`,
  { event: "demo.created", data: { id: "demo_1" } }, accessToken
);
console.log(observed.body.value);

Redaction and retention

Credential-like field names are redacted recursively in headers, query and parsed JSON. Supplied authorization values of at least eight characters are removed from reflected text. Nested values beyond eight levels are omitted. Unparseable JSON is shown as text; arbitrary text does not receive field-name redaction. Invalid UTF-8 binary contents are not reflected.

Requests are processed by the server but not retained in resource history. The resource stores configuration and a use count. Public sharing allows anyone with the endpoint to use it. Do not send real credentials or customer data; these redaction rules cannot recognize all sensitive values.

Lifecycle, clients and limits

Use GET, PUT and DELETE /api/mocks/{id} for management. Sharing and renewal use the existing /sharing and /renew routes. There is no echo-history API, and reset is only for CRUD collections. Expired, deleted and unauthorized private resources return 404.

The SDK request method and CLI api command accept /mock/ paths, using the separate caller token. SSH uses the same CLI commands. MCP create_mock_api accepts echo: true and empty routes; call_mock_api invokes the endpoint with method, path, optional JSON object body and optional accessToken.

Bodies are limited to 100 KiB by the platform; the web editor allows 64 KiB. Endpoints use the existing 120-request-per-minute mock limit and resource storage/lifecycle quotas. This tool does not forward traffic, execute arbitrary code, retain capture history or expose a client IP field.