ReqResReqRes
Skip to content
Docs menu · Change traffic

Change traffic

New in 1.1

Pass a host through untouched

On this page

ReqRes passes an excluded host's traffic through without recording it, over HTTPS and plain http://. It does not decrypt the HTTPS, and no rule or breakpoint applies. Exclude a host when it does not work through ReqRes, such as Apple's timestamp service for code signing, or when you do not want it in the traffic list.

Why exclude a host

To read HTTPS, ReqRes re-signs each response with the ReqRes certificate. Most apps accept that once the certificate is trusted. Some clients check for one specific certificate, or need something ReqRes cannot give them.

  • codesign asks Apple's timestamp service for a signed timestamp. When ReqRes captures that request, signing can fail with an error that names something unrelated to ReqRes: "A timestamp was expected but was not found".
  • An app that pins its certificates refuses ReqRes's. ReqRes handles these without an exclusion: it relays the hosts macOS pins, and remembers an app after its first refusal. See Keep SSL-pinned apps working. Exclude the host to avoid that first failed request, or to drop the rows.
  • A server that requires a client certificate (mTLS) fails through ReqRes, because ReqRes presents none. Excluded, the app's own certificate reaches the server.
  • A protocol other than HTTP inside TLS, such as IMAP or SMTP over TLS, fails once the certificate is trusted, because ReqRes opens all TLS through it as HTTPS. Exclude its host to pass it through.

Use the recommended hosts

The list starts with 2 recommended hosts. Settings ▸ Capture shows the reason beside each one.

HostReason shown in Settings
timestamp.apple.com"keeps codesign working"
*.ls.apple.com"Apple Maps tiles for the Destinations window"

The Apple Maps entry keeps the map in the Destinations window loading while capture runs.

  • If you remove all hosts, the pane warns: "Nothing else is excluded. If code signing or a certificate-pinning app starts failing while capture is on, that is why." Click Restore the recommended hosts to put both back.
  • If the list is missing a recommended host, the pane names it and shows Add the recommended hosts. ReqRes never adds it on its own, so a host you removed stays removed.

The license server is always excluded

reqresapp.com and *.reqresapp.com, ReqRes's license server, are always excluded. Settings ▸ Capture lists them first, with a lock and the reason "ReqRes's license server: never intercepted". They have no Remove button, and no rule or breakpoint applies to them, so your license check always reaches the real server.

  • Typing either host in Pass through is refused: "“reqresapp.com” is already excluded: ReqRes's license server is never intercepted."
  • Asking an agent to exclude them changes nothing. exclude_host answers that the host is already excluded, and ReqRes does not ask you.

Add or remove a host

  1. Open Settings ▸ Capture.
  2. Scroll to Excluded from interception.
  3. In Pass through, type a host, such as api.example.com, or *.example.com for its subdomains.
  4. Click Add.

To capture a host again, click Remove beside it.

  • Type the host only, with no https:// and no path. ReqRes saves https://api.example.com or api.example.com/v1 without a warning, and that entry never matches.
  • A wildcard covers subdomains only. *.example.com covers api.example.com but not example.com. To cover both, add both.
  • An entry needs a dot, so localhost cannot be excluded. ReqRes refuses it and says why below the field: "ReqRes cannot match “localhost”. Use a host like api.example.com, or *.example.com for its subdomains."
  • A host already on the list is refused too: "“api.example.com” is already excluded." The note under the field goes away once you change the text, or remove the host it names.
  • A port is dropped: api.example.com:8443 is saved as api.example.com.

You can also exclude a host from a Failed row where the app refused ReqRes's certificate and ReqRes did not remember it. Click Exclude api.example.com… in the row's banner, then confirm "Stop recording api.example.com?".

An agent can add a host with the exclude_host MCP tool. ReqRes asks you every time, even when you have allowed agent changes without asking. The panel says: "ReqRes will stop recording api.example.com; you will no longer see its traffic." You can undo it in Settings ▸ Capture or from the activity log. See Approve agent changes.

What changes for an excluded host

  • ReqRes records nothing for it, whether or not the ReqRes certificate is trusted. Its requests do not appear in the traffic list or in the Destinations window.
  • HTTPS to it is not decrypted or changed, and stays on HTTP/2 when the app and the server both speak it.
  • Plain http:// to it is forwarded as any proxy forwards it, with hop-by-hop headers removed.
  • Rules and breakpoints do not apply to it. See Change requests and responses with rules and Hold a request with a breakpoint.
  • For HTTPS, the change applies to connections opened after it. A connection that is already open keeps working as it started. Plain http:// follows the change from the next request.

Related