Supported protocols

ReqRes is an HTTP and HTTPS proxy that your Mac points at while capture runs. This page lists, protocol by protocol, what ReqRes records, what it only relays, and what never reaches it, so a missing request is not mistaken for a broken capture.

The same list is in the app, in Help ▸ ReqRes Help ▸ Supported Protocols.

Each protocol and its status#

Each entry has one of 4 statuses, in the app's words:

• Supported: captured request by request, with the inspector, rules and breakpoints.
• Beta, off by default: captured once you turn on a setting.
• Relayed, not read: one row per connection, written when it closes. ReqRes never reads what the connection carries.
• Not captured: nothing in the list, or at most a failed row that says why.

HTTP and HTTPS#

Once you install and trust the ReqRes certificate, each HTTPS request is one row: method, URL, headers, status, timings, the app that made it and where its server is. Bodies are decoded from gzip, deflate, brotli and zstd. A slow request or a stream is listed while it is still open. Rules, breakpoints and saved sessions all apply.

Until the certificate is installed and trusted, HTTPS is relayed instead:

• Each connection is one row, written when it closes: host and port, the bytes sent each way, and how long it was open. There are no requests, headers or bodies.
• ReqRes does not touch the traffic. The app talks to the real server, with the server's own certificate.
• Opening one of these rows never uses a free HTTPS inspection.

When you trust the certificate, connections opened after that are decrypted without restarting capture. A connection that is already open stays relayed until its app reconnects. See Trust the ReqRes certificate.

Plain HTTP on any port#

A plain http:// request on any port is captured like HTTPS, with no certificate needed. Rules match its path and query, and mocks and breakpoints apply. ws:// is captured too.

Loopback is the exception. Browsers and Electron apps never send localhost, 127.0.0.1 or ::1 to a proxy, and most apps built on Apple's networking skip it too. So http://localhost:3000 opened in them is not in the list. To capture a local backend, call it from a tool pointed at the proxy with NO_PROXY unset:

unset NO_PROXY no_proxy
curl -x http://127.0.0.1:8034 http://localhost:3000/

If you changed the port in Settings ▸ Capture ▸ Proxy port, use yours instead of 8034. You can also reach it by your Mac's network name instead of localhost. The environment lines in Capture command-line tools and agents skip localhost, 127.0.0.1 and ::1 on purpose, through NO_PROXY.

HTTP/2 and gRPC#

HTTP/2 capture is a beta, and it is off by default. Turn it on in Settings ▸ Capture ▸ HTTP/2 ▸ Capture HTTP/2 (beta).

• Off: the app and the server both speak HTTP/1.1 to ReqRes. Most apps accept this without noticing. A client that speaks only HTTP/2 fails.
• On: when the app and the server both speak HTTP/2, ReqRes speaks it to both and records one row per request. The Protocol row in the Metrics tab says which protocol a request used, and proto:h2 in the search field finds them.
• The switch applies to connections opened after the change. Capture does not need restarting. Turn it off if a site misbehaves.
• A host with an enabled Map Local rule, or an Override rule with a body, stays on HTTP/1.1, so ReqRes can answer it without contacting the server.
• WebSockets stay on HTTP/1.1.
• Trailers, the header fields sent after a body, appear in the Headers tab under Request Trailers and Response Trailers.

gRPC comes in 2 kinds:

• gRPC-Web and Connect are supported. Each call is one row with an RPC tab: the service and method, each message decoded without the .proto, and the call's own status beside the HTTP one. A gRPC-Web error arrives as HTTP 200, so the row reads "200 · NOT_FOUND". Type grpc:error in the search field to find the calls that failed.
• Native gRPC is a beta that needs HTTP/2 capture. With it on, each call is a row whose RPC tab shows its messages and the status from its trailers. With it off, a gRPC client fails through ReqRes. Most gRPC libraries ignore the macOS system proxy, so point the client at http://127.0.0.1:8034 with the environment lines and give it the ReqRes certificate the way its TLS library reads one.

A call that is still streaming is listed from its response head and grows while it runs. See Capture HTTP/2 and gRPC.

WebSocket#

A WebSocket handshake is one row, with status 101 Switching Protocols. Its Messages tab lists the messages both ways as they pass: text, binary, ping, pong and close.

• ReqRes keeps the first 200 and the last 2,000 messages of a connection, and says how many it let go in between.
• ws:// needs nothing. For wss://, trust the certificate. Before that, the connection is a relayed row with no messages.

See Read WebSocket messages.

Server-sent events and NDJSON streams#

A stream is a row from its response head, and the row grows while the stream runs. Its Events tab numbers each complete event. An answer from Anthropic or OpenAI is put back together: text, tool calls, stop reason and tokens.

See Read streaming responses.

Long responses and idle connections#

ReqRes closes a connection only when nothing has moved in either direction for:

• 30 s between requests;
• 300 s while a response is awaited or streaming;
• 10 minutes on a relayed connection: a WebSocket, an excluded host, or a connection opened before the certificate was trusted.

A download, upload or stream that keeps moving is never cut.

Each request keeps at most the first 16 MB of its bodies for display, request and response together. Everything is still sent on in full, and a row that kept less says how much is missing. With HTTP/2 capture on, the requests open at the same time on one HTTP/2 connection keep at most 64 MB between them.

ReqRes adds no headers of its own. Traffic changes only where one of your rules says so. The one exception is a request you abort at a breakpoint: the response ReqRes sends in its place carries X-Req-Res-Aborted: breakpoint.

Settings shows these facts under Settings ▸ Capture ▸ What capture changes, keeps and closes.

HTTP/3 and QUIC#

ReqRes does not capture HTTP/3. QUIC runs over UDP and never passes through ReqRes's proxy, so a request an app sends over HTTP/3 is not in the list at all.

Browsers use HTTP/3 only with sites that offer it. They fall back to TCP, through ReqRes, when QUIC is blocked or fails. So one site can show some of its requests and not others.

To see all of a site's requests, turn QUIC off in the app while you debug. In Chrome, Brave and Edge, set chrome://flags/#enable-quic to Disabled and relaunch.

Other protocols#

A connection through the proxy that carries neither HTTP nor TLS, such as SSH, a database or cleartext HTTP/2, is passed on untouched. It is listed as one row when it closes: endpoint, bytes each way, and how long it was open.

With the certificate trusted, ReqRes opens all TLS through the proxy as HTTPS:

• A protocol other than HTTP inside TLS fails, such as IMAP or SMTP over TLS, or a database over TLS.
• A protocol whose server speaks first, such as SMTP, IMAP or FTP, waits for the app and is closed after 30 s.

For either, add the host to Settings ▸ Capture ▸ Excluded from interception to pass it through untouched. SOCKS, UDP and DNS never reach ReqRes at all.

Hosts ReqRes passes through#

Excluded hosts#

A host on the exclusion list is not recorded, over https:// and plain http:// alike. It gets no row, no rules and no breakpoints.

• HTTPS to it is passed straight through without decrypting it, with the server's own certificate, and HTTP/2 if both sides speak it.
• Plain http:// to it is forwarded the way any proxy forwards it, with hop-by-hop headers removed.
• timestamp.apple.com (code signing) and *.ls.apple.com (Apple Maps) are on the list by default.

See Pass a host through untouched.

Apps that pin their certificate#

Some apps check their servers' certificates themselves, which is called SSL pinning. WhatsApp's media and banking apps do this. Such an app refuses ReqRes's certificate:

1. The request that meets the refusal fails. It leaves a Failed row that names the host and the app.
2. ReqRes remembers the app and the host's domain.
3. From then on, that app's connections there are passed through untouched. The app works while you capture, and each connection is a row marked "SSL pinned by" and the app's name, with the endpoint, the bytes each way and how long it was open.

Try again in the app after the first failure. A refusal alert counts at once. A bare hang-up counts only when it repeats within 30 s, because a browser's spare connection looks the same.

Settings ▸ Capture ▸ SSL-pinned apps lists what ReqRes remembered. Forget one to try decrypting it again. See Keep SSL-pinned apps working.

Apple services macOS pins#

iCloud, Software Update, the App Store, push notifications, Find My and the other hosts on macOS's own pinning list accept only Apple's certificate. No proxy can decrypt them. ReqRes passes them through untouched, so these services keep working while you capture. Each connection is one row marked "SSL pinned by macOS" and the service, such as "SSL pinned by macOS · iCloud".

You need to do nothing. A certificate does not change macOS's rule. To pass one of these hosts through without a row, exclude it.

Servers that require a client certificate#

ReqRes presents no client certificate to the server, so a request to a server that requires one (mTLS) fails. It leaves a Failed row, and ReqRes answers the app with a 502 that names the reason. A gRPC call gets grpc-status 14 UNAVAILABLE instead, with the reason in grpc-message.

Exclude the host. Its connections then carry the app's own certificate, unrecorded. See See why a request failed.

Tools that ignore the system proxy#

Capture works by pointing the macOS system proxy at ReqRes. curl and git (Apple's included), the Claude Code CLI, node, Go and Rust programs, and processes inside Docker containers ignore it. Their traffic is not in the list at all, not even as Unknown.

Point them at ReqRes with the environment lines in Settings ▸ Capture ▸ Capture a command-line tool. The proxy address starts with http:// even for HTTPS traffic. An https:// proxy URL does not work. See Capture command-line tools and agents.

What rules and breakpoints support#

• Rules apply to HTTPS and plain http://, and match the path and the query on both. See Write a URL pattern that matches.
• A Map Local rule, or an Override rule with a body, answers without contacting the server. See Change requests and responses with rules.
• Breakpoints hold HTTPS and plain http:// requests alike. See Hold a request with a breakpoint.
• No rule or breakpoint applies to a relayed connection or an excluded host. That covers HTTPS before the certificate is trusted, SSL-pinned apps and services, and other protocols.

Other devices#

ReqRes captures traffic from the Mac it runs on. The proxy listens on 127.0.0.1 only, so an iPhone or another computer cannot use it as a proxy. The port is 8034 by default. See Change the proxy port.