API client overview

Cloak Proxy includes a Postman-style API client in its own window. You build requests, group them into collections, test responses with JavaScript, and run whole collections, all on your Mac with no account. It speaks HTTP, GraphQL, gRPC, WebSocket, Socket.IO, MQTT, MCP, AI, SQL and raw TCP or UDP, and its requests can go through the proxy so they show up next to the rest of your traffic.

Use it when you want to call an API on purpose rather than watch an app call it: to try an endpoint, reproduce a bug, write tests, or turn a request you captured into something you can edit and send again.

Open the API client

1. Press ⇧ ⌘ O, or choose File › API Client.

   You can also click API Client in the main window’s toolbar, or search for “API Client” in global search (⇧ ⌘ A).

2. The first time it opens, the client creates a workspace with a Getting Started collection (three requests against https://httpbin.org) and a Local environment, and opens the first request.

3. Press ⌘ ↩ to send it. The response, test results and console output appear in the lower half of the editor.

To jump straight to the MCP hub, press ⇧ ⌘ M (File › MCP…). See MCP client.

The window

12345

The API client: section rail, sidebar, tabs and the editor for the selected tab.

1. Rail: switches the sidebar between the client's sections
2. Sidebar: the selected section's items, here collections, folders and requests
3. Tabs: every open request, collection, environment and tool
4. Editor for the selected tab
5. Recently Deleted, shown when something was deleted in the last 30 days

×

The window has five regions, left to right:

Region	What it does
Rail	One button per section. Clicking a section changes what the sidebar lists. MCP, Webhooks, Vault and Git also open their own tab.
Sidebar	The section’s items. Collections, Datasets, History, Specs, Flows and Packages have a Filter field at the top. Drag the sidebar’s right edge to resize it (200 to 460 points).
Tab strip	Every open item as a tab. Unsaved requests have italic titles. Right-click a tab for Close, Close Other Tabs and Close All Tabs. The + button (⌘ T) opens a new HTTP request.
Editor	The selected tab. A request shows its editor on top and the response below, with a draggable divider between them.
Agent panel	Optional. Agent in the toolbar (⇧ ⌘ I) opens an AI assistant on the right. See Agent Mode.

You can also drop files onto the window to import them: Postman collections and environments, OpenAPI or Swagger specs, HAR files and Insomnia exports. See Import and export.

Toolbar

Control	What it does
Search	Opens global search (⇧ ⌘ A). It finds collections, requests, environments, specs, flows, datasets, monitors and packages, as well as proxy actions and settings.
New	HTTP Request, Other Protocols (GraphQL, gRPC, WebSocket, Socket.IO, MQTT, MCP, AI, TCP / UDP, Data), Collection, Environment, Spec and Flow.
Import	Opens the Import sheet.
Environment menu	Picks the active environment for {{variables}}, or No Environment. Manage Environments… opens the Environments section.
Agent	Shows or hides the Agent panel (⇧ ⌘ I).

Sidebar sections

Section	What it holds	Learn more
Collections	Collections, folders and saved requests of every protocol.	Collections and requests
MCP	MCP servers saved as MCP requests, and the MCP hub.	MCP client
Environments	Globals and your environments. The green check marks the active one.	Variables and environments
Datasets	Tables of test data the runner iterates over.	Datasets and data files
History	Every request you sent, grouped by day.	History and Recently Deleted
Specs	OpenAPI and Swagger documents.	Specs
Flows	Visual request chains.	Flows
Packages	Shared script modules and downloaded npm packages for pm.require.	Scripts and tests
Mocks	Local mock servers, one per collection, with the port of each running one.	Mock servers
Monitors	Scheduled collection runs.	Monitors and webhooks
Webhooks	A local receiver for webhook deliveries.	Monitors and webhooks
Vault	Secrets kept in the macOS Keychain.	Variables and environments
Git	Commit, pull, push and branch the workspace folder.	Workspace and Git

How the client relates to the proxy

The API client and the proxy share one app. By default, every request you send from the client goes through Cloak Proxy on its port (9090 unless you changed it), so:

• It appears in the main window’s traffic list, where you can inspect it like any captured request.
• The debugging tools apply to it: a breakpoint can pause it, Map Local can answer it.
• HTTPS requests are decrypted only if SSL Proxying is on for that host.

Turn off Send through Cloak Proxy in a request’s Settings tab to send it directly. Direct requests don’t use the macOS system proxy either. See Request settings.

The other direction works too: right-click any captured request and choose Save to API Client. See Save captured requests.

What goes through the proxy is recorded

Requests sent through the proxy, including their Authorization headers and cookies, are in the traffic list. If you export that session as HAR or publish it as a Gist, those values go with it unless you redact them.

Keyboard shortcuts

Shortcut	Action
⇧ ⌘ O	Open the API client
⇧ ⌘ M	Open the MCP hub
⌘ T	New HTTP request in an unsaved tab
⌘ ↩	Send the request
⌘ S	Save an unsaved request (the shortcut of its Save menu)
⇧ ⌘ I	Show or hide Agent Mode
⇧ ⌘ A	Global search

All of Cloak Proxy’s shortcuts are in Keyboard shortcuts.

Where your work is kept

Everything in the client lives in a workspace folder of small JSON files, one per request, so you can keep it in Git and review changes. Secret values stay in a git-ignored .cloak/ folder, and real credentials can live in the macOS Keychain. See Workspace and Git.

The same workspace is available from the command line: cloakctl collection run runs collections in CI, and cloakctl mcp lets AI assistants read and edit it. See cloakctl and MCP server.

Related

Collections and requestsBuild, organize and send requests.

Workspace and GitHow the workspace is stored and versioned.

Scripts and testsThe pm API for tests and automation.

Collection runnerRun every request in a collection.