Endpoints

The Endpoints tab turns captured traffic into an API catalog. Requests that differ only by an ID in the path, like /users/1 and /users/2, are grouped into one endpoint template, /users/{id}, with call counts, error rates, latency percentiles, response sizes, query parameters and the apps that called it. Use it to learn an undocumented API, spot the slowest or most error-prone endpoints, or export an OpenAPI description of what an app really calls.

12345

Each row is one endpoint template. Select a row to see its details below the table.

1. Filter endpoints by method, host or path
2. Export OpenAPI… saves the listed endpoints as OpenAPI
3. Click a column header to sort
4. Errors in red, with the error rate
5. p95 turns orange above one second

×

Browse the catalog

1. Open Insights with ⌥ ⌘ I and click Endpoints.
2. Type in Filter endpoints to narrow the list. It matches the endpoint title (method, host and path) without regard to case. The count next to it shows how many endpoints are listed.
3. Click a column header to sort. The list starts sorted by Calls, most first.
4. Select a row to see its status codes, parameters, callers and latency in the pane below.
5. Click Show Requests in that pane to select every request behind the endpoint in the main window.

If no API calls have been captured yet, the tab says No API endpoints yet.

Table columns

Column	What it shows
Method	The HTTP method, in capitals.
Host	The host, in lowercase.
Path	The endpoint template, with IDs replaced by placeholders. The query string isn’t part of the path.
Calls	How many requests matched this endpoint.
Errors	The number of 4xx and 5xx responses plus requests that failed with no response, followed by the error rate as a percentage. Shows – when there are none.
p50	Median response time.
p95	95th percentile response time. Shown in orange when it’s over one second.
Avg size	Average response body size per call.

Percentiles use the nearest-rank method over every request to the endpoint that got a response. An endpoint whose requests all failed shows – for p50 and p95.

Endpoint details

Select an endpoint to see:

Field	What it shows
Status codes	Each status code with its count, such as 200 × 12. Codes under 300 are green, 3xx orange, and 400 and above red. Requests with no response appear as failed × N.
Query parameters	Every query parameter name seen on this endpoint, or None.
Content types	Every response Content-Type seen, without parameters such as charset.
Called by	The apps that made these requests.
Latency	Average, p50, p95 and maximum response time.
Seen	The time of the first and the last request.

How requests become endpoints

Two requests belong to the same endpoint when they have the same method, the same host and the same templated path. Cloak Proxy templates a path by looking at each segment between slashes and replacing the ones that look like identifiers:

Segment looks like	Becomes	Example
Only digits	{id}	/orders/1042 → /orders/{id}
A UUID	{uuid}	/files/3f2b1c9e-6a1d-4e2f-9b8a-0c1d2e3f4a5b → /files/{uuid}
A date in YYYY-MM-DD form	{date}	/reports/2026-10-13 → /reports/{date}
16 or more hex characters including at least one digit	{hash}	/commits/9f1c2ab34de56f78 → /commits/{hash}
Contains @ and .	{email}	/users/ada@example.com → /users/{email}
20 or more characters with at least three digits and no .	{token}	/invite/a8Kq2mZ7x1Lp0Wc4Rt9e → /invite/{token}

Short words with a digit, like v1 or page2, stay as they are.

What isn’t an endpoint

The catalog leaves out:

• HTTPS tunnels that weren’t decrypted, and CONNECT requests.
• Images, stylesheets, JavaScript, fonts and media files.

These still appear in the Timeline and, where relevant, on the Performance and Security tabs.

Export the catalog as OpenAPI

Click Export OpenAPI… above the table to save the endpoints currently listed as an OpenAPI 3 document in YAML. If you’ve typed in Filter endpoints, only the listed endpoints are exported.

1. Optionally filter the list to the endpoints you want.
2. Click Export OpenAPI….
3. In the save panel, choose a name and folder. Turn on Redact secrets if the example values could include tokens or personal data.
4. Click Save.

The export includes servers, paths, path and query parameters with example values, request body schemas inferred from JSON, and a response entry per status code. The OpenAPI export names path parameters after the segment before them, so /users/42 becomes /users/{userId}. See Export for exactly what’s written.

Examples come from real traffic

The OpenAPI file includes example values taken from captured requests, such as query parameter values and JSON request bodies. Turn on Redact secrets before sharing it. See Redaction.

Endpoints in the report and over MCP

The Markdown report lists the 50 endpoints with the most calls, with calls, errors, p50 and p95. The MCP server’s insights tool returns the catalog with section set to endpoints. See Insights report and MCP tools reference.

Related

Turn traffic into API docsGo from captured traffic to an OpenAPI spec and collection.

PerformanceSlow, large, duplicate and N+1 requests by endpoint.

Schema changesCatch fields that change between responses.

ExportEvery export format and what it contains.