Filtering

The filter bar sits above the traffic list. Use it to cut a busy session down to the few requests you care about: one endpoint, every failed call, or everything that mentions a user ID. Filters only change what you see; nothing is deleted, and clearing a filter brings every request back.

There are four kinds of filter, and they all apply at once:

• The quick filter: one text condition, focused with ⌘ F.
• Content chips: one click for HTTP or HTTPS, JSON, images, GraphQL and more.
• Multiple filters: several conditions combined with all or any, which you can save as presets.
• The sidebar: one app or one domain.

A request is shown only when it passes every active filter. The status bar then reads N of M requests.

Use the quick filter

1. Press ⌘ F, or click the filter field.

   The placeholder tells you what it searches, for example Filter by url (contains).

2. To search somewhere other than the URL, click the menu at the left of the field (it shows the current field, URL by default).

   • Under Match in, choose the part of the request to search.
   • Under Condition, choose how the text must match.

3. Type your text. The list updates as you type.

4. Press Esc or click the clear button in the field to remove the text.

Match in

Field	Searches
URL	The full URL, including scheme, host, path and query
Host	The host name only
Method	GET, POST and so on
Status Code	The response status, such as 404. Empty for requests without a response.
Request Header	Each request header as one Name: Value line. A request matches if any line matches.
Response Header	Each response header as one Name: Value line
Request Body	The request body, decompressed, as text (the first 2 MB)
Response Body	The response body, decompressed, as text (the first 2 MB)
All	URL, method, status code, every request and response header, and both bodies

Condition

All conditions ignore upper and lower case.

Condition	Matches when the value…
Contains	Contains the text anywhere
Not Contains	Doesn’t contain the text. For headers and All, none of the values may contain it.
Starts With	Begins with the text
Ends With	Ends with the text
Equals	Is exactly the text
Regex	Matches the regular expression (ICU syntax, as used by macOS)

Examples

To find	Match in	Condition	Text
Every server error	Status Code	Starts With	5
Client and server errors	Status Code	Regex	^[45]
Requests that send a bearer token	Request Header	Contains	Authorization: Bearer
Everything except analytics	Host	Not Contains	analytics
A user ID anywhere in the traffic	All	Contains	usr_1042
One versioned endpoint	URL	Regex	/v[0-9]+/users/[0-9]+$
Responses that set cookies	Response Header	Starts With	Set-Cookie

Tip

Body searches decompress gzip, deflate and Brotli bodies first, so you can search compressed responses as text. Only the first 2 MB of each body is searched.

Filter by content type and scheme

The chips to the right of the filter field filter by what a request carries.

12345

The filter bar: the quick filter, the multiple-filters button, and the content chips.

1. Choose the field and condition
2. Quick filter text (⌘F)
3. Multiple filters and presets
4. All clears every chip
5. Content chips: click one, ⌘-click to add more

×

• Click a chip to show only that kind of request. Click it again to turn it off.
• ⌘-click more chips to show several kinds at once, for example JSON and GraphQL. ⌘-click a selected chip to remove it.
• HTTP and HTTPS filter by scheme. They work separately from the content chips, so HTTPS plus JSON shows JSON sent over HTTPS.
• All turns off every chip, including HTTP and HTTPS.

Chip	Shows requests where
HTTP	The URL scheme is http
HTTPS	The URL scheme is https
JSON	The content type contains json
Form	The request body is application/x-www-form-urlencoded or multipart/form-data
XML	The content type contains xml
JS	The content type contains javascript or ecmascript
CSS	The content type is text/css
GraphQL	The request is a GraphQL query, mutation or subscription sent over HTTP
Document	The content type is text/html
Image	The content type starts with image/
Media	The content type starts with audio/ or video/, or is an HLS playlist (mpegurl)
Font	The content type starts with font/, or is WOFF or OpenType
WebSocket	The request upgrades to a WebSocket
Other	None of the above

The content type is the response’s Content-Type, or the request’s when the response has none. A request can belong to more than one chip: a GraphQL request is also JSON, and a form post that returns HTML is both Form and Document.

Combine several conditions

Use multiple filters when one condition isn’t enough, for example “URL contains users and status equals 200”.

1. Click the filters button (three sliders) next to the quick filter.

   A panel opens with one empty condition.

2. For each condition, choose a field, a condition and type a value. They use the same fields and conditions as the quick filter.

3. Click Add Condition for another row, or the minus button to remove one.

4. At the top, choose whether requests must match all or any of the conditions.

   The panel shows how many requests match as you edit, for example 3 of 38 requests match.

5. Click outside the panel to close it. The filters button shows the number of active conditions.

12345

Two conditions that must both match.

1. Match all or any of the conditions
2. Load or delete saved presets
3. Remove a condition
4. Live count of matching requests
5. Save these conditions as a preset

×

Conditions with no value are ignored. The conditions apply together with the quick filter, the chips and the sidebar. Clear resets the panel to one empty condition.

Save and reuse presets

Presets save a set of conditions under a name so you can bring them back in any session. Cloak Proxy remembers them between launches.

Save a preset

1. Set up your conditions in the multiple filters panel.

2. Click Save as Preset…. It’s available once at least one condition has a value.

3. Type a name and click Save (or press Return).

   Saving with the name of an existing preset replaces it.

Use a preset

1. Open the multiple filters panel.

2. Click Presets and choose a preset by name.

   Its conditions and its all or any setting replace what’s in the panel.

Delete a preset

1. Open the multiple filters panel.
2. Choose Presets › Delete and pick the preset.

Reset every filter

When any filter is on, a Reset button appears at the right of the filter bar. It clears the quick filter text, the multiple filter conditions, every chip, and the sidebar selection (back to All Traffic). Saved presets are kept.

You can also reset from the empty list (Reset Filters) or from Search Everything (Reset Filters). Search Everything also has a Show Only action for each chip, such as Show Only JSON.

Note

Filters hide requests from the list and the status bar count. File › Export exports the visible requests unless you’ve selected more than one, so a filter is also a quick way to export a subset. See Export.

Related

Traffic listColumns, sorting, highlights and comments.

SidebarShow one app or one domain.

Search and command paletteFind any request, action or setting with ⇧⌘A.

ExportSave the requests you filtered as HAR, CSV, Postman or OpenAPI.