Export

Export turns captured traffic into files other people and tools can use: HAR for browsers and other debuggers, CSV for a spreadsheet, a Postman collection to replay requests, OpenAPI to document an API, or a Cloak Proxy session for a complete copy. For a single request, Copy as puts it on the clipboard as cURL or code in one of 20 languages.

Export requests

1. Choose what to export:
   • Select two or more requests in the traffic list to export just those.
   • Select one request or none to export everything the main window shows, after its sidebar selection and filters.
2. Choose File › Export and a format: Cloak Proxy Session…, HAR…, CSV…, Postman Collection… or OpenAPI (YAML)…. The bottom of the menu says which requests will be exported, for example “Exports the 3 selected requests” or “Exports all visible requests”.
3. In the save panel, check the name. It defaults to Cloak Proxy with the date and time and the format’s extension.
4. Turn on Redact secrets: tokens, cookies, passwords, API keys and card numbers if the file will leave your Mac. See Redaction.
5. Click Save.

The save panel’s message confirms the count and format, such as “Export 12 requests as HAR”. If nothing matches, Cloak Proxy shows There are no requests to export. If writing fails, it shows Export failed: with the reason.

Other ways to export

Where	What it exports
Right-click requests › Export Request or Export N Requests	The requests you right-clicked: the selection if the clicked row is part of it, otherwise just the clicked row. Has the same five formats.
File › Save Session… (⌘ S)	Every captured request as a session, ignoring filters and selection. See Save and open sessions.
Search Everything (⇧ ⌘ A)	Export as HAR… and the other formats, with the same rules as the File menu.
Insights › Endpoints › Export OpenAPI…	The requests behind the endpoints listed in the catalog. See Endpoints.
Right-click requests › Publish to GitHub Gist…	HAR, cURL commands or a Postman collection, uploaded as a gist. See Publish to Gist.

Exports contain cookies and tokens

HAR, Postman and session files include headers and bodies, and OpenAPI includes example values copied from requests. That means session cookies, Authorization headers, API keys and anything personal in the traffic. Turn on Redact secrets before sharing an export, and only share traffic you’re allowed to share.

The Redact secrets checkbox is off the first time and then remembers your last choice for every export and Save Session.

Formats

Format	Extension	Opens in	Best for
Cloak Proxy Session	.cloaksession	Cloak Proxy	A complete copy, exactly as captured
HAR	.har	Browser developer tools and most HTTP tools	Sharing with people who use other tools
CSV	.csv	Numbers, Excel, Google Sheets	A list of requests with status, timing and size
Postman Collection	.postman_collection.json	Postman and the Cloak Proxy API client	Replaying requests
OpenAPI (YAML)	.yaml	Swagger tools, API gateways, the API client’s spec editor	Documenting an API

Cloak Proxy Session

Every request and response with headers, bodies exactly as captured, timing, the client app, the tools that touched it, WebSocket messages and undecrypted tunnels. See Save and open sessions.

HAR

A HAR 1.2 file with creator set to Cloak Proxy. For each request:

Included	Details
Request	Method, URL, HTTP version, headers, query string, body size and the decoded body as postData.
Response	Status, status text, HTTP version, headers, redirectURL from the Location header, body size, and the decoded body as content.text with its MIME type and decoded size.
Binary bodies	Base64 with "encoding": "base64".
Timing	startedDateTime and time in milliseconds. The whole duration is reported as wait, with send and receive at 0.
Cloak Proxy extras	_cloakClient, the app that sent the request, and _error on the response for failed requests. Cloak Proxy reads both back on import.

Undecrypted tunnels (CONNECT requests) and WebSocket messages aren’t included. Cookies are in the headers; the HAR cookies arrays are empty.

CSV

One row per request, with a header row:

Column	Contents
ID	The request number.
Start	Start time in ISO 8601.
Client	The app that sent it.
Method	HTTP method.
URL	Full URL.
Status	Status code, tunnel for an undecrypted tunnel, or error for a failed request.
Duration (ms)	Total time in whole milliseconds.
Request Size	Request body size in bytes.
Response Size	Response body size in bytes, as received.
Content Type	The response Content-Type.
Tools	Debugging tools that touched the request, separated by ; .

Fields with commas, quotes or line breaks are quoted. CSV has no headers or bodies, so it’s the safest format to share, but URLs can still contain tokens in query strings.

Postman Collection

A Postman Collection v2.1 named Cloak Proxy Export, with one request per exported request (tunnels are skipped) and no folders.

Included	Details
Name	The method and path, such as GET /v1/users.
Request	Method, URL split into protocol, host, port, path and query, and every header except Host, Content-Length and Connection.
Body	The decoded text body in raw mode, marked as JSON when the Content-Type is JSON. Binary bodies are left out.
Saved response	The captured response as an example named Captured response, with status, headers and body.

Import the file into Postman, or into the Cloak Proxy API client. To turn captured requests into an API client collection directly, see Capture to client.

OpenAPI (YAML)

An OpenAPI 3.0.3 document titled Captured API, version 1.0.0, described as “Generated by Cloak Proxy from captured traffic.”

Part	How it’s built
servers	One per scheme, host and port seen.
paths	One per templated path. A segment that’s all digits, a UUID, or 16 or more hex characters becomes a parameter named after the segment before it, with a trailing s dropped: /users/42 becomes /users/{userId}. With no usable segment before it, the parameter is {id}.
Operations	get, post, put, patch, delete, head and options. Other methods are skipped. Each has a summary like GET /users/{userId}.
Parameters	Path parameters, required, with an example from the first request. Query parameters, optional strings, with an example value.
requestBody	For JSON request bodies: an inferred schema and the body as an example.
responses	One per status code, using the first response seen with that code: its reason phrase as the description and, for JSON, an inferred schema.

Schemas are inferred from the JSON: objects with their properties, arrays from their first item, string, integer or number, boolean, and nullable for null. They describe what was seen, not every possible value, so review them before publishing. The API client’s spec editor can open and lint the result.

OpenAPI examples come from real requests

Query parameter examples, path parameter examples and request body examples are copied from captured traffic. Turn on Redact secrets before sharing the file.

Copy as cURL and code

To put requests on the clipboard instead of in a file, right-click them in the traffic list:

Menu item	What’s copied
Copy URL	The URLs, one per line.
Copy as cURL	A curl command for each request.
Copy as › language	Code that sends each request, in the language you pick.
Copy Response Body	The decoded response body of the last request in the selection, as text. Shown when it has one.
Copy Request Body	The decoded request body of the last request in the selection, as text. Shown when it has one.

When several requests are selected, their commands are separated by a blank line. Undecrypted tunnels are skipped.

Copy as offers: cURL, Swift, JavaScript, Python, Go, HTTPie, Shell – wget, HTTP, NodeJS – Axios, Python – http.client, Java – OkHttp, Kotlin – OkHttp, C# – HttpClient, PHP – cURL, Ruby – Net::HTTP, Rust – reqwest, Dart – http, PowerShell, C – libcurl and Markdown. See Copy as code for what each one produces.

In the inspector, the ⋯ menu also has Copy URL, Copy as cURL, Copy Request and Copy Response, which copy the raw HTTP message with decoded bodies.

Copied commands include credentials

Copy as cURL and the code snippets include every header, so they carry the same cookies and tokens as the request. Copying doesn’t redact. Remove credentials before pasting a command into a chat or ticket.

Export from the command line and MCP

Tool	What it does
cloakctl export [--out FILE]	Asks the running app for the requests its proxy captured and writes them as HAR to a file, or to standard output without --out. Not redacted. See cloakctl.
cloakctl run --record FILE [--redact]	Records a headless run to HAR (.har) or a session (any other extension), optionally redacted. See Headless and CI.
MCP export_session	Writes requests as a session, HAR, CSV, Postman collection or OpenAPI, optionally only some request ids and optionally redacted. See MCP tools reference.

Terminal

cloakctl export --out capture.har

Related

RedactionExactly what Redact secrets removes.

Publish to GistShare requests as a GitHub gist.

ImportOpen HAR, Charles and cURL.

Copy as codeEvery language Copy as supports.