Import

Cloak Proxy can open traffic captured somewhere else: a HAR file saved from a browser’s developer tools or another proxy, a Charles JSON session, or a Cloak Proxy session from a teammate. Imported requests appear in the traffic list next to live traffic, so you can inspect, filter, compare, repeat and analyze them like anything you captured yourself. You can also paste a curl command to rebuild a single request.

Supported formats

Format	Extension	Notes
Cloak Proxy session	.cloaksession	Everything, exactly as saved. See Save and open sessions.
HAR 1.2	.har	Saved by browsers’ developer tools and most HTTP debugging tools.
Charles JSON session	.chlsj	A Charles session exported in its JSON format.
JSON	.json	Tried as a Cloak Proxy session, then HAR, then Charles.
cURL command	(pasted text)	Loads one request into Compose. See Import a cURL command.

Charles settings files (.config, rewrite rules and so on) can’t be imported.

Open a file

1. Choose File › Open Session… or press ⌘ O.
2. Select one or more .cloaksession, .har, .chlsj or .json files.
3. Click Open.

You can also drag files onto the main window, or press ⇧ ⌘ A and choose Open Session, HAR or Charles File….

Cloak Proxy works out the format from the contents, not just the extension. For .cloaksession and .json files it tries a Cloak Proxy session first, then HAR, then Charles.

What happens to imported requests

• They’re added to the traffic list. Press ⌘ K first if you want to see only the file.
• They’re numbered after the requests already in the list.
• Requests with no app recorded appear in the sidebar under Imported: name, where name is the file name without its extension. Select it to see only that file’s requests.
• The first imported request is selected.
• HTTPS requests are marked as decrypted, so their headers and bodies show in the inspector.

If the file isn’t a format Cloak Proxy recognizes, it shows Couldn’t open with the file name and “This file isn’t a Cloak Proxy session, HAR, or Charles session”.

How HAR files are read

HAR field	Becomes
request.method, request.url, request.httpVersion, request.headers	The request line and headers. Missing values default to GET and HTTP/1.1.
request.postData.text	The request body. Base64 bodies ("encoding": "base64") are decoded.
response.status, statusText, httpVersion, headers	The response.
response.content.text	The response body, decoded from base64 when marked.
startedDateTime, time	When the request started and how long it took.
_cloakClient	The app that sent the request, for HAR files exported by Cloak Proxy.
response._error	The failure reason, for HAR files exported by Cloak Proxy.

A response with status 0 or no response becomes a failed request with the reason “No response”. HAR stores bodies already decoded, so Cloak Proxy removes the response’s Content-Encoding header to keep the body viewers from decoding them a second time. Entries without a valid URL are skipped.

How Charles sessions are read

Charles field	Becomes
scheme, host, actualPort or port, path, query	The URL. The port is left out when it’s the default for the scheme.
method, protocolVersion	The request line. CONNECT transactions are skipped.
request.header.headers, request.body	Request headers and body. Bodies can be text or base64 encoded.
response.status, response.header.headers, response.body	The response. Content-Encoding is removed, as for HAR.
times.start, times.end	Timing.
clientAddress	The client’s address.
status, errorMessage	A transaction whose status isn’t COMPLETE, or that has no response, becomes a failed request with its error message.

Import a cURL command

A curl command copied from a browser’s developer tools, API documentation or a teammate can be turned into a request you can edit and send. It opens in the Compose window rather than the traffic list. When you send it, the request and its response are captured like any other.

1. Choose File › Compose Request or press ⌥ ⌘ N.
2. Click Import cURL. If the clipboard holds a command starting with curl, it’s already filled in.
3. Paste or edit the command and click Import.
4. Check the method, URL, headers and body, then send the request.

You can also paste a whole curl … command into Compose’s URL field. Cloak Proxy recognizes it and imports it the same way.

A command Compose can import

curl 'https://api.example.com/v1/users?page=2' \
  -H 'Authorization: Bearer sk_test_xxxx' \
  -H 'Accept: application/json' \
  --compressed

Supported curl options

Option	Effect
-X, --request	Method.
-H, --header	A header.
-d, --data, --data-raw, --data-binary, --data-ascii	Body. Several are joined with &. Sets the method to POST unless one is given, and Content-Type: application/x-www-form-urlencoded unless a Content-Type header is given.
--data-urlencode	A URL-encoded body field.
--json	A body, plus Content-Type: application/json and Accept: application/json unless those headers are given.
-F, --form	A multipart/form-data field.
-u, --user	An Authorization: Basic header.
-A, --user-agent	User-Agent header.
-e, --referer	Referer header.
-b, --cookie	Cookie header, when the value contains = (a cookie file name is ignored).
-I, --head	HEAD request.
-G, --get	Moves the -d data into the query string and sends a GET.
--url	The URL.

Options that don’t change the request itself, such as --compressed, -k, -L, -s, -v, -o, -x, --max-time and --cert, are accepted and ignored, as are unknown options. Single quotes, double quotes, $'…' strings, backslash escapes and line continuations are handled. A URL without a scheme gets http://.

Files can’t be read from a pasted command. -d @file becomes the placeholder <contents of file> and -F name=@file becomes a file part named after the file with <file> as its content, so you can replace them before sending.

If the command can’t be read, the Import cURL sheet shows the reason under the command and stays open. When you paste into the URL field instead, Compose shows Couldn’t import that curl command: with the reason, such as “That doesn’t start with curl.” or “No URL found in the command.”

For more on Compose, see Repeat and Compose. To save imported requests in a collection instead, the API client imports cURL, HAR, Postman and OpenAPI too.

Imported files can hold someone else's credentials

A HAR or session file from someone else often contains their cookies and tokens. Don’t replay requests from it against a live service unless you’re allowed to, and delete the file when you’re done.

Import from the command line or MCP

• The MCP server’s import_session tool opens a HAR, Charles or Cloak Proxy session file into the traffic list. See MCP tools reference.
• cloakctl run --mock recorded.har answers requests from a recorded HAR or session instead of the network. See Headless and CI.
• Mock Sets can also be created from a HAR or session file with Import HAR or Session….

Related

Save and open sessionsThe .cloaksession format and what it keeps.

ExportWrite HAR, CSV, Postman and OpenAPI.

Repeat and ComposeEdit and send requests by hand.

Insights overviewAnalyze imported traffic for secrets and problems.