# Hosted mocks (on Subcloak's servers)

> Publish a team mock set at an unguessable public URL served by Subcloak, for apps, devices and teammates that can't use your Mac's proxy. Not end-to-end encrypted.

Source: https://docs.subcloak.com/cloak-proxy/team/hosted-mocks/

Added in Cloak Proxy 0.7.0.

{/*
  L9 draft. Sources: PLAN 1.1 (hosted mocks row), 7.12, 7.14, 8.4, 9.5 page 10, 6.8; T14.
  Production serves hosted mocks in path mode on one shared origin, mocks.subcloak.link/<id>/ (hosted/config.ts; R2D-L2).
  Re-check labels against L5/L8.
*/}

A **hosted mock** serves one of your team's mock sets at a public address, from Subcloak's servers. Use it when something can't reach a Mac running Cloak Proxy: a teammate's phone, a preview build, a partner's test environment.

> *** Not end-to-end encrypted, and public:**
> Hosted mocks run on Subcloak's servers, which read them to serve them. Anyone who has the URL can call it. Don't put real personal data, credentials or anything secret in a hosted mock.

## Publish a mock set

{/* PLAN 7.12 publishing */}

1. Open a mock set under **Team: Acme › Mocks** and choose **Host on Subcloak's Servers\*…**. The sheet starts with the warning above.

2. Publish. Cloak Proxy sends a readable copy of the set's routes to Subcloak's servers. The team mock set itself stays end-to-end encrypted.

3. Copy the URL. It looks like `https://mocks.subcloak.link/k3j9w2m4p8x1q6ra/`: a 16-character random name that can't be guessed. Every team's hosted mocks share that one sandboxed address, which serves no web pages or scripts.

Publishing the same mock set again from the same Mac replaces it with a new version at the same URL. Publishing it from another Mac makes a new copy at a new URL; unpublish the old one in the console. **Unpublish** deletes the copy from our servers. The copy is encrypted at rest with Subcloak's own key, which isn't end-to-end encryption.

## What a hosted mock can serve

{/* PLAN 7.12 serving */}

| | |
|---|---|
| Routes | Up to 500, matched by method and path. Paths can have parameters (`/users/:id`) and `*` |
| Each response | A status, headers and a body of up to 256 KB, served without a delay |
| Content types | JSON, plain text, CSV, and PNG, JPEG, GIF or WebP images. XML keeps its type but is always sent with `Content-Disposition: attachment`, so a browser downloads it instead of showing it. Anything else is served as `text/plain` with `Content-Disposition: attachment` |
| Headers | `content-type`, `cache-control`, `x-*` and CORS headers. `set-cookie`, `Content-Security-Policy` and redirects are refused |
| CORS | On by default |

Every response also carries `Content-Security-Policy: sandbox; default-src 'none'`, `X-Content-Type-Options: nosniff`, `Referrer-Policy: no-referrer`, `X-Robots-Tag: noindex` and `X-Abuse: abuse@subcloak.com`. So a hosted mock can't serve a working web page or script. {/* PLAN 7.12, LAUNCH 1 gate */}

## Limits

{/* PLAN 8.4 */}

| Limit (per team) | Value |
|---|---|
| Hosted mock sets | 10 |
| Requests | 10,000 a month for each seat |
| Rate | 20 requests a second |
| Response size | 256 KB |
| Routes per set | 500 |

Over a limit, the mock answers `429` with a JSON body that names the limit.

## Who can use it

{/* PLAN 7.12, 7.14, 6.8; LAUNCH 4.1 */}

- Hosted mocks are for active, paid teams. They answer `503` when the team's subscription becomes read-only.
- The policy **Server-side features (monitors, hosted mocks)** set to **blocked** makes our server refuse new hosted mocks and new versions, and every hosted mock already published answers `503` until it's allowed again. **Unpublish** still works.
- The console's **Hosted mocks\*** page lists each one's name, URL, version, requests this month against the limit, who published it and when, with **Unpublish**.
- Hosted mocks may not serve phishing, malware or personal data. We may take one down for abuse and tell the team's owner. To report abuse, email `abuse@subcloak.com` with the URL.

## What Subcloak sees

Everything in the published copy, how many requests each hosted mock gets, and the requests sent to it (their headers and bodies too), as they pass through Subcloak's servers. Those requests aren't kept. {/* PLAN 1.1 */}

## Related

  - [Mock sets](https://docs.subcloak.com/cloak-proxy/tools/mock-sets/): Build and record mock sets in Cloak Proxy.
  - [Monitors](https://docs.subcloak.com/cloak-proxy/team/monitors/): The other feature that runs on our servers.
  - [What Subcloak can and can't see](https://docs.subcloak.com/cloak-proxy/team/what-subcloak-can-see/): Everything our servers hold for a team.