Hosted mocks (on Subcloak's servers)

A hosted mock serves one of your team’s mock sets at a public address, from Subcloak’s servers. Use it when something can’t reach a Mac running Cloak Proxy: a teammate’s phone, a preview build, a partner’s test environment.

* Not end-to-end encrypted, and public

Hosted mocks run on Subcloak’s servers, which read them to serve them. Anyone who has the URL can call it. Don’t put real personal data, credentials or anything secret in a hosted mock.

Publish a mock set

1. Open a mock set under Team: Acme › Mocks and choose Host on Subcloak’s Servers*…. The sheet starts with the warning above.

2. Publish. Cloak Proxy sends a readable copy of the set’s routes to Subcloak’s servers. The team mock set itself stays end-to-end encrypted.

3. Copy the URL. It looks like https://mocks.subcloak.link/k3j9w2m4p8x1q6ra/: a 16-character random name that can’t be guessed. Every team’s hosted mocks share that one sandboxed address, which serves no web pages or scripts.

Publishing the same mock set again from the same Mac replaces it with a new version at the same URL. Publishing it from another Mac makes a new copy at a new URL; unpublish the old one in the console. Unpublish deletes the copy from our servers. The copy is encrypted at rest with Subcloak’s own key, which isn’t end-to-end encryption.

What a hosted mock can serve

Routes	Up to 500, matched by method and path. Paths can have parameters (/users/:id) and *
Each response	A status, headers and a body of up to 256 KB, served without a delay
Content types	JSON, plain text, CSV, and PNG, JPEG, GIF or WebP images. XML keeps its type but is always sent with Content-Disposition: attachment, so a browser downloads it instead of showing it. Anything else is served as text/plain with Content-Disposition: attachment
Headers	content-type, cache-control, x-* and CORS headers. set-cookie, Content-Security-Policy and redirects are refused
CORS	On by default

Every response also carries Content-Security-Policy: sandbox; default-src 'none', X-Content-Type-Options: nosniff, Referrer-Policy: no-referrer, X-Robots-Tag: noindex and X-Abuse: abuse@subcloak.com. So a hosted mock can’t serve a working web page or script.

Limits

Limit (per team)	Value
Hosted mock sets	10
Requests	10,000 a month for each seat
Rate	20 requests a second
Response size	256 KB
Routes per set	500

Over a limit, the mock answers 429 with a JSON body that names the limit.

Who can use it

• Hosted mocks are for active, paid teams. They answer 503 when the team’s subscription becomes read-only.
• The policy Server-side features (monitors, hosted mocks) set to blocked makes our server refuse new hosted mocks and new versions, and every hosted mock already published answers 503 until it’s allowed again. Unpublish still works.
• The console’s Hosted mocks* page lists each one’s name, URL, version, requests this month against the limit, who published it and when, with Unpublish.
• Hosted mocks may not serve phishing, malware or personal data. We may take one down for abuse and tell the team’s owner. To report abuse, email abuse@subcloak.com with the URL.

What Subcloak sees

Everything in the published copy, how many requests each hosted mock gets, and the requests sent to it (their headers and bodies too), as they pass through Subcloak’s servers. Those requests aren’t kept.

Related

Mock setsBuild and record mock sets in Cloak Proxy.

MonitorsThe other feature that runs on our servers.

What Subcloak can and can't seeEverything our servers hold for a team.