Allow List

The Allow List keeps the traffic list focused. While it’s on, Cloak Proxy records only requests that match one of its rules. Everything else still goes through the proxy and still works; it just isn’t shown or kept. Use it when you capture the whole Mac but only care about one API.

Record only one API

1. Right-click a request from the host you care about and choose Tools › Allow List….

   Cloak Proxy creates a rule named after the host that matches every request to it (for example https://api.example.com/ with subpaths on) and opens it.

2. Add more rules for other hosts or paths you want to see.

3. Turn the Allow List on with the On/Off switch in its header. Creating a rule doesn’t turn it on.

4. New requests that don’t match any rule no longer appear in the traffic list.

123

An Allow List rule created from a request. The tool stays off until you switch it on.

1. Off by default. Switch it on to start filtering.
2. A rule for one host.
3. What to keep: here, every request to api.example.com.

×

How the Allow List decides

Situation	Result
The Allow List is off	Every request is recorded.
The Allow List is on but has no enabled rules	Every request is recorded.
The Allow List is on and a request matches any enabled rule	The request is recorded.
The Allow List is on and a request matches no enabled rule	The request is proxied as usual but not recorded.

Rules have only a name and a matcher; there are no other settings. Order doesn’t matter. The decision is made from the URL the app sent, before any other tool runs.

What isn’t recorded

A request the Allow List skips:

• Doesn’t appear in the traffic list, the sidebar or Insights.
• Isn’t saved in sessions or exports.
• Doesn’t trigger Alerts, because alerts check recorded requests.

Every other tool still applies to it. A Map Local, Block List or Network Conditions rule changes the request even though you can’t see it.

Hidden traffic can't be brought back

The Allow List decides at capture time. Requests it skips are never stored, so you can’t show them later by turning it off. To hide requests only from view, use filters instead: they hide rows but keep everything recorded.

What the Allow List covers

• HTTP requests and WebSocket connections are checked against the rules.
• Encrypted tunnels Cloak Proxy doesn’t decrypt still appear in the list.
• Requests you send with Repeat or Compose are always recorded.

Tip

If the traffic list looks empty, check the status bar for an Allow List chip. A forgotten Allow List looks a lot like a capture problem.

Related

FilteringHide requests from view without losing them.

Block ListStop requests instead of hiding them.

Recording and sessionsPause recording and clear the session.

Rules and matchingWildcards, regex and subpaths.