Skip to main content
The Request Body Find & Replace action enables you to modify HTTP request body content by finding and replacing text patterns using regular expressions. This is useful for redacting sensitive information, transforming data formats, or modifying AI prompts before they reach upstream services.

​
Configuration reference

The Traffic Policy configuration reference for this action.

​
Supported phases

on_http_request

​
Type

request-body-find-replace

​
Configuration fields

​
replacements
array
Required
Array of replacement rules to apply to the request body. Rules are applied in order.Minimum 1 replacement required.
​
from
string
Required
Supports CEL
Regular expression pattern to match. Supports RE2 syntax. CEL interpolation is supported for dynamic patterns.
​
to
string
Supports CEL
Replacement string. Use $1, $2, etc. to reference capture groups from the pattern. CEL interpolation is supported for dynamic replacements. If omitted or empty, matched text is deleted.

​
Behavior

When this action executes, it buffers the entire request body, applies all replacement rules in order, and updates the Content-Length header if present.

​
Pattern matching

The from field accepts RE2 regular expressions. All matches in the body are replaced, not just the first occurrence.

​
Capture groups

You can use capture groups in your pattern and reference them in the replacement: 
replacements:
  - from: "api_key=([a-zA-Z0-9]+)"
    to: "api_key=REDACTED"

​
CEL expressions

Both from and to fields support CEL interpolation for dynamic values: 
replacements:
  - from: "${vars.pattern_to_match}"
    to: "replaced with ${req.headers['x-replacement-value']}"
When using CEL in the from field, the resulting string must be a valid regular expression.

​
Content-Length handling

After replacements are applied, the action automatically updates the Content-Length header to reflect the new body size.

​
Ordering

Replacement rules are applied in the order they are specified. Later rules operate on the result of earlier rules.

​
Examples

​
Redacting sensitive data from requests

The following configuration redacts API keys and email addresses from request bodies.

​
Example Traffic Policy document

on_http_request:
  - actions:
      - type: request-body-find-replace
        config:
          replacements:
            - from: '"api_key":\s*"[^"]*"'
              to: '"api_key": "[REDACTED]"'
            - from: "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}"
              to: "[EMAIL REDACTED]"

​
Example request

Before (original request body): 
{
  "api_key": "sk-abc123secret",
  "user_email": "[email protected]",
  "message": "Hello world"
}
After (modified request body): 
{
  "api_key": "[REDACTED]",
  "user_email": "[EMAIL REDACTED]",
  "message": "Hello world"
}

​
Modifying AI prompts

Add system instructions to AI model requests: 
on_http_request:
  - actions:
      - type: request-body-find-replace
        config:
          replacements:
            - from: '"role":\s*"system",\s*"content":\s*"([^"]*)"'
              to: '"role": "system", "content": "$1 Always respond in a professional tone."'

​
Removing unwanted content

Delete specific patterns by using an empty to value: 
on_http_request:
  - actions:
      - type: request-body-find-replace
        config:
          replacements:
            - from: "<!--.*?-->"
              to: ""

​
Action result variables

The following variables are made available for use in subsequent expressions and CEL interpolations after the action has run. Variable values will only apply to the last action execution, results are not concatenated.
​
actions.ngrok.request_body_find_replace.replacements
array
Array of objects describing which replacement rules matched.
​
replacement_index
integer
The zero-based index of the replacement rule that matched.
​
matched_content
string
The first matched content from this replacement rule.