> ## Documentation Index
> Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Request Body Find & Replace Action
> Find and replace text patterns in HTTP request bodies using regular expressions.
export const ConfigField = ({title, type, cel = false, defaultValue = false, required = false, children}) => {
const id = `config-${title.replace(/\.|\s|\*/g, "_")}`;
return
{title}
{type &&
{type}
}
{defaultValue &&
default:
{defaultValue}
}
{required &&
Required
}
{cel &&
Supports CEL
}
{children}
;
};
The Request Body Find & Replace action enables you to modify HTTP request body content
by finding and replacing text patterns using regular expressions. This is useful for
redacting sensitive information, transforming data formats, or modifying AI prompts
before they reach upstream services.
## Configuration reference
The [Traffic Policy](/traffic-policy/) configuration reference for this action.
### Supported phases
`on_http_request`
### Type
`request-body-find-replace`
### Configuration fields
Array of replacement rules to apply to the request body. Rules are applied in order.
Minimum `1` replacement required.
Regular expression pattern to match. Supports [RE2 syntax](https://github.com/google/re2/wiki/Syntax).
CEL interpolation is supported for dynamic patterns.
Replacement string. Use `$1`, `$2`, etc. to reference capture groups from the pattern.
CEL interpolation is supported for dynamic replacements.
If omitted or empty, matched text is deleted.
## Behavior
When this action executes, it buffers the entire request body, applies all replacement
rules in order, and updates the `Content-Length` header if present.
### Pattern matching
The `from` field accepts [RE2 regular expressions](https://github.com/google/re2/wiki/Syntax).
All matches in the body are replaced, not just the first occurrence.
### Capture groups
You can use capture groups in your pattern and reference them in the replacement:
```yaml theme={null}
replacements:
- from: "api_key=([a-zA-Z0-9]+)"
to: "api_key=REDACTED"
```
### CEL expressions
Both `from` and `to` fields support CEL interpolation for dynamic values:
```yaml theme={null}
replacements:
- from: "${vars.pattern_to_match}"
to: "replaced with ${req.headers['x-replacement-value']}"
```
When using CEL in the `from` field, the resulting string must be a valid regular expression.
### Content-Length handling
After replacements are applied, the action automatically updates the `Content-Length`
header to reflect the new body size.
### Ordering
Replacement rules are applied in the order they are specified. Later rules operate
on the result of earlier rules.
### Non-terminating action
This is a **Non-terminating action**. It does not return a response, and will allow Traffic Policy processing to continue to the next Action in the chain. All **Cloud Endpoint** Traffic Policies must end with a terminating action. This requirement does not apply to **Agent Endpoints**.
## Examples
### Redacting sensitive data from requests
The following configuration redacts API keys and email addresses from request bodies.
#### Example Traffic Policy document
```yaml policy.yml theme={null}
on_http_request:
- actions:
- type: request-body-find-replace
config:
replacements:
- from: '"api_key":\s*"[^"]*"'
to: '"api_key": "[REDACTED]"'
- from: "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}"
to: "[EMAIL REDACTED]"
```
```json policy.json theme={null}
{
"on_http_request": [
{
"actions": [
{
"type": "request-body-find-replace",
"config": {
"replacements": [
{
"from": "\"api_key\":\\s*\"[^\"]*\"",
"to": "\"api_key\": \"[REDACTED]\""
},
{
"from": "[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}",
"to": "[EMAIL REDACTED]"
}
]
}
}
]
}
]
}
```
#### Example request
Before (original request body):
```json theme={null}
{
"api_key": "sk-abc123secret",
"user_email": "john.doe@example.com",
"message": "Hello world"
}
```
After (modified request body):
```json theme={null}
{
"api_key": "[REDACTED]",
"user_email": "[EMAIL REDACTED]",
"message": "Hello world"
}
```
### Modifying AI prompts
Add system instructions to AI model requests:
```yaml policy.yml theme={null}
on_http_request:
- actions:
- type: request-body-find-replace
config:
replacements:
- from: '"role":\s*"system",\s*"content":\s*"([^"]*)"'
to: '"role": "system", "content": "$1 Always respond in a professional tone."'
```
```json policy.json theme={null}
{
"on_http_request": [
{
"actions": [
{
"type": "request-body-find-replace",
"config": {
"replacements": [
{
"from": "\"role\":\\s*\"system\",\\s*\"content\":\\s*\"([^\"]*)\"",
"to": "\"role\": \"system\", \"content\": \"$1 Always respond in a professional tone.\""
}
]
}
}
]
}
]
}
```
### Removing unwanted content
Delete specific patterns by using an empty `to` value:
```yaml policy.yml theme={null}
on_http_request:
- actions:
- type: request-body-find-replace
config:
replacements:
- from: ""
to: ""
```
```json policy.json theme={null}
{
"on_http_request": [
{
"actions": [
{
"type": "request-body-find-replace",
"config": {
"replacements": [
{
"from": "",
"to": ""
}
]
}
}
]
}
]
}
```
## Action result variables
The following variables are made available for use in subsequent expressions and
CEL interpolations after the action has run. Variable values will only apply
to the last action execution, results are not concatenated.
Array of objects describing which replacement rules matched.
The zero-based index of the replacement rule that matched.
The first matched content from this replacement rule.
## Related actions
* [Response Body Find & Replace](/traffic-policy/actions/response-body-find-replace) - Modify response bodies
* [SSE Find & Replace](/traffic-policy/actions/sse-find-replace) - Modify Server-Sent Events streams