> ## Documentation Index
> Fetch the complete documentation index at: https://ngrok.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.
# Response Body Find & Replace Action
> Find and replace text patterns in HTTP response bodies using regular expressions.
export const ConfigField = ({title, type, cel = false, defaultValue = false, required = false, children}) => {
const id = `config-${title.replace(/\.|\s|\*/g, "_")}`;
return
{title}
{type &&
{type}
}
{defaultValue &&
default:
{defaultValue}
}
{required &&
Required
}
{cel &&
Supports CEL
}
{children}
;
};
The Response Body Find & Replace action enables you to modify HTTP response body content
by finding and replacing text patterns using regular expressions. This is useful for
redacting sensitive information in responses, transforming data formats, or modifying
AI model outputs before they reach clients.
## Configuration reference
The [Traffic Policy](/traffic-policy/) configuration reference for this action.
### Supported phases
`on_http_response`
### Type
`response-body-find-replace`
### Configuration fields
Array of replacement rules to apply to the response body. Rules are applied in order.
Minimum `1` replacement required.
Regular expression pattern to match. Supports [RE2 syntax](https://github.com/google/re2/wiki/Syntax).
CEL interpolation is supported for dynamic patterns.
Replacement string. Use `$1`, `$2`, etc. to reference capture groups from the pattern.
CEL interpolation is supported for dynamic replacements.
If omitted or empty, matched text is deleted.
## Behavior
When this action executes, it buffers the entire response body, applies all replacement
rules in order, and updates the `Content-Length` header if present.
### Pattern matching
The `from` field accepts [RE2 regular expressions](https://github.com/google/re2/wiki/Syntax).
All matches in the body are replaced, not just the first occurrence.
### Capture groups
You can use capture groups in your pattern and reference them in the replacement:
```yaml theme={null}
replacements:
- from: "error_code: ([0-9]+)"
to: "error_code: HIDDEN"
```
### CEL expressions
Both `from` and `to` fields support CEL interpolation for dynamic values:
```yaml theme={null}
replacements:
- from: "${vars.sensitive_pattern}"
to: "[REDACTED by ${req.headers['x-request-id']}]"
```
When using CEL in the `from` field, the resulting string must be a valid regular expression.
### Content-Length handling
After replacements are applied, the action automatically updates the `Content-Length`
header to reflect the new body size.
### Ordering
Replacement rules are applied in the order they are specified. Later rules operate
on the result of earlier rules.
### Non-terminating action
This is a **Non-terminating action**. It does not return a response, and will allow Traffic Policy processing to continue to the next Action in the chain. All **Cloud Endpoint** Traffic Policies must end with a terminating action. This requirement does not apply to **Agent Endpoints**.
## Examples
### Redacting sensitive data from AI responses
The following configuration redacts personal information from AI model responses.
#### Example Traffic Policy document
```yaml policy.yml theme={null}
on_http_response:
- actions:
- type: response-body-find-replace
config:
replacements:
# Redact SSN patterns
- from: "\\b\\d{3}-\\d{2}-\\d{4}\\b"
to: "[SSN REDACTED]"
# Redact credit card numbers
- from: "\\b\\d{4}[- ]?\\d{4}[- ]?\\d{4}[- ]?\\d{4}\\b"
to: "[CARD REDACTED]"
# Redact phone numbers
- from: "\\b\\d{3}[-.\\s]?\\d{3}[-.\\s]?\\d{4}\\b"
to: "[PHONE REDACTED]"
```
```json policy.json theme={null}
{
"on_http_response": [
{
"actions": [
{
"type": "response-body-find-replace",
"config": {
"replacements": [
{
"from": "\\b\\d{3}-\\d{2}-\\d{4}\\b",
"to": "[SSN REDACTED]"
},
{
"from": "\\b\\d{4}[- ]?\\d{4}[- ]?\\d{4}[- ]?\\d{4}\\b",
"to": "[CARD REDACTED]"
},
{
"from": "\\b\\d{3}[-.\\s]?\\d{3}[-.\\s]?\\d{4}\\b",
"to": "[PHONE REDACTED]"
}
]
}
}
]
}
]
}
```
#### Example response
Before (original response body):
```text theme={null}
Here's the customer information:
- SSN: 123-45-6789
- Credit Card: 4111-1111-1111-1111
- Phone: 555-123-4567
```
After (modified response body):
```text theme={null}
Here's the customer information:
- SSN: [SSN REDACTED]
- Credit Card: [CARD REDACTED]
- Phone: [PHONE REDACTED]
```
### Adding disclaimers to AI responses
Append legal disclaimers or warnings to AI-generated content:
```yaml policy.yml theme={null}
on_http_response:
- expressions:
- "res.headers['content-type'].contains('application/json')"
actions:
- type: response-body-find-replace
config:
replacements:
- from: '"content":\s*"([^"]*)"(\s*})'
to: '"content": "$1\n\n---\nDisclaimer: This response was generated by AI and may contain errors."$2'
```
```json policy.json theme={null}
{
"on_http_response": [
{
"expressions": [
"res.headers['content-type'].contains('application/json')"
],
"actions": [
{
"type": "response-body-find-replace",
"config": {
"replacements": [
{
"from": "\"content\":\\s*\"([^\"]*)\"(\\s*})",
"to": "\"content\": \"$1\\n\\n---\\nDisclaimer: This response was generated by AI and may contain errors.\"$2"
}
]
}
}
]
}
]
}
```
### Sanitizing error messages
Remove internal error details from responses before sending to clients:
```yaml policy.yml theme={null}
on_http_response:
- expressions:
- "res.status_code >= 500"
actions:
- type: response-body-find-replace
config:
replacements:
- from: '"stack_trace":\s*"[^"]*"'
to: '"stack_trace": "[HIDDEN]"'
- from: '"internal_error":\s*"[^"]*"'
to: '"internal_error": "[HIDDEN]"'
```
```json policy.json theme={null}
{
"on_http_response": [
{
"expressions": [
"res.status_code >= 500"
],
"actions": [
{
"type": "response-body-find-replace",
"config": {
"replacements": [
{
"from": "\"stack_trace\":\\s*\"[^\"]*\"",
"to": "\"stack_trace\": \"[HIDDEN]\""
},
{
"from": "\"internal_error\":\\s*\"[^\"]*\"",
"to": "\"internal_error\": \"[HIDDEN]\""
}
]
}
}
]
}
]
}
```
## Action result variables
The following variables are made available for use in subsequent expressions and
CEL interpolations after the action has run. Variable values will only apply
to the last action execution, results are not concatenated.
Array of objects describing which replacement rules matched.
The zero-based index of the replacement rule that matched.
The first matched content from this replacement rule.
## Related actions
* [Request Body Find & Replace](/traffic-policy/actions/request-body-find-replace) - Modify request bodies
* [SSE Find & Replace](/traffic-policy/actions/sse-find-replace) - Modify Server-Sent Events streams