Search

Search queries captured HTTP traffic in the current project, including records beyond the currently loaded HTTP History rows.

Opening Search

Click Search in the left navigation. Enter structured criteria and/or an HTTPQL expression, then click Search or press Enter. Typing changes the criteria without executing a new search. Use pagination to inspect additional results.

HTTPQL Syntax

HTTPQL is a structured query language for HTTP traffic. It matches against request and response fields using typed operators.

Fields

Field	Matches
req.host	Request hostname.
req.path	Request path.
req.method	HTTP method (GET, POST, etc.).
req.body	Request body content.
resp.code	Response status code (integer).
resp.len	Response body length in bytes (integer).
resp.body	Response body content.
resp.header["Name"].value	Value of the named response header.
req.header["Name"].value	Value of the named request header.
req.has_finding	True when the request has at least one finding attached.
req.tag	Tag string applied to the request.

Operators

Operator	Applies to	Meaning
eq	string, integer	Exact match.
ne	string, integer	Not equal.
cont	string	Contains substring.
ncont	string	Does not contain substring.
regex	string	Matches regular expression.
gt	integer	Greater than.
gte	integer	Greater than or equal.
lt	integer	Less than.
lte	integer	Less than or equal.
exists	headers	Header is present.

Combining Expressions

Use AND and OR to combine conditions. Parentheses control precedence. Use negative operators such as ne or ncont to exclude matches.

(req.method.eq:POST OR req.method.eq:PUT) AND resp.code.gte:500

Example Queries

Find POST requests that returned a 500-range error:

req.method.eq:POST AND resp.code.gte:500

Find requests with an Authorization header:

req.header["Authorization"].value.exists

Find large responses from a specific host:

req.host.eq:api.example.com AND resp.len.gt:100000

Find requests tagged for follow-up:

req.tag.eq:followup

Find all requests that have a finding attached:

req.has_finding.eq:true

Find requests where the response body contains a known error string:

resp.body.cont:"stack trace"

Saved Searches

Use Pin beside the HTTPQL input to retain a frequently used query for quick reuse. Select a pinned query to apply it; remove its chip when it is no longer needed. Query history also helps reuse recent expressions.

Search tabs let you compare independent queries during the current visit. They are not persistent saved searches. For named structured presets that can be exported and imported, use the Filters page.

Inspecting Results

Click any row in the results table to open the request and response in the inspector panel. The inspector is the same view used in HTTP History: you can switch between raw and pretty views, copy headers or body, and add findings directly from this panel.

AI Assist

When an AI provider is configured, click AI next to the query input to describe what you want to find in plain language. Ogma generates the HTTPQL expression. Review the query before running it.

• "POST requests returning server errors" > req.method.eq:POST AND resp.code.gte:500
• "Responses larger than 50 KB from the API subdomain" > req.host.cont:api AND resp.len.gt:51200
• "Requests that have findings attached" > req.has_finding.eq:true

Related Pages

• HTTPQL and StreamQL
• HTTP History
• Filters