HTTPQL and StreamQL

Ogma uses a Caido-compatible query language subset for filtering HTTP history, WebSocket traffic, Automate results, and related views.

Syntax

Queries are composed of clauses joined by AND and OR.

req.host:example.com AND resp.code:200

Parentheses group expressions:

(req.path.cont:"/api/" OR req.path.cont:"/graphql") AND resp.code.gte:400

Comments are supported:

// API errors
req.path.cont:"/api/" AND resp.code.gte:500

/* focus on login */
req.path.cont:"login"

Operators

Operator	Meaning
:	Equals or default match, depending on field type
.eq:	Equals
.ne:	Not equals
.cont:	Contains, case-insensitive
.ncont:	Does not contain, case-insensitive
.cs.cont:	Contains, case-sensitive
.cs.ncont:	Does not contain, case-sensitive
.like:	SQL-like pattern match
.nlike:	Negative SQL-like pattern match
.regex:	Regular expression match
.nregex:	Negative regular expression match
.lt:	Less than
.lte:	Less than or equal
.gt:	Greater than
.gte:	Greater than or equal
.exists	Header exists; use req.header["Name"].value.exists or its response equivalent

HTTP Examples

Find API traffic:

req.path.cont:"/api/"

Find server errors:

resp.code.gte:500

Find large responses:

resp.len.gt:100000

Find JSON responses:

resp.header["content-type"].value.cont:"application/json"

Find requests with cookies:

req.header["cookie"].value.exists

Find traffic modified by Intercept or Match & Replace:

req.modified.eq:true

Find likely admin paths:

req.path.cont:"/admin" OR req.path.cont:"/manage"

Find replay or automate traffic:

source:replay OR source:automate

Stream Examples

StreamQL applies the same query style to WebSocket and stream views.

Find WebSocket messages containing a token field:

ws.raw.cont:"token"

Find server-to-client messages:

ws.direction.eq:"To Client"

Find JSON-like messages:

ws.raw.cont:"{" AND ws.raw.cont:"}"

Practical Saved Filters

Name	Query
API errors	req.path.cont:"/api/" AND resp.code.gte:400
Auth endpoints	req.path.cont:"login" OR req.path.cont:"oauth" OR req.path.cont:"session"
JSON traffic	resp.header["content-type"].value.cont:"json"
Interesting methods	req.method:POST OR req.method:PUT OR req.method:PATCH OR req.method:DELETE
Potential secrets	resp.body.cont:"api_key" OR resp.body.cont:"secret" OR resp.body.cont:"token"

Limits

To keep filters predictable, Ogma limits query complexity:

• Maximum nested expression depth: 16.
• Maximum clause count: 64.

If a query becomes too complex, split it into saved filters or use Search for broader investigation.