Skip to main content
Requestly’s AI features work by sending part of your API data to an AI model so it can answer you. This page describes exactly what is sent, what is removed first, and what you should never put in front of them.

​
Which features use AI

Two features send data to Requestly’s AI service:
  • AI Assistant, the chat panel you open from the footer, from Debug with AI or Visualize with AI in the response panel, or with Cmd/Ctrl + Shift + A.
  • Test Authoring Agent, the Generate tests button in the Post-response script editor. See Generate API test cases using AI.
Both are available in cloud projects only. A local project never reaches the AI service. Everything else in Requestly runs without an AI model. Sending a request, running a collection, importing a file and evaluating your scripts involve no AI service at all.

​
What gets sent

When you use one of those two features, Requestly sends:
  • What you typed: your chat message or your test-generation instruction.
  • The API data the task needs: the request being discussed (URL, method, headers, query parameters, body, scripts) and, where the feature uses it, the response your last send returned.
  • What the assistant looks up. The assistant can list your project’s collections and requests by name, and reads the full contents of the ones it decides it needs. It does this without asking you first. Your whole project is not sent with each message.
That payload goes to Requestly’s AI service, which calls a third party AI model provider to produce the answer.

​
What is masked before it leaves

Requestly strips known credentials out of the payload on your machine, before anything is sent:
  • Authorization configuration. Every secret field of a request’s or collection’s auth setup, across all supported auth types, is replaced with a mask. An auth type Requestly does not recognise is masked in full rather than passed through.
  • Secret variables. Any variable you marked secret is masked, in environments and in collection or project scope alike.
  • Credential-shaped headers and body keys. Headers, form fields and JSON body keys whose names conventionally carry a credential, such as an Authorization header or an api_key field, are masked by name.

​
What is not masked, and what that means for you

Masking works on structure, not on meaning. A credential that sits in a place Requestly cannot recognise as a credential is sent as ordinary content. Examples:
  • A token pasted into the middle of a raw JSON body under a field name that reads like anything else.
  • Anything in the URL, including an api_key query parameter or a password. The URL is sent as you wrote it.
  • A body that is not JSON or a form, such as XML or plain text.
  • Your pre-request and post-response scripts, and anything you type into a chat message or test instruction.
  • Real customer names, emails or account numbers in a sample response you sent and then asked the assistant about.
So the rule to work by is: do not submit live credentials or personal data into test environments. Use test accounts, test keys and synthetic data in any request you intend to discuss with an AI feature. If a request holds production credentials or real customer data, do not point an AI feature at it.

​
Review what comes back

The assistant and the agent can be wrong, so check what they produce before you keep it:
  • The Test Authoring Agent shows generated scripts in a diff you accept, edit or discard. It never writes a script without that step.
  • The AI Assistant asks you to approve a change before it writes to your project. That is manual mode, which is where every app session starts.
The status line under the chat composer tells you which mode you are in. Click it, or press Shift + Tab in the chat panel, to switch. In auto mode the assistant applies changes and sends requests without asking you first, and each action is recorded in the transcript so you can see what it did. Deleting items from your project asks every time, whichever mode you are in. Auto mode lasts until you switch back or restart the app: starting a new chat does not reset it. Read what was produced before you accept it. An assertion that looks right can still test the wrong thing.

​
Turning AI features off

If your organization is managed through BrowserStack, an administrator controls AI features for everyone in it by turning Enable AI features on or off in the BrowserStack admin dashboard. Requestly’s own Settings page reports that state but cannot change it, which is why the switch there is greyed out. With AI features turned off, the AI Assistant and the Generate tests button do not appear, and no data reaches the AI service from any member’s machine. If your account is not linked to BrowserStack, AI features are on and Requestly shows no AI section in Settings: there is no organization policy to report, and no per-user setting to change.