Anatomy of a rule
Each rule has five parts:- A target: what part of the request to inspect. Method, Path, Query, Header, Body (matched with a JSONPath expression), Cookie, or URL Param.
- A property: which key or path within the target to read, for example a header name, a query key, or a
$.json.pathinto the body. - An operator:
equals,contains,regex,>,<,in,exists, orjsonpath. - A value to compare against.
- An invert toggle to negate the match (NOT).

Body and header matching are on by default, so you can match against request body fields and header values out of the box without any extra setup. The Body target uses a dot-path existence check (for example, does
user.role exist), not full JSONPath filters.Add a rule
1
Open the response's Rules tab
In the response pane, select the response you want to gate, then open its Rules sub-tab.
2
Add and configure a condition
Add a rule, then set its target, property, operator, and value. Turn on invert if you want the rule to match when the condition is not met.
3
Combine multiple rules
If you added more than one rule, set the AND / OR toggle to decide whether all of them or any of them must pass.
4
Save and test
Click Save, make sure the mock is running, then call the endpoint with and without the matching condition to confirm the right response is served.
Worked examples
Each example below gates a response on a real condition and shows the served result.Require a header (exists + invert)
To return a403 only when the Authorization header is missing, add a 403 response with one rule: target Header, property authorization, operator exists, invert on. Mark the normal 200 response as default.
exists rule and returns 403; a present header falls through to the default 200.
Match on the request body (JSONPath)
To branch on the shape of a JSON body, use the Body target with thejsonpath operator. Here a POST /orders response is gated on $.user.role existing, with a 422 default:
Read a URL parameter (equals)
A URL Param rule reads a value captured by a:param in the path. Here GET /accounts/:id serves a special response only when id equals 42:
Combine rules with AND
With the combinator set to AND, every rule must pass. Here a response onGET /and requires both ?a=1 and ?b=2:
Combine rules with OR
With the combinator set to OR, any one rule passing is enough. Here a response onGET /or matches when either ?a=1 or ?b=2:


