rq.request (Request object)

The rq.request object provides access to all details of the API request in your Requestly scripts. Read these properties in both pre-request and post-response scripts. In a pre-request script you can also modify the request that is sent: headers, query parameters, the URL, the method, and the body are all writable. In a post-response script the request has already been sent, so writes have no effect on the wire. In the desktop app, the request’s auth is writable too; see Auth.

What each script sees

Scripts see the request the way Postman’s scripts see it:

Script	The request it sees
Pre-request	The saved request, with the edits of every earlier pre-request script applied (the collection’s script, then each folder’s, then the request’s own). Variables such as `{{host}}` are not resolved yet, and the headers the auth tab adds, the cookie jar’s cookies and the headers Requestly generates are not on it yet.
Post-response	The request as it was sent: variables resolved, auth headers and cookies included, plus the edits of earlier post-response scripts.

When the request is sent:

Variables in values your script set are resolved, including dynamic variables such as {{$guid}}, the same as values you typed in the editor. A {{vault:...}} reference your script writes is resolved only when Allow scripts to access vault secrets is on; otherwise it is sent as written and the script console shows a warning.
The auth tab is applied after your scripts. A header or query parameter it adds replaces every header or query parameter with the same name, including one your script set. Header names are matched ignoring case; query parameter names are matched exactly. Auth that adds nothing, such as a bearer token left empty, leaves your header alone. To send an Authorization header from your script, set the request’s auth to No Auth.
Cookies are merged. If the request has its own Cookie header, saved or set by your script, its cookies come first and the cookie jar’s cookies for the URL follow in the same header.
Disabled headers and query parameters are never sent. If you upsert a header with the name of a header turned off in the editor, its value changes and it stays off.

Properties and Methods

`rq.request.method`

The HTTP method of the request (e.g. GET, POST, PUT, OPTIONS, DELETE, PATCH, HEAD). Writable from a pre-request script: the value is uppercased on write (rq.request.method = 'post' sends POST), and it must be one of the methods above. Anything else is dropped with a console warning instead of being sent. Example:

console.log("Request Method: ", rq.request.method);

`rq.request.headers`

An object that holds the request headers. Read them with rq.request.headers.get(name), rq.request.headers.has(name), or rq.request.headers.all(), which returns a plain { name: value } object of the enabled headers. Use .all() when you want to serialize the headers. Example:

console.log("Headers: ", JSON.stringify(rq.request.headers.all()));

You can also modify request headers from a pre-request script. The methods below change the headers that are sent with the request. Use them in pre-request scripts; in post-response scripts the request has already been sent, so header changes have no effect. Header changes apply to HTTP and GraphQL requests.

`rq.request.headers.add(header)`

Adds a header. If a header with the same name already exists, this adds a second one (it does not replace the existing header). Parameters:

header (object or string): { key, value }, or a raw "Key: value" string (parsed at the first :, both sides trimmed). These are the same inputs Postman’s Header accepts. A header added with disabled: true is readable on the request but is not sent.

Example:

rq.request.headers.add({ key: "X-Trace-Id", value: "abc-123" });
rq.request.headers.add("X-Trace-Id: abc-123"); // same effect

`rq.request.headers.upsert(header)`

Adds a header, or replaces it if a header with the same name already exists. Header names are matched case-insensitively. If the existing header is turned off in the editor, its value changes and it stays off, so it is not sent. Parameters:

header (object): { key, value } - the header name and value.

Example:

rq.request.headers.upsert({ key: "Authorization", value: "Bearer " + rq.environment.get("authToken") });

`rq.request.headers.remove(name)`

Removes every header with the given name (case-insensitive). Parameters:

name (string): The header name to remove.

Example:

rq.request.headers.remove("X-Debug");

`rq.request.headers.clear()`

Removes all request headers. Parameters: none. Any argument passed is ignored. clear() always removes every header, so to remove a single header use remove(name) instead. Example:

rq.request.headers.clear();

The same operations are available directly on rq.request, with Postman’s exact signatures, including Postman’s case-sensitivity split, which differs from the headers.* methods above:

rq.request.addHeader(header) - same inputs as headers.add (object or "Key: value" string).
rq.request.removeHeader(toRemove, options?) - a header name string or a { key } object. Matches case-sensitively by default; pass { ignoreCase: true } for a case-insensitive match. (headers.remove(name) is always case-insensitive.)
rq.request.upsertHeader(header) - requires a truthy key (returns silently otherwise) and matches case-sensitively: a differently-cased key adds a second header instead of replacing. (headers.upsert matches case-insensitively.)

`rq.request.body`

The request body, as Postman’s RequestBody object: { mode, raw, urlencoded, formdata, graphql, options, disabled }. It is undefined when the request has no body. It still reads as a string wherever JavaScript coerces: `${rq.request.body}`, String(rq.request.body), and JSON.parse(rq.request.body) all see the raw text. But it is an object, so string methods need rq.request.body.toString() first (the same one-line edit rq.request.url needed). Writable from a pre-request script. Whatever your script writes is sent as written, except that variables in it ({{name}}) are resolved when the request is sent, as they are in Postman. If you sign the body, resolve any variables in your script first, so the signature covers the bytes that are sent:

// Replace the whole body with a raw string:
rq.request.body.update('{"signed": true}');

// Or plain assignment, same effect:
rq.request.body = '{"signed": true}';

// Select the content type via Postman's options.raw.language
// (an explicit Content-Type header row always wins over it):
rq.request.body.update({ mode: 'raw', raw: '{"a":1}', options: { raw: { language: 'json' } } });

// Other modes: urlencoded, formdata (text fields), graphql:
rq.request.body.update({ mode: 'urlencoded', urlencoded: 'a=1&b=2' });

// Send without a body:
rq.request.body = null;

mode: 'file' is not supported: a script cannot choose local files to upload; the call is refused with a console warning and the body is left unchanged. On a body-less request rq.request.body is undefined, but assignment still works and creates the body. Example (reading):

console.log("Body:", rq.request.body.toString());

`rq.request.url`

The request URL as a Url object, the same shape as Postman’s pm.request.url. It converts to a string wherever one is expected ("Sending to " + rq.request.url, `${rq.request.url}`, new URL(String(rq.request.url))), and exposes the URL’s parts:

Property / method	Value for `https://api.example.com:8443/v1/users/42?page=2&tag=a#top`
`protocol`	`"https"`
`host`	`["api", "example", "com"]`
`port`	`"8443"`
`path`	`["v1", "users", "42"]`
`hash`	`"top"`
`query`	a list of query parameters — see below
`variables`	the request’s path variables (`variables.get("id")`)
`getHost()`	`"api.example.com"`
`getPath()`	`"/v1/users/42"`
`getQueryString()`	`"page=2&tag=a"`
`getPathWithQuery()`	`"/v1/users/42?page=2&tag=a"`
`getRemote()`	`"api.example.com:8443"`
`toString()`	the full URL

Example:

if (rq.request.url.path.includes("healthz") || rq.request.url.host.includes("localhost")) {
    console.log("Skipping auth for", rq.request.url.toString());
}

rq.request.url.query is a list of query parameters with the same API as Postman’s:

Read: get(name), has(name), one(name), count(), idx(i), indexOf(...), all(), each(fn), map(fn), filter(fn), find(fn), reduce(fn, initial), toString(). toObject() returns { name: value }; a repeated name becomes an array of values.
Change: add(param), insert(param, before), insertAfter(param, after), prepend(param), append(param), upsert(param), remove(name | fn), clear(), populate(list), repopulate(list), assimilate(list, prune). A param is { key, value } or a "key=value" string. rq.request.url.addQueryParams(...) and removeQueryParams(...) do the same in bulk.

rq.request.url.variables is the list of the request’s path variables (:id in the URL) with the same list API, plus replace("{{id}}"), substitute(object), syncFromObject(object), syncToObject(). You can also edit the URL parts directly: rq.request.url.path.push("v2"), rq.request.url.host = ["api", "example", "com"], rq.request.url.port = "8443", or rq.request.url.update("https://...") to replace the whole URL. In a pre-request script every one of these changes applies to the request that is sent, as in Postman. In a post-response script the request has already been sent.

rq.request.url.query.add({ key: "trace-id", value: rq.$guid() });
rq.request.url.path.push("v2");
console.log(rq.request.url.toString());

JSON.stringify(rq.request.url) returns the URL’s parts, the same shape Postman uses: { protocol, host: [...], port, path: [...], hash, query: [{ key, value }], variable: [...] }. Use rq.request.url.toString() when you want the URL as a string.

rq.request.url is an object, not a string, exactly as in Postman. typeof rq.request.url is "object", a strict comparison such as rq.request.url === "https://..." is false, and string methods like .split() or .includes() are not available on it. Call rq.request.url.toString() first: rq.request.url.toString().split("?"), rq.expect(rq.request.url.toString()).to.equal(...). Scripts written before this change that called a string method directly on rq.request.url need that one edit.

`rq.request.queryParams`

A read-only object mapping each query parameter name to its value ({ name: value }). Iterate it with Object.entries(). This is a Requestly addition; Postman’s request has no queryParams. Example:

console.log("Query Params:", JSON.stringify(rq.request.queryParams));

Postman request members

rq.request also has the rest of the members of Postman’s pm.request, with the same arguments, return values and behaviour. A pm.request script that uses them runs unchanged after the move to rq.

These members of rq.request require the desktop app. The web app and the CLI’s Safe mode run scripts on an engine that does not have them.

Identity

Member	Value
`rq.request.id`	The request’s id.
`rq.request.name`	The request’s name.
`rq.request.description`	The request’s description: `content` (the Markdown you wrote), `type` (`"text/markdown"`), `update(content, type)`, `toString()`, `toJSON()`. `undefined` when the request has no description.

console.log("Running", rq.request.name, rq.request.id);
if (rq.request.description) {
  console.log(rq.request.description.content);
}

Headers as a list

rq.request.headers is Postman’s HeaderList. Besides the methods above, it has:

Read: one(name) (the last header with that name; get(name) returns the first), count(), idx(i), indexOf(...), each(fn), map(fn), filter(fn), find(fn), reduce(fn, initial), toObject(excludeDisabled, caseSensitive, multiValue, sanitizeKeys), toString(), toJSON(), contentSize(). has(name, value) also checks the value.
Change: insert(header, before), insertAfter(header, after), prepend(header), append(header), populate(list), repopulate(list), assimilate(list, prune). remove() also takes a predicate or a header object, and removes only the headers it matches.

Each header is an object with key, value, disabled, update({ key, value, disabled }), toString() ("Key: value") and toJSON(). In a pre-request script, a change you make through a header object is sent, the same as one made through the list:

const accept = rq.request.headers.one("Accept");
if (accept) {
  accept.value = "application/json";
}

On rq.request itself:

getHeaders({ ignoreCase, enabled, multiValue, sanitizeKeys }) returns the headers as an object. A repeated name becomes an array of values. ignoreCase: true lower-cases the names; enabled: true leaves out disabled headers.
forEachHeader(callback) calls callback(header, request) for every header, disabled ones included.

A header you place with insert, prepend or insertAfter is in that position in the list your script reads, but it is sent after the request’s other headers.

Disabled headers and query parameters

Headers and query parameters you turned off in the editor are on the list your script reads, with disabled: true. They are not sent unless your script turns them on:

const debug = rq.request.headers.one("X-Debug");
if (debug) {
  debug.disabled = false; // now it is sent
}

headers.toObject() and count() include disabled headers; toObject(true) leaves them out. headers.all() lists only the enabled headers.
url.toString() and url.getQueryString() leave out disabled query parameters.
A post-response script sees the disabled headers, and only the query parameters that were sent.

In a pre-request script, a change you make through a query parameter or a path variable object is sent too, for example rq.request.url.variables.one("id").value = "7".

Auth

rq.request.auth is Postman’s RequestAuth: the request’s auth, which your script can read and change.

Script	`rq.request.auth`
Pre-request	The request’s own auth, with earlier scripts’ changes applied. Variables are not resolved. `undefined` when the request inherits its auth; `{ type: "noauth" }` when it is set to No Auth.
Post-response	The auth the request was sent with, its own or the one it inherited, with variables resolved.

Members: type (bearer, basic, apikey, oauth1, oauth2, jwt, digest, hawk, awsv4, ntlm or noauth), one parameter list per type (rq.request.auth.bearer), parameters() (the list for the type in use), use(type, options), update(options, type), clear(type) and toJSON(). rq.request.authorizeUsing(type, options) replaces the auth. options is a { key: value } object or a list of { key, value }. authorizeUsing(null) makes the request inherit its auth.

// Read the token the request is set to send
if (rq.request.auth && rq.request.auth.type === "bearer") {
  console.log(rq.request.auth.parameters().get("token"));
}

// Send a different bearer token
rq.request.authorizeUsing("bearer", { token: rq.environment.get("authToken") });

In a pre-request script every change to the auth is sent, whether you make it with authorizeUsing(), the auth object’s methods, or a parameter object (rq.request.auth.parameters().one("token").value = "..."). Settings that Postman’s auth format has no field for, such as an AWS profile name, are kept when you change the auth’s parameters without changing its type. Assigning rq.request.auth = ... changes nothing; use authorizeUsing(). How the auth your script sets is sent:

OAuth 2.0 sends the token in accessToken (authorizeUsing("oauth2", { accessToken: "..." })). No new token is fetched.
JWT Bearer is signed from the key and claims your script gives it.
AWS Signature is signed with the access keys your script gives it. No AWS profile is read.
When one of these is missing its token or keys, the request is sent without it and the script console shows a warning.
edgegrid, asap and types Requestly does not know make the request inherit its auth, with a console warning naming the type.

Proxy and certificate

In a post-response script, rq.request.proxy and rq.request.certificate describe how the request was sent. They are filled only when it was sent through a proxy or with a client certificate. In a pre-request script both are undefined.

rq.request.proxy is Postman’s ProxyConfig: host, port, protocol, username, password, authenticate, tunnel, match, bypass, id, test(url), getProxyUrl(), getProtocols(), update(), updateProtocols() and toJSON(). It shows a custom proxy, or the proxy your system settings named. A proxy chosen through environment variables is not shown.
rq.request.certificate is Postman’s Certificate: name (the host the certificate is set for in App Settings), matches, cert.src, key.src and pfx.src (file paths), passphrase (when the certificate has one), id, canApplyTo(url), update() and toJSON(). The contents of the certificate files are never shown.

As in Postman, a post-response script can read the proxy’s password and the certificate’s passphrase. Changes your script makes to either object stay in that script and are never sent.

// Post-response script
if (rq.request.proxy) {
  console.log("Sent through", rq.request.proxy.host + ":" + rq.request.proxy.port);
}
if (rq.request.certificate) {
  console.log("Client certificate for", rq.request.certificate.name);
}

Whole-request methods

Method	What it does
`clone()`	A detached copy of the request. Changing the copy changes nothing that is sent.
`update(definition)`	Sets `url`, `method`, `header` (replaces every header), `body`, `auth`, `proxy` and `certificate` from a Postman request definition. Only the keys you pass change.
`addQueryParams(params)`, `removeQueryParams(params)`	The same as `rq.request.url.addQueryParams()` and `removeQueryParams()`.
`size()`	`{ body, header, total, source }` in bytes, computed as Postman computes it.
`toJSON()`	Postman’s keys (`id`, `name`, `description`, `url`, `header`, `method`, `body`, `auth`, `proxy`, `certificate`), plus Requestly’s `headers` (a `{ name: value }` object of the enabled headers) and `queryParams`.

rq.request.update({
  method: "POST",
  header: [{ key: "Content-Type", value: "application/json" }],
  body: { mode: "raw", raw: '{"a":1}' },
});
console.log(rq.request.size().total);

Assertions

rq.request.to holds Postman’s request assertions, for use inside rq.test():

rq.test("Request carries a JSON content type", () => {
  rq.request.to.have.header("Content-Type", "application/json");
  rq.request.to.not.have.header("X-Debug");
});

to.have.header(name) matches the name case-insensitively. With a value, it compares the last header of that name exactly.

Common Use Cases

Logging Request Details

console.log("Making " + rq.request.method + " request to " + rq.request.url);
console.log("Request headers:", JSON.stringify(rq.request.headers.all()));
console.log("Request body:", JSON.stringify(rq.request.body));

Conditional Logic Based on Request Method

if (rq.request.method === "POST" || rq.request.method === "PUT") {
    console.log("Sending data:", rq.request.body);
}

Accessing Query Parameters

Object.entries(rq.request.queryParams).forEach(([key, value]) => {
    console.log(`Query param ${key}: ${value}`);
});

Adding an Authentication Header

// In a pre-request script
const token = rq.environment.get("authToken");
if (token) {
    rq.request.headers.upsert({ key: "Authorization", value: "Bearer " + token });
}

If the request’s auth tab adds an Authorization header, it replaces this one. Set the request’s auth to No Auth to send the header your script sets.

Getting Started

API Design

Mock Server

Collaboration & Projects

Account & Administration

rq.request (Request object)

What each script sees

Properties and Methods

`rq.request.method`

`rq.request.headers`

`rq.request.headers.add(header)`

`rq.request.headers.upsert(header)`

`rq.request.headers.remove(name)`

`rq.request.headers.clear()`

`rq.request.body`

`rq.request.url`

`rq.request.queryParams`

Postman request members

Identity

Headers as a list

Disabled headers and query parameters

Auth

Proxy and certificate

Whole-request methods

Assertions

Common Use Cases

Logging Request Details

Conditional Logic Based on Request Method

Accessing Query Parameters

Adding an Authentication Header

​What each script sees

​Properties and Methods

​rq.request.method

​rq.request.headers

​rq.request.headers.add(header)

​rq.request.headers.upsert(header)

​rq.request.headers.remove(name)

​rq.request.headers.clear()

​rq.request.body

​rq.request.url

​rq.request.queryParams

​Postman request members

​Identity

​Headers as a list

​Disabled headers and query parameters

​Auth

​Proxy and certificate

​Whole-request methods

​Assertions

​Common Use Cases

​Logging Request Details

​Conditional Logic Based on Request Method

​Accessing Query Parameters

​Adding an Authentication Header

​Related Documentation

What each script sees

Properties and Methods

`rq.request.method`

`rq.request.headers`

`rq.request.headers.add(header)`

`rq.request.headers.upsert(header)`

`rq.request.headers.remove(name)`

`rq.request.headers.clear()`

`rq.request.body`

`rq.request.url`

`rq.request.queryParams`

Postman request members

Identity

Headers as a list

Disabled headers and query parameters

Auth

Proxy and certificate

Whole-request methods

Assertions

Common Use Cases

Logging Request Details

Conditional Logic Based on Request Method

Accessing Query Parameters

Adding an Authentication Header

Related Documentation