# HTTP Engine

For script authoring, see the [JavaScript API guide](profile/javascript-api.md), including an importable demo, request/response fields, completion rules, and runtime limits.

MintFlow 2.0.0 can inspect and rewrite HTTP/HTTPS traffic carried by Direct, VPN, or proxy routes. Open the **HTTP** tab for HTTP Engine configuration, live capture, Rewrite, and HTTP Labs.

## Select traffic, then record it

**Enable HTTP Processing** enables the engine. Choose **Domain Capture** (DNS suffixes), **IPv4 Capture** (destination CIDRs), and **TCP Ports** (80 and 443 by default), or use **Capture All** for all IPv4 destinations on those ports. Capture All retains your detailed scope lists for later use.

Capture scope is separate from routing: an HTTP capture domain is not a routing domain set. A destination must enter the MintFlow tunnel and match the HTTP scope before the engine can process it. App Routing/MintFlow DNS supports domain-based matching.

Live recording is a separate control. With VPN running, start **HTTP Live Capture**, reproduce the operation, and stop the session. Browse requests and responses or reopen a stopped session from history.

## HTTPS and certificates

Generate the local CA under **HTTP → HTTP Engine → MITM Certificate**, install its profile, and enable full trust in iOS **Settings → General → About → Certificate Trust Settings**. Merely installing a certificate profile does not enable trust.

Keep **Apple Service Compatibility** enabled for ordinary use. Add sensitive or incompatible domains to the custom never-decrypt list. Certificate-pinned apps may fail or remain opaque; installing MintFlow's CA does not bypass pinning. HTTP/3 uses QUIC/UDP and is not decrypted by the TCP engine. The HTTP/3 blocking option can prompt compatible clients to fall back to TCP, but fallback is not guaranteed.

Follow the [step-by-step capture guide](howtos/http-live-capture.md) for current screens, CA setup, and troubleshooting.

## URL and body rewrites

URL rules match a URL with a regular expression and can reject it or return a 302 redirect to another URL. Body rules transform either a request or a response with jq or JavaScript.

Use jq for JSON transformations. JavaScript supports JSON or text bodies through MintFlow's versioned `$MF` API. Scripts are managed local resources; editing profile text alone does not supply their source. Save and restart VPN to compile changed rules. Available rule allowances and advanced tools depend on your entitlement.

## Analysis exports and portable rewrites

Export stopped sessions as an **Agent Analysis Bundle** or **Original Database** bundle. The analysis mode redacts query values and known credential headers and includes a specification that an AI coding agent can use to produce one `.mfhrb` rewrite file.

Import the result in **HTTP → Rewrite**. MintFlow saves imported rules disabled for review; inspect and test them before enabling and restarting VPN. See the [analysis bundle and MFHRB guide](howtos/http-analysis-mfhrb.md) for the file structure, privacy options, complete example, and iteration workflow.

[Profile fields](profile.md#http-engine)