← Docs

Proxy

Your endpoint is a URL, /<endpoint-id>/... on this site, shown at the top of the dashboard. Send it any HTTP request, with any method and path. Middleman records the request and answers it.

Without a target

With no target set, Middleman records the request and answers 200 with an empty body. This is all a guest endpoint does.

With a target

Set a target in the Config tab: an absolute http:// or https:// URL. Middleman forwards each request there and relays the target's answer back to the sender.

Path and query: whatever follows your endpoint id is appended to the target's path, and the request's query string goes after the target's own. With target https://api.example.com/hooks?src=mm, a request to /<endpoint-id>/orders?id=7 is forwarded to https://api.example.com/hooks/orders?src=mm&id=7.
Method, headers and body are forwarded as received, except for the changes below. A request template can rewrite a JSON body first.
The answer (status, headers and body) is relayed to the sender, so your target decides what the sender sees. Set-Cookie and Clear-Site-Data are not relayed.
Redirects are not followed. A 3xx answer is relayed as is.

What Middleman changes

Cookies Middleman itself sets for the dashboard are removed from the request. Your other cookies pass through.
Headers added by Middleman's hosting (X-Forwarded-Proto, Forwarded, Traceparent, Tracestate, X-Cloud-Trace-Context and X-Goog-*) are removed. X-Forwarded-For is kept, carrying the sender's address.
Every answer on your endpoint URL, errors included, carries Content-Security-Policy: sandbox and X-Content-Type-Options: nosniff, so an HTML answer from your target cannot run scripts in a browser.

Which targets are allowed

The target must have a host. Targets that resolve to private, loopback or link-local addresses are refused when a request is forwarded (the sender gets a 502), so you cannot point Middleman at localhost or your internal network. To reach a service on your machine, expose it with a tunnel and use the tunnel's public URL.

Limits

Limit	Value	When exceeded
Request body	1 MiB	`413`
Target's response body	1 MiB	`502`
Whole exchange with the target, reading its answer included	30 seconds	`502`, or `500` if it runs out while the answer body is being read
Requests to your endpoint	10 per second, bursts of 30	`429`
Requests from one network address, to any endpoint	50 per second, bursts of 200	`429`
Forwarded requests	3 per second, bursts of 10	`429`
Forwards in flight at once	10	`429`

Requests answered with one of these errors are still recorded in History, with the reason. The exceptions are 404, and the 429 for one network address, which are answered before the request reaches your endpoint.

Error answers

Errors Middleman produces itself are JSON like {"message": "..."}, except the per-address 429, which is plain text.

Status	Meaning
`404`	The id in the URL is not an endpoint, or a guest endpoint has expired.
`400`	The saved target is not a valid URL. Fix it in the Config tab.
`413`	The request body is over the limit.
`422`	The endpoint's request template failed on the request and the endpoint's "On request template failure" setting is Reject (the default). Nothing was forwarded.
`429`	A rate or concurrency limit was hit. Retry later.
`502`	The target could not be reached or refused, took too long, or answered with a body over the limit.
`500`	The target's answer could not be read to the end.

When a request template fails on a request, the failure is recorded in History and the Config tab's "On request template failure" setting decides what happens. Reject (the default) answers 422 and forwards nothing. Forward sends the original body on instead. Bodies that are not JSON, and empty bodies, skip the template and are forwarded unchanged.

← Docs