Traffic capture

Trust the local CA, run the intercepting proxy, and capture WebSocket traffic.

Studio includes a real intercepting proxy — not a mock — so you can capture and inspect traffic from a browser, a mobile app, or any HTTP client while you test.

Trust the local CA (once per machine)

To read HTTPS traffic, the proxy generates a root CA on your machine and mints a short-lived leaf certificate per host you visit through it — the same approach Burp and mitmproxy use. Nothing is uploaded anywhere; the CA's private key never leaves disk.

  1. Open Proxy.
  2. Install/trust the local CA when prompted (per-OS: added to the system or browser trust store).
  3. You only need to do this once. If you regenerate the CA later, you'll need to re-trust it.

Start intercepting

  1. From Proxy, start the proxy — it listens on 127.0.0.1 on a local port shown in the view.
  2. Point your browser, mobile device, or API client at that address (system proxy settings, or an explicit proxy config in your HTTP client).
  3. Traffic starts appearing in the view live. Every request/response pair is captured as an exchange, added to the Sitemap, and run through the passive rule set automatically.

Keep scope rules tight so you're only capturing hosts you actually own — traffic to unrelated third-party hosts your browser happens to also call is noise you don't need in a project.

WebSocket traffic

If a captured connection upgrades to a WebSocket, Studio relays it and logs every frame in both directions under WebSocket — useful for APIs that push events or use a socket for part of the session instead of polling.

Two things worth knowing

  • HTTP/2 isn't intercepted yet. The proxy currently handles HTTP/1.1 and WebSocket upgrades; clients that negotiate HTTP/2 to your API won't be visible through it. Force HTTP/1.1 on the client side if you need to see that traffic.
  • The proxy's upstream leg doesn't validate your API's TLS certificate. This is a deliberate trade-off for a local dev tool (matching Burp's default), so self-signed certs on a local dev server won't block capture. Every other engine in Studio — Repeater, active rules, role-diff, Intruder, login macros — uses a strict TLS client.

Once you've captured some traffic, jump into Manual testing tools to replay and manipulate individual requests.