Modify incoming API requests before they reach the backing resource by adding, removing, renaming, or replacing headers, query parameters, and body fields.
Overview
A Request Transformer Policy modifies incoming API requests before they reach the backing resource. Use it to add, remove, rename, or replace headers, query parameters, and body fields — for example, to inject a standard header, drop a parameter your backend doesn't expect, or adapt a client's request to the shape your automation needs, without changing the client or the backend. It is an inbound policy. To change what callers receive, use the Response Transformer Policy instead.
Field Reference
Field | Description |
|---|---|
Policy Name * | A unique identifier used across logs, dashboards, and API group configurations. |
Tags | Custom labels to organize and filter the policy by environment, team, or functionality. |
Protocols | The request protocols that trigger this policy: http, https, or both. Defaults to https. A request on a protocol not selected is refused with 403. |
Transformation | One or more transformation rules. Select Add Transformation to add a rule. Each rule has an Operation and a Location, plus the fields that operation needs. |
Transformation Rule Fields
Sub-field | Description |
|---|---|
Operation | Upsert — add or update a field; Remove — delete a field; Rename — rename an existing field; Replace — replace the value of an existing field. |
Location | Header — modify request headers; Query Params — modify query parameters; Body — modify the request payload. |
Key | For Upsert, Replace, and Remove: the field to transform — the header name, query parameter name, or body field name. |
Value | For Upsert and Replace: the new value. |
Old value | For Rename: the field to be renamed. |
New value | For Rename: the new field name. |
How It Works
Request received — The gateway receives the API request.
Protocol check — The request's protocol is checked against the configured protocols. A request on a protocol not selected is refused with 403.
Transformation execution — Each rule is applied in sequence: headers, query parameters, or body fields are added, updated, renamed, replaced, or removed per the configured location.
Modified request forwarded — After all transformations, the updated request continues to the next policy or to the backing resource.
Attaching the Policy
Policies can attach at three levels: access profile, API, and API group. They are applied in that order: access profile first, then API, then API group.
Notes
Transformation rules are applied in the order you define them — if rules depend on each other (e.g., rename before replace), order them deliberately.
Use Remove to strip headers or parameters your backend shouldn't receive.
Use Upsert to inject standard headers (e.g., X-API-Version) into every request without changing each client.
Replace changes a field only if it is already present in the request; use Upsert to add it when it is missing.
Test transformations against sample requests before attaching to a production group to confirm the backend receives the shape it expects.