Execution model

Each request can carry two optional JavaScript snippets:

• A pre-request script runs before the request is sent. It can read and modify the request method, URL, body, and headers; read and write environment variables; emit logs; and define tests.
• A post-response script runs after the response arrives. It can read the response (status, headers, body, timing, size, parsed JSON/XML), read and write environment variables, log, and run tests. It cannot modify the request — that ship has sailed.

Scripts are written in JavaScript and run inside an isolated, synchronous sandbox. They have access to a single global, fp.

The sandbox guards against accidental footguns — async APIs, runaway loops, accidental Node imports — but it is not designed to contain a malicious script. Treat a .http file from an untrusted source the same way you would treat a shell script from the same source: read it before running it.

The fp API

Member	Phases	Purpose
fp.request.method / url / body	pre: read/write · post: read-only	Mutate the in-flight request before send.
fp.request.headers.get/getAll/set/add/remove/count/toObject	pre: full · post: read-only	Case-insensitive header access. getAll / add / count are duplicate-aware (read or author repeated names); toObject is lossy.
fp.response.status / statusText / body / timingMs / sizeBytes	post only	Read-only response fields. sizeBytes is measured after decoding a compressed response.
fp.response.decodingStatus	post only	Outcome of decoding the body against Content-Encoding: 'decoded', 'not-required', 'unsupported' or 'failed' (in the last two the body is as received).
fp.response.headers.get/getAll/count/toObject	post only	Read-only response headers. getAll / count expose duplicates (e.g. Set-Cookie).
fp.response.json()	post only	Parse the body as JSON (10 MB cap). Throws when the body could not be decoded.
fp.response.xml2Json(options?)	post only	Parse the body as XML into an object tree (10 MB cap). Throws when the body could not be decoded.
fp.environment.get/set/remove/toObject	both	Read/write the persisted environment.
fp.variables.get/set	both	Read/write ephemeral per-send variables.
fp.test(name, fn)	both	Define a test assertion.
fp.expect(value)	both	Chai-like fluent assertions.
fp.log/warn/error(...)	both	Capture log lines (also exposed via console.log/warn/error).

The sandbox is deliberately constrained. The following are intentionally not available:

• Promises, async/await, setTimeout, setInterval, queueMicrotask, or any other asynchronous primitive — scripts must complete synchronously.
• eval(), new Function(), WebAssembly compilation.
• Filesystem, network, OS, or environment access.
• DOM globals, runtime internals, or any extension API.

CPU-bound scripts are hard-stopped at 5 seconds. The JSON and XML parsers each cap their input at 10 MB so an oversized response cannot hang the app.