Caido

Writing HTTPQL Queries ​

With HTTPQL, you can include or exclude traffic proxied through Caido from traffic tables and operations.

HTTPQL query statements filter either requests (req), responses (resp), or specific table rows (id). The filtering is further refined by specifying an available field, operator, and comparison value, using dot notation.

sql
<namespace>.<field>.<operator>:"<value>"

NOTE

These statements will serve as a starting point for your HTTPL queries. View the full HTTPQL reference to customize your query statements to achieve the intended results.

Filtering Requests by Host ​

To filter requests made to example.com, use the host field.

sql
req.host.eq:"www.example.com"
req.host.regex:"^example.com$"
sql
req.host.ne:"www.example.com"
req.host.nregex:"^example.com$"
sql
req.host.cont:".example.com"
req.host.like:"%.example.com"
sql
req.host.ncont:".example.com"
req.host.nlike:"%.example.com"

Filtering Requests by Time ​

To filter requests by date/time, use the created_at field.

sql
req.created_at.lt:"2025-12-05"
sql
req.created_at.gt:"2025-12-05"
sql
req.created_at.lt:"2025-12-05T08:30:00+00:00"
sql
req.created_at.gt:"2025-12-05T08:30:00+00:00"

Filtering Responses by Status Code ​

To filter responses by status code, use the code field.

sql
resp.code.eq:200
sql
resp.code.ne:200

To specify a range of status codes, use the gt, lt, gte, or lte operators.

Filter Requests by ID ​

To filter traffic by the numerical table row value, use the id field.

sql
row.id.eq:50
sql
row.id.ne:50
sql
row.id.gt:50
sql
row.id.lt:50

To include the specific request ID, use the gte or lte operators.

Filter by Request/Response Content ​

To match against a value in a full request or response, use the raw field.

sql
req.raw.cont:"application/json"
sql
resp.raw.cont:"\"isAdmin\":true"