An HTTP transcript is most useful when it shows the request shape and response behavior without exposing an access capability. Keep protocol facts that explain the failure, replace live values consistently, and state which tool normalized the output.
Record the minimum complete exchange
Include the method, representative path, content type, relevant request headers, status code, relevant response headers, and a sanitized body. Add the client, environment, and timestamp when they affect behavior.
Do not include unrelated cookies, complete authorization headers, analytics identifiers, or a full production payload when a small synthetic example reproduces the issue.
Remove access capabilities
Redact bearer tokens, API keys, cookies, signed URLs, webhook signatures, basic-auth values, client secrets, and temporary cloud credentials. Rotate any value that has already been exposed.
Keep header names where their presence matters. For example, Authorization: [REDACTED] shows that authentication was attempted without revealing the credential.
Practical next step: HTTP language guide - Preserve protocol context in readable form.
Preserve data shape with synthetic values
Maintain JSON types, nesting, null behavior, list length when relevant, and field relationships. Replace names, email addresses, account numbers, and customer content with realistic but unmistakably synthetic values.
Use the JSON formatter locally to catch syntax damage after redaction. A syntactically valid payload can still be semantically unsafe, so inspect every value.
Explain the observed result
State the expected status and body, the actual result, whether redirects were followed, and whether a proxy changed headers. Include retry behavior only when it is part of the problem.
Use HTTP or JSON highlighting, unlisted visibility, and short retention. A durable API example belongs in tests or documentation after the issue is resolved.
Transcript element
| Transcript element | Recommendation | Practical meaning |
|---|---|---|
| Method and path shape | Keep | Generalize tenant or object identifiers. |
| Authorization and cookies | Redact and rotate if exposed | They may grant access. |
| Status and content type | Keep | They explain protocol behavior. |
| Personal response fields | Replace synthetically | Preserve types and relationships. |
| Signed URL query | Remove the signature | Keep only a representative path when needed. |
Primary sources and further reading
These references support the standards and implementation concepts used in How to share API responses and HTTP transcripts. Product behavior is checked separately against Pastebin.ai.