History

Every request you send from the Composer editor, or through the REST API or MCP, is logged to a dedicated History tab — not just the request you sent, but the response that came back, so you can review what an endpoint returned without resending it. The requests of a collection run aren't logged.

Opening History

Click the clock icon in the Collections sidebar header (next to the environment and import icons). History opens as its own tab in the unified tab bar, alongside your session and request tabs — clicking the icon again just switches back to the existing tab instead of opening a second one.

Layout

The tab is a table-and-detail split, same shape as the rest of Probe:

Table (left) — one row per sent request: Method, URL, Status, Duration, Time. Sorted newest-first by default; click the Time header to flip the order.
Detail (right) — select a row to see its full Request (headers, params, body) and Response (headers, body) on separate sub-tabs. A response that was truncated when saved (see below) shows a note above the body.

The row and the Request sub-tab show the request as it was sent: after any pre-request script's edits, with {{variables}} resolved, and with the headers Probe added (auth, cookies, content type). The credentials Probe recognises are masked, because History is saved to disk; see below.

What's masked, and why

History is a plain file on disk, so Probe masks the credentials it can recognise before it saves an entry. These values are replaced with ••••••••, and that's what the History tab shows:

The request headers Authorization, Proxy-Authorization and Cookie. An auth scheme stays readable (Bearer ••••••••), and so do cookie names (sid=••••••••).
The header your request's or collection's API-key auth sends, and the common key headers X-API-Key, Api-Key and X-Auth-Token.
The response header Set-Cookie. Cookie names and attributes such as Path stay readable.
The secret fields of the request's Auth tab (bearer token, basic-auth password, API-key value), and the values of the Cookies tab.
The password in a URL's user info (https://ada:••••••••@host), in the URL and in an error text that repeats it. User info without a password is masked whole, since that's where a token goes.
The values of secret variables, in the URL, the headers, both bodies and the error text of a failed send (which repeats the URL it was sending), in whatever form the request carries them (URL-encoded or not, in any letter case). That includes the value a request was sent with when a script changes or unsets the variable afterwards, such as a refreshed token or a logout, and a value that stands in for a secret variable: a script's pro.variables.set local or a REST or MCP variables value with a secret variable's name. A secret of the collection the request was sent from, and a global secret, is masked however short it is: a secret 1 masks every 1 in that collection's entries.

Everything else is saved as it was sent: body fields, other headers, query parameter values (in the URL or the Params tab), form-data rows that hold a literal value, and the request's scripts. To keep a credential out of History, put it in a secret variable or in one of the places above.

A {{template}} is never masked: it holds no secret.

Each time Probe starts, it masks History again with the rules above and the current values of secret variables, picked by where each entry was sent from: an entry sent from a collection gets the secrets of that collection (every environment) and the global secrets, and an entry sent with no collection gets the global secrets only. So an entry saved before masking existed, or before a value was made secret, is masked too, and one collection's secret never masks an entry sent from another collection or from none.

Probe records where an entry was sent from since 2026-10-07. An older entry doesn't say, so it gets every collection's secret values of 4 characters or more and the global secrets (a shorter value, such as a PIN 1, would mask every 1 in it). That can mask more than the secret itself, and masking can't be undone: if one of your collections has a secret variable whose value is admin, an older entry's /Admin/users becomes /••••••••/users. A value that was already changed or deleted by then is no longer known, so an old entry that holds it keeps it: delete that entry from its row's menu.

A search field above the table filters rows by method or URL substring as you type.

Loading a past request back into the editor

Right-click a row (or use the Load into Editor button in the detail header) to open that request's captured snapshot in a new unsaved Composer tab named History: the method, URL, headers, params, cookies, body and its type (form-data rows included), GraphQL variables, description, auth, timeout, both scripts and the response that came back, exactly as they were in the editor when you sent it (with {{variables}} and without the scripts' edits, so the scripts run again on the next send). The draft opens with the collection the request was sent from selected (or none, if it was sent without one), so its {{variables}}, scripts, auth and cookies resolve there; if that collection has since been deleted, the current one stays selected and History says so. The tabs you already have open are left as they are. Save the draft to keep it in a collection: a saved request has no place for form-data rows or a binary body's file, so those don't come back after Probe restarts.

Values that come from variables replay as they were, so no secret is needed to replay a request. A masked value you typed straight into the request (a credential header, the Auth tab, the Cookies tab, a URL's user info, or a secret variable's value written out) comes back as ••••••••: the detail panel says so above the Request tab, and you re-enter it before sending. The same goes for text an older entry lost to masking with every collection's secrets (see above).

What's kept, and for how long

Up to 200 requests are kept, oldest evicted first when the log is full.
Each entry's response body is capped at 256 KB when saved — a larger body is truncated and flagged, and the truncation note appears above the body in the Response sub-tab.
The request body and the copy of the response that Load into Editor restores are capped at 256 KB too, so loading an entry whose request body was larger gives you the first 256 KB.
History is a permanent file on disk (~/.probe/compose_history.json, not SharedPreferences), so it survives app restarts.
Delete an entry with Delete in its row's context menu. Clear All, next to the search field, deletes every entry after you confirm (a search filter doesn't narrow it). It is not offered while History is empty.

Composer OverviewWhere Send lives and how responses are captured.

CollectionsSave a request from History permanently instead of just reloading it once.