Use API response mocks to make crawl results repeatable

What a response mock does

A crawl profile can replace a matching same-origin fetch or XMLHttpRequest response with a status, body, and optional safe response headers. This is useful when a page has different states driven by data, such as an empty list, an error message, or a populated table. The page still has to make the request and render the response.

Keep the match narrow

Use a path fragment that identifies the intended endpoint and choose the HTTP method the page uses. Set a response body that matches the shape the application expects. Broad patterns can unintentionally affect multiple requests, and a body with the wrong shape may leave the page in an error or loading state.

Build and import the profile

In the test-config builder, set the website target, enable crawl mode, then add the mock with the matching URL path, method, status, and response body. Download the JSON profile and import it in the extension. Treat the profile as test data: do not put passwords, access tokens, private customer information, or production response headers in a shareable file.

Verify the rendered state before trusting the scan

Run the crawl on a page where you can recognize the expected state. Confirm that the interface shows the mock data, then inspect the findings for that page. If the page does not make the matching request, the mock will not run. If you need the page to wait for live data rather than replace it, configure a page readiness rule instead.

Compare states safely

Create separate profiles for meaningful states, such as populated and empty results. Keep the target and other scan settings the same, then compare the findings. Mocks improve repeatability, but they do not verify that the real server returns correct data or that every production state is accessible.