Skip to main content

Pre-Configured Proxies

For an overview of Pre-Configured Proxies and when to use them, see Pre-Configured Proxy.

Runtime Options

Code transforms in Pre-Configured Proxies run in Basis Theory's Runtime environment and support the next images:

RuntimeDescriptionProvisioning
node-btDefault runtime with curated dependencies. No runtime object needed.Synchronous
node22Modern Node.js 22 that offers dependency customization.Asynchronous

Create a Proxy

Creates a new Proxy for the Tenant.

POST
https://api.basistheory.com/proxies
Copy

node22 provisioning is asynchronous. Check valid states for execution.

Permissions

proxy:create

Request

transform='module.exports = async function (req) {
// Do something with req.configuration.SERVICE_API_KEY

return {
headers: req.args.headers,
body: req.args.body
};
};'

curl "https://api.basistheory.com/proxies" \
-H "BT-API-KEY: <MANAGEMENT_API_KEY>" \
-H "Content-Type: application/json" \
-X "POST" \
-d '{
"name": "My Proxy",
"destination_url": "https://example.com/api",
"request_transforms": [
{
"code": '"$(echo $transform | jq -Rsa .)"'
}
],
"response_transforms": [
{
"code": '"$(echo $transform | jq -Rsa .)"'
}
],
"configuration": {
"SERVICE_API_KEY": "key_abcd1234"
},
"application": {
"id": "45c124e7-6ab2-4899-b4d9-1388b0ba9d04"
},
"require_auth": true
}'

Request Parameters

AttributeRequiredTypeDefaultRuntimeDescription
nametruestringnullAllThe name of the Proxy. Has a maximum length of 200
destination_urltruestringnullAllThe URL to which requests will be proxied
request_transformsfalsearraynullAllOne or more request transforms executed in order before sending to the destination.
response_transformsfalsearraynullAllOne or more response transforms executed in order before returning the proxy response.
applicationfalseApplicationnullnode-btThis Application's API key is injected into a pre-configured BasisTheory JS SDK instance passed into the transform. Must be a public or private Application Type.
configurationfalsemap<string, string>nullAllA string key and string value map of all configuration name and values for a Proxy Transform
require_authfalsebooleantrueAllRequire a BT-API-KEY request header for authentication and authorization

Response

Returns a Proxy if the Proxy was created. Returns an error if there were validation errors, or the Proxy failed to create.

{
"id": "433013a6-a614-4e1e-b2aa-5fba67aa85e6",
"tenant_id": "77cb0024-123e-41a8-8ff8-a3d5a0fa8a08",
"name": "My Proxy",
"key": "e29a50980ca5",
"destination_url": "https://example.com/api",
"request_transforms": [
{
"code": "module.exports = async function (req) { ... }"
}
],
"response_transforms": [
{
"code": "module.exports = async function (req) { ... }"
}
],
"configuration": {
"SERVICE_API_KEY": "key_abcd1234"
},
"application_id": "45c124e7-6ab2-4899-b4d9-1388b0ba9d04",
"require_auth": true,
"created_by": "3ce0dceb-fd0b-4471-8006-c51243c9ef7a",
"created_at": "2020-09-15T15:53:00+00:00"
}

List Proxies

Get a list of proxies for the Tenant.

GET
https://api.basistheory.com/proxies
Copy

Permissions

proxy:read

Request

curl "https://api.basistheory.com/proxies" \
-H "BT-API-KEY: <MANAGEMENT_API_KEY>"

Query Parameters

ParameterRequiredTypeDefaultDescription
idfalsearray[]An optional list of Proxy ID's to filter the list of proxies by
namefalsestringnullWildcard search of proxies by name

Response

Returns a paginated object with the data property containing an array of proxies. Providing any query parameters will filter the results. Returns an error if proxies could not be retrieved.

{
"pagination": {...}
"data": [
{
"id": "433013a6-a614-4e1e-b2aa-5fba67aa85e6",
"tenant_id": "77cb0024-123e-41a8-8ff8-a3d5a0fa8a08",
"name": "My Proxy",
"key": "e29a50980ca5",
"destination_url": "https://example.com/api",
"request_transforms": [
{
"code": "
module.exports = async function (req) {
// Do something with req.configuration.SERVICE_API_KEY

return {
headers: req.args.headers,
body: req.args.body
};
};
"
}
],
"response_transforms": [
{
"code": "
module.exports = async function (req) {
// Do something with req.configuration.SERVICE_API_KEY

return {
headers: req.args.headers,
body: req.args.body
};
};
"
}
],
"configuration": {
"SERVICE_API_KEY": "key_abcd1234"
},
"application_id": "45c124e7-6ab2-4899-b4d9-1388b0ba9d04",
"require_auth": true,
"created_by": "fb124bba-f90d-45f0-9a59-5edca27b3b4a",
"created_at": "2020-09-15T15:53:00+00:00",
"modified_by": "fb124bba-f90d-45f0-9a59-5edca27b3b4a",
"modified_at": "2021-03-01T08:23:14+00:00"
},
{...},
{...}
]
}

Get a Proxy

Get a Proxy by ID in the Tenant.

GET
https://api.basistheory.com/proxies/{id}
Copy

Permissions

proxy:read

Request

curl "https://api.basistheory.com/proxies/5b493235-6917-4307-906a-2cd6f1a90b13" \
-H "BT-API-KEY: <MANAGEMENT_API_KEY>"

URI Parameters

ParameterRequiredTypeDefaultDescription
idtrueuuidnullThe ID of the proxy

Response

Returns a Proxy with the id provided. Returns an error if the Proxy could not be retrieved.

{
"id": "433013a6-a614-4e1e-b2aa-5fba67aa85e6",
"tenant_id": "77cb0024-123e-41a8-8ff8-a3d5a0fa8a08",
"name": "My Proxy",
"key": "e29a50980ca5",
"destination_url": "https://example.com/api",
"request_transforms": [
{
"code": "module.exports = async function (req) { ... }"
}
],
"response_transforms": [
{
"code": "module.exports = async function (req) { ... }"
}
],
"configuration": {
"SERVICE_API_KEY": "key_abcd1234"
},
"application_id": "45c124e7-6ab2-4899-b4d9-1388b0ba9d04",
"require_auth": true,
"created_by": "fb124bba-f90d-45f0-9a59-5edca27b3b4a",
"created_at": "2020-09-15T15:53:00+00:00",
"modified_by": "fb124bba-f90d-45f0-9a59-5edca27b3b4a",
"modified_at": "2021-03-01T08:23:14+00:00"
}

Update Proxy

Update a Proxy by ID in the Tenant.

PUT
https://api.basistheory.com/proxies/{id}
Copy

node22 updates are asynchronous. Check valid states where node22 can be updated.

Permissions

proxy:update

Request

transform='module.exports = async function (req) {
// Do something with req.configuration.SERVICE_API_KEY

return {
headers: req.args.headers,
body: req.args.body
};
};'

curl "https://api.basistheory.com/proxies/433013a6-a614-4e1e-b2aa-5fba67aa85e6" \
-H "BT-API-KEY: <MANAGEMENT_API_KEY>" \
-H "Content-Type: application/json" \
-X "PUT" \
-d '{
"name": "My Proxy",
"destination_url": "https://example.com/api",
"request_transforms": [
{
"code": '"$(echo $transform | jq -Rsa .)"'
}
],
"response_transforms": [
{
"code": '"$(echo $transform | jq -Rsa .)"'
}
],
"configuration": {
"SERVICE_API_KEY": "key_abcd1234"
},
"application": {
"id": "45c124e7-6ab2-4899-b4d9-1388b0ba9d04"
},
"require_auth": true
}'

URI Parameters

ParameterRequiredTypeDefaultDescription
idtrueuuidnullThe ID of the proxy

Request Parameters

AttributeRequiredTypeDefaultRuntimeDescription
nametruestringnullAllThe name of the Proxy. Has a maximum length of 200
destination_urltruestringnullAllThe URL to which requests will be proxied
request_transformsfalsearraynullAllOne or more request transforms executed in order before sending to the destination.
response_transformsfalsearraynullAllOne or more response transforms executed in order before returning the proxy response.
applicationfalseApplicationnullnode-btThis Application's API key is injected into a pre-configured BasisTheory JS SDK instance passed into the transform. Must be a public or private Application Type.
configurationfalsemap<string, string>nullAllA string key and string value map of all configuration name and values for a Proxy Transform
require_authfalsebooleantrueAllRequire a BT-API-KEY request header for authentication and authorization
disable_detokenizationfalsebooleanfalseWhen true, disables all detokenization processing and passes {{...}} syntax through as literal text. Use this when your payload contains literal {{...}} strings that should not be interpreted as detokenization expressions.

Response

Returns a Proxy if the Proxy was updated. Returns an error if there were validation errors, or the Proxy failed to update.

{
"id": "433013a6-a614-4e1e-b2aa-5fba67aa85e6",
"tenant_id": "77cb0024-123e-41a8-8ff8-a3d5a0fa8a08",
"name": "My Proxy",
"key": "e29a50980ca5",
"destination_url": "https://example.com/api",
"request_transforms": [
{
"code": "module.exports = async function (req) { ... }"
}
],
"response_transforms": [
{
"code": "module.exports = async function (req) { ... }"
}
],
"configuration": {
"SERVICE_API_KEY": "key_abcd1234"
},
"application_id": "45c124e7-6ab2-4899-b4d9-1388b0ba9d04",
"require_auth": true,
"created_by": "3ce0dceb-fd0b-4471-8006-c51243c9ef7a",
"created_at": "2020-09-15T15:53:00+00:00",
"modified_by": "34053374-d721-43d8-921c-5ee1d337ef21",
"modified_at": "2021-03-01T08:23:14+00:00"
}

Patch Proxy

Patch a Proxy by ID in the Tenant.

PATCH
https://api.basistheory.com/proxies/{id}
Copy

node22 updates are asynchronous. Check valid states where node22 can be updated.

Permissions

proxy:update
The Patch Proxies endpoint uses a different content-type to support merge-patch operations. Requests need the Content-Type header to be set to application/merge-patch+json. Requests made with a different Content-Type header value will receive a 415 Unsupported Media Type response code. For more information on merge-patch, see RFC 7386.

Request

transform='module.exports = async function (req) {
// Do something with req.configuration.SERVICE_API_KEY

return {
headers: req.args.headers,
body: req.args.body
};
};'

curl "https://api.basistheory.com/proxies/433013a6-a614-4e1e-b2aa-5fba67aa85e6" \
-H "BT-API-KEY: <MANAGEMENT_API_KEY>" \
-H "Content-Type: application/merge-patch+json" \
-X "PATCH" \
-d '{
"name": "My Proxy",
"destination_url": "https://example.com/api",
"configuration": {
"SERVICE_API_KEY": "key_abcd1234"
}
}'

URI Parameters

ParameterRequiredTypeDefaultDescription
idtrueuuidnullThe ID of the proxy

Request Parameters

AttributeRequiredTypeDefaultRuntimeDescription
namefalsestringnullAllThe name of the Proxy. Has a maximum length of 200
destination_urlfalsestringnullAllThe URL to which requests will be proxied
request_transformsfalsearraynullAllOne or more request transforms executed in order before sending to the destination.
response_transformsfalsearraynullAllOne or more response transforms executed in order before returning the proxy response.
applicationfalseApplicationnullnode-btThis Application's API key is injected into a pre-configured BasisTheory JS SDK instance passed into the transform. Must be a public or private Application Type.
configurationfalsemap<string, string>nullAllA string key and string value map of all configuration name and values for a Proxy Transform
require_authfalsebooleantrueAllRequire a BT-API-KEY request header for authentication and authorization
disable_detokenizationfalsebooleanfalseWhen true, disables all detokenization processing and passes {{...}} syntax through as literal text. Use this when your payload contains literal {{...}} strings that should not be interpreted as detokenization expressions.

Response

Returns 204 if successful. Returns an error if there were validation errors, or the operation failed.

Delete Proxy

Delete a Proxy by ID in the Tenant.

DELETE
https://api.basistheory.com/proxies/{id}
Copy

Check valid states where node22 can be deleted.

Permissions

proxy:delete

Request

curl "https://api.basistheory.com/proxies/433013a6-a614-4e1e-b2aa-5fba67aa85e6" \
-H "BT-API-KEY: <MANAGEMENT_API_KEY>" \
-X "DELETE"

URI Parameters

ParameterRequiredTypeDefaultDescription
idtrueuuidnullThe ID of the proxy

Response

Returns an error if the Proxy failed to delete.

Proxy Object

AttributeTypeDescription
iduuidUnique identifier of the Proxy which can be used to get a Proxy
keystringAuto-generated key used to invoke this Proxy
namestringThe name of the Proxy
destination_urlstringThe URL to which requests will be proxied
tenant_iduuidThe Tenant ID which owns the Proxy
require_authbooleanRequire a BT-API-KEY request header for authentication and authorization
disable_detokenizationbooleanWhen true, disables all detokenization processing and passes {{...}} syntax through as literal text
request_transformsarray(Optional) One or more request transforms executed in order before sending to the destination.
response_transformsarray(Optional) One or more response transforms executed in order before returning the proxy response.
application_idstring(Optional) This Application's API key is injected into a pre-configured BasisTheory JS SDK instance passed into the transform. Must be a public or private Application Type.
configurationmap<string, string>(Optional) A string key and string value map of all configuration name and values for a Proxy Transform
created_byuuid(Optional) The ID of the user or Application that created the Proxy
created_atstring(Optional) Created date of the Proxy in ISO 8601 format
modified_byuuid(Optional) The ID of the user or Application that last modified the Proxy
modified_atdate(Optional) Last modified date of the Proxy in ISO 8601 format

Proxy Request Transform Object

AttributeTypeDescription
typestringThe type of request transform. One of code or tokenize. Default: code.
codestringTransform code which will be executed when the Proxy transform is processed. Required when type is code. See Request Transforms for details.
runtimeRuntime ObjectRuntime configuration for transforms.
optionsobjectConfiguration options for the transform. Required when type is tokenize. See Transform Options for details.

Proxy Response Transform Object

See Response Transforms for details regarding the various types of response transforms.

AttributeTypeDescription
typestringThe type of response transform. One of code, mask, tokenize, append_json, append_text, or append_header. Default: code.
codestringTransform code which will be executed when the Proxy transform is processed. Required when type is code
runtimeRuntime ObjectRuntime configuration for transforms.
optionsobjectConfiguration options for the transform. Required when type is tokenize, append_json, append_text, or append_header. See Transform Options for details.
matcherstringThe type of matching. One of regex or chase_stratus_pan. Required when type is mask
replacementstringThe replacement character for masking. Must be only one character in length. Required when type is mask
expressionstringThe regular expression to use when determining masking values. Must contain at least one capture group using parenthesis. Required when type is mask and matcher is regex.

Transform Options

The options field structure varies by transform type:

Tokenize Transform Options (Request and Response)

AttributeTypeDescription
tokenobjectToken creation configuration matching the Create Token Request schema
identifierstringOptional identifier for referencing the created token in subsequent transforms

For request and response transforms, token.data can contain:

  • Static plaintext values
  • Encrypted JWE expressions
  • Request expressions like "{{ req.card_number }}" or "{{ res.card_number }}" to extract data from the request or response payload

Append JSON Transform Options (Response only)

AttributeTypeDescription
valueanyThe data to append to the response. Can contain Liquid expressions or token references
locationstringJSONPath expression specifying where to place the value in the response (e.g., "$.created_token_id")
When using nested JSONPath expressions in the location field (e.g., "$.metadata.token_id"), the system will automatically create any missing parent objects in the response structure.

Append Text Transform Options (Response only)

AttributeTypeDescription
valuestringThe text to append to the end of the response body. Can contain Liquid expressions or token references

Append Header Transform Options (Response only)

AttributeTypeDescription
valuestringThe header value to add to the response. Can contain Liquid expressions or token references
locationstringThe header name to add to the response

Token References in Options

For transforms that support token references, you can reference tokens created by previous transforms using:

  • "{{ transform_identifier: 'identifier' }}" - References the full token data
  • "{{ transform_identifier: 'identifier' | json: '$.path' }}" - Extracts specific data using JSONPath

Runtime Object

The runtime object configures the execution environment.

AttributeRequiredTypeDefaultRuntimeDescription
imagetruestring-AllThe runtime image identifier. See available runtimes.
dependenciesfalsemap<string, string>{}node22npm packages to install. Key is package name, value is semver version (e.g., "stripe": "^18.4.0").
timeoutfalsenumber10node22Maximum execution time in seconds (1-30).
resourcesfalsestringstandardnode22Compute resources allocation. One of standard, large, xlarge.
warm_concurrencyfalsenumber0node22Number of warm instances to maintain.
permissionsfalsearray<string>[]node22Basis Theory permissions to grant (e.g., token:reveal, token:create).

See Runtime Options for detailed descriptions of each property.

Requested Object

The requested object contains the pending configuration during asynchronous provisioning (when state is creating or updating).

AttributeTypeDescription
codestringThe pending code.
runtimeRuntime ObjectThe pending runtime configuration.
{
"request_transforms": [
{
"type": "code",
"code": "module.exports = async function (event) { const MaskData = require('maskdata'); ... }",
"runtime": {
"image": "node22",
"dependencies": {
"maskdata": "^1.3.2"
},
"permissions": ["token:reveal"],
"timeout": 10,
"resources": "standard"
}
}
]
}

Transforms

For details on writing transform code, including input/output contracts, available transform types, and examples, see Proxy Transforms.

Request Transforms

See Request Transforms for code contracts and available transform types.

Response Transforms

See Response Transforms for code contracts and available transform types.