Convert an ngrok Traffic Policy

Turn an ngrok Traffic Policy file (YAML or JSON) into the equivalent ngris policy YAML, with a report of what was converted, what was approximated and what was skipped. Nothing is created or changed on your account: save ngris_yaml as a file and pass it to the agent with ngris http 3000 --traffic-policy policy.yaml (see Traffic rules), or add the rules to an endpoint with Add Rule.

How it converts:

• An ngrok rule holds several actions; an ngris rule is one action. Each action becomes its own ngris rule carrying the ngrok rule's name and its expressions joined with &&. Phases and order are kept. on_tcp_connect rules go to on_udp_connect when tunnel_type is udp.
• In expressions only req.url.path is renamed (to req.path); everything else is copied as written — check the result with Test a Rule Expression.
• Converted directly: add-headers, remove-headers, restrict-ips (with allow / deny lists), url-rewrite, redirect, custom-response, compress-response.
• Converted with a warning to review: rate-limit (ngrok's token bucket becomes a fixed window), deny (becomes a custom-response, 403 by default), request-body-find-replace / response-body-find-replace (one literal replace-body rule per replacement), owasp-crs-request / owasp-crs-response (the waf rule in detect mode), and jwt-validation, verify-webhook, set-vars, circuit-breaker (config copied as is; the fields differ).
• Skipped with a warning: oauth, oidc and basic-auth (sign-in is an endpoint setting on ngris — see Update Endpoint Auth), restrict-ips that only references ngrok IP policies, forward-internal, http-request, close-connection, log, terminate-tls, sse-find-replace, any unknown action, and every action under on_event_stream_message.

Any signed-in member can call it; only a suspended account is refused.

Request body

Response (200 OK)

Errors