Dynamic templating

A token is a placeholder in double braces, such as {{params.id}}, that Mock Studio replaces each time it sends a response. Tokens let a mock echo what the client sent and return fresh ids, times and made-up data, so replies look like a real API.

Where tokens work

• In a response body, for every body type except Empty.
• In the Value of a response header.

Type a token by hand, or use Insert variable above the body editor. Spaces inside the braces are allowed: {{ uuid }} is the same as {{uuid}}.

Tokens are not replaced in the project's global headers, in labels or in paths. Flows have their own extra tokens for steps.

A first example

The sample Create user endpoint, POST /users, has this body:

{
  "id": "{{uuid}}",
  "name": "{{body.name}}",
  "email": "{{body.email}}",
  "createdAt": "{{now}}"
}

Send this request:

curl -X POST http://localhost:8080/users \
  -H 'Content-Type: application/json' \
  -d '{"name": "Ana Li", "email": "ana@example.com"}'

The reply echoes the name and email and adds a new id and the current time:

{
  "id": "c1b7f0de-2a53-4c1b-9d8e-6f1a2b3c4d5e",
  "name": "Ana Li",
  "email": "ana@example.com",
  "createdAt": "2026-11-09T06:30:25.412345Z"
}

Token reference

Data from the request

Token	Replaced with	Example
{{params.<name>}}	A path parameter from the endpoint path	{{params.id}} is 42 for /users/:id and /users/42
{{params.wildcard0}}	The segment matched by the first *	report for /files/* and /files/report
{{params.rest}}	Everything matched by **	img/logo.png for /assets/**
{{query.<name>}}	A query-string parameter	{{query.page}} is 2 for ?page=2
{{header.<name>}}	A request header	{{header.Authorization}}
{{body.<path>}}	A field of the JSON request body	{{body.email}}

Notes:

• A second and third * in a path are {{params.wildcard1}} and {{params.wildcard2}}.
• Header names are not case-sensitive: {{header.authorization}} and {{header.Authorization}} read the same header.
• Parameter, query and body field names are case-sensitive.
• The words params, query, header and body must be lower case.

Reading the request body

{{body.<path>}} works when the request body is a JSON object. Use dots to go deeper, and a number to pick an item from a list, counting from 0.

For this request body:

{
  "user": { "name": "Ana", "roles": ["admin", "editor"] },
  "items": [ { "id": 7 }, { "id": 9 } ],
  "total": 31.5
}

Token	Result
{{body.user.name}}	Ana
{{body.user.roles.0}}	admin
{{body.items.1.id}}	9
{{body.total}}	31.5
{{body.user}}	{"name":"Ana","roles":["admin","editor"]}

A token that points at an object or a list is replaced with its JSON text, so you can echo a whole part of the request: "received": {{body.user}}, with no quotes around the token. There is no token for the entire body; name the fields you need.

Ids and time

Token	Replaced with	Example
{{uuid}}	A random version 4 UUID	c1b7f0de-2a53-4c1b-9d8e-6f1a2b3c4d5e
{{now}}	The current time in UTC, ISO 8601	2026-11-09T06:30:25.412345Z
{{now.iso}}	The same as {{now}}	2026-11-09T06:30:25.412345Z
{{timestamp}}	The current unix time in seconds	1794205825
{{now.unix}}	The same as {{timestamp}}	1794205825

Random numbers

Token	Replaced with	Example
{{randomInt(a,b)}}	A whole number from a to b, both included	{{randomInt(1,100)}} gives 57
{{randomInt}}	A whole number from 0 to 999	418

a and b must be whole numbers. They can be negative, and they can be given in either order.

Fake data

Token	Replaced with	Example
{{faker.name}}	A first and last name	Maya Patel
{{faker.firstName}}	A first name	Maya
{{faker.lastName}}	A last name	Patel
{{faker.email}}	An address at example.com	liam.kim@example.com
{{faker.phone}}	A phone number	+1-415-732-8841
{{faker.city}}	A city	Lisbon
{{faker.company}}	A company name	Northwind
{{faker.word}}	A single word	nebula
{{faker.color}}	A hex colour	#3B82F6
{{faker.bool}}	true or false	true
{{faker.uuid}}	The same as {{uuid}}

The names of these tokens, and of the id, time and random tokens above, are not case-sensitive: {{UUID}} and {{faker.firstname}} work too.

Each token is filled in separately

Every token in a body gets its own value. Two {{uuid}} tokens give two different ids, and {{faker.name}} and {{faker.email}} in the same body are not related to each other, so the email may not match the name. Values also change on every request.

If the client needs to get back exactly what it sent, use the request tokens ({{params…}}, {{query…}}, {{body…}}) instead of fake data.

Quotes in JSON bodies

A token is replaced with plain text. Whether you put quotes around it decides the JSON type of the result.

You write	Request has	Result
"id": "{{params.id}}"	/users/42	"id": "42" (text)
"id": {{params.id}}	/users/42	"id": 42 (number)
"active": {{faker.bool}}		"active": true
"score": {{randomInt(1,10)}}		"score": 7

Leave the quotes off only when the value will always be a number, true, false or JSON.

Unknown tokens are left as they are

When Mock Studio cannot work out a token, it leaves it in the response exactly as typed, braces included. That way you can see the mistake in the reply instead of getting a silent blank.

A token is left as typed when:

• the name is misspelled, such as {{uuuid}} or {{faker.adress}};
• the request has no such value: {{query.page}} when the URL has no page, or {{body.email}} when the body has no email field;
• the request body is not a JSON object, for any {{body…}} token;
• the prefix is in the wrong case, such as {{Params.id}}.

WARNING

An unquoted token that is left as typed breaks a JSON body. "page": {{query.page}} becomes invalid JSON when the request has no page parameter. Either quote the token, or use conditional rules with Query param page exists to send a different response when it is missing.

To check a body before sending real traffic, select Preview with sample data under the editor, then send a request with the built-in tester and read the Response body in the Live section.

Next steps

• Responses
• Conditional rules
• Quick reference
• Troubleshooting