> For the complete documentation index, see [llms.txt](https://docs.bountysecurity.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bountysecurity.ai/creating-profiles/raw-request.md).

# Raw HTTP requests

Use the request editor for a fixed endpoint or a specific HTTP structure.

Use **Raw Request** in the active profile editor for a fixed diagnostic endpoint or a specific HTTP message structure.

1. Select the step to configure.
2. Change **Request type** from **Original Request** to **Raw Request**.
3. Open the **Raw Request** tab and enter the complete HTTP message.
4. Configure **Response** matching and **Issue** reporting for that step.
5. Click **OK** to save. Pro handles the JSON string and escaping in the `.bb` file.

For example, the request editor can contain:

```http
GET /health HTTP/1.1
Host: {CURRENT_HOST}
Connection: close

```

Include a terminating blank line. In **Response → Grep**, add a precise condition for the expected diagnostic, such as a Simple String row with `example diagnostic marker`. Do not use a generic 200 response as proof of a vulnerability.

## Construct a valid message

The transmitted message needs a request line, CRLF header lines and a terminating blank line. For a body, verify framing and Content-Type. Confirm authentication and other required headers: a raw template does not automatically reproduce every header from the original exchange.

For a non-default port, construct the appropriate Host header. The service/protocol comes from the scan input; a Host header is not an HTTPS selector.

Use only [supported tokens](/creating-profiles/global-variables.md). Earlier documentation listed `{PAYLOAD}` and `{PAYLOAD_URL}` as general raw-request placeholders; they are not a verified shared runtime contract. Do not assume an arbitrary token is substituted or that every payload row creates the intended raw request.

## Scope and portability

Pro's **Once per host** scan scope can reduce repeated fixed-path checks. Standalone Server callers must choose representative requests themselves. MCP confines generated requests to explicit service origins. Raw requests are incompatible with Server's exclusive `$BBOUNTY$` selection because they replace more than the selected span.

Inspect the final request in both engines when distributing a raw-request profile. Confirm path, method, headers, body, dynamic values, redirects and matched response. The exported `requestType` and `rawRequest` fields are described in [the file reference](/creating-profiles/field-reference.md).