Public mock hosting

A mock gives your team an HTTP endpoint before the real dependency is ready. Use it for a frontend in progress, a shared demo or deliberate error and delay scenarios. Echo can run a mock locally on the desktop for free or publish it to the public hosting service at mock.gapfy.io on a paid Echo plan. A public hosted mock keeps answering without your desktop running.

Local desktop mocks intercept requests sent by Echo itself; they do not open an HTTP listener for another application.

Choose where the mock runs

• Local desktop: keep requests on your machine while authoring and experimenting. Included in every Echo plan, Free among them.
• Public mock hosting: give another machine a URL it can call directly, even with your desktop closed. Hosting requires a paid Echo plan that includes it. Check the current options in your organization's billing page.
• Inside your .NET application: use Mock.Client or Mock.Server with rules fetched through an application key on a paid Echo plan. This uses the paid rule feed, separately from the public hosted URL; your application keeps its own address.

Publish your first mock

1. Open Mocks in Maestro and select the workspace that owns the mock.
2. Create a server and add a route with an HTTP method, path pattern, status and response. Choose a static response or a contract. You can also start from a mock saved and synced by the desktop.
3. Open the server's public hosting panel and enable hosting. Publishing needs a paid Echo plan. On that plan you can publish a mock in your own space as its owner; publishing a team mock needs the Echo/ManageHosting permission, granted by default to the organization administrator.
4. Copy the exact base URL shown by the panel and append your route path. The host name alone is not a mock endpoint.
5. Call the route from the consuming application and check the response, including X-Echo-Mock.

Contracts let you generate structured responses and keep versions. Static responses are useful when you need an exact body.

An organization on a paid Echo plan can have up to 25 published mock servers at once. This is a hard limit: the 26th publication is refused until you disable hosting for one of the existing servers. The plan also includes 50,000 public mock requests per month per seat. This monthly allowance is measured for usage and alerts; exceeding it does not, by itself, stop the host from serving requests. A separate operational limit of 300 requests per minute can still return 429.

On Echo Free, the public hosting panel still shows your mock's status and explains that the plan does not include public hosting. Enabling hosting and rotating its public identifier are unavailable. Local desktop mocks and contracts remain available. An organization administrator can change the plan in Settings > Billing when public hosting is needed.

Build a useful route

Start with one active route and test it before adding more. For example, create GET /orders/{id} with status 200 and a JSON response. The path parameter captures the final segment; a static response can refer to it as {{path.id}}. Call the base URL copied from Maestro followed by /orders/42. The method and path must match an active route.

Use a static body for an exact example. Choose Contract mode to generate data from a selected contract version. Request path values, query parameters, headers and JSON body can supply inputs to the contract. Use the contract's preview to check the result before publishing.

For a contract that defines scenarios, send X-Echo-Scenario with the scenario name. X-Echo-Seed controls randomized generation for the same contract and inputs, but values based on the current date or time can still change. A scenario name must already exist in the contract. An invalid contract or unknown scenario returns a generation error; the host does not silently replace it with the saved sample body.

You can configure a delay to exercise loading and timeout handling in the consuming application. The hosted service caps delays, and may omit the delay when its concurrent delay capacity is full. Treat this as a functional test tool, not a load-testing service or a timing guarantee.

Response rules

Hosted responses are limited to 2 MiB of UTF-8 content. Incoming request bodies are limited to 1 MiB. Use ordinary JSON or another supported data content type. HTML and other active content require the server's explicit opt-in and are served with browser sandbox restrictions.

Response headers use an allowlist. For your own test metadata, use names beginning with X-Mock-. Headers such as Set-Cookie, Location and WWW-Authenticate are not relayed. The host also supplies its own safety headers. A HEAD call returns the response headers without the body.

Understand a failed call

Usage counts completed authored responses. An unmatched route is tracked separately and does not consume the monthly served-response measurement. This distinction helps explain why the number of attempted calls can differ from the usage shown.

Share deliberately

Anyone who knows the public URL can call its routes. It is not protected by an eck_ application key. Use invented data, keep credentials out of bodies and headers, and share the URL only with its intended audience.

The public hosting panel can disable hosting or rotate the public identifier and issue a new URL. Rotation means updating callers. If a paid plan ends after its grace period, a published mock keeps its URL and public identifier but automatically stops answering: the public host returns 503 mock-server-suspended with Retry-After. Honor the value returned by the service. Restoring a paid plan resumes it without republishing once the host refreshes its rules. A separate suspension set on the mock server needs an operator to lift it; a platform kill switch can expire on its own. Changing the plan alone does not clear either while it is active. Refresh the panel to inspect its current state.

Bring the rules into your application

Applications and keys explains the separate ServeMocks permission used by the paid .NET rule feed. Choose this path when your own application should serve or intercept requests using Echo rules at its own address, rather than calling the public hosted URL.