The CLI offers a convenient way to record stubs from endpoints that are accessible from the computer running the CLI, but not accessible from the internet. Run:

wiremock record http://private-endpoint --to=cloud:<mock_api_id>

where <mock_api_id> is the ID of the Mock API that should receive the recorded stubs. At present you can get that value by browsing into a Mock API at https://app.wiremock.cloud and extracting it from the URL - for instance in the URL https://app.wiremock.cloud/mock-apis/33eye3l9/stubs/1e0d7dc0-06a0-49a2-81a7-f5d6a40bfa3d, the ID is 33eye3l9 so you should record as so:

wiremock record http://private-endpoint --to=cloud:33eye3l9

This will be made easier in future versions!

The CLI will then run a proxy server bound to http://localhost:8000. Requests to this endpoint will be proxied to the endpoint you want to record from. When you have finished the journey you want to record, press <enter> to save the stubs to your Mock API in WireMock Cloud and the CLI will exit.

You can specify the port the server should listen on using -p or --reverse-proxy-port:

wiremock record http://private-endpoint --to=cloud:33eye3l9 \
  --reverse-proxy-port=8080

​
Recording with Mutual TLS

If you need to record from an API that authenticates clients with mutual TLS, the CLI can present your private client certificate in one of two ways:

​
Via a PEM file

If you have a file containing a PEM encoded RSA private key and X509 certificate, you can provide it as so:

wiremock record http://mutual-tls-endpoint --to=cloud:33eye3l9 \
  --client-certificate=/path/to/file.pem

A PEM encoded file should look something like this:

-----BEGIN PRIVATE KEY-----
MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDHIpsyRDeM1lFQ
<multiple lines of base64 encoded data>
GhxuZ3ceXiqwvhH8Yt5gNs0=
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIDrzCCApegAwIBAgIUR24W6NZN7xPwSqc59usFQ37HPYswDQYJKoZIhvcNAQEL
<multiple lines of base64 encoded data>
dHhXPaefkEhrsUbnXGYRfwQhf4SzdYCMCJno7KKsNn6RLIo=
-----END CERTIFICATE-----

​
Using a PKCS 12 certificate store

Keeping a private key in PEM format is a security risk, so we also support supplying your client certificate in a password protected PKCS 12 store as so:

wiremock record http://mutual-tls-endpoint --to=cloud:33eye3l9 \
  --client-certificate-store=/path/to/file.pkcs12

You will be challenged for a password to decrypt the store and the private key. The same password must be able to decrypt both.