---
title: Configure AjaxRequest events
source: https://docs.newrelic.com/docs/browser/new-relic-browser/configuration/configure-ajax-request-events
---

In [agent version 1211](https://docs.newrelic.com/docs/release-notes/new-relic-browser-release-notes/browser-agent-release-notes/browser-agent-v1211/) or higher, all network requests made by a page are recorded as `AjaxRequest` events. You can configure which requests are recorded and what data is captured:

-   **[Deny list](#deny-list)**: Filter which domains and URLs are excluded from AJAX tracking
-   **[Payload capture](#enable-payload-capture)**: Record full request and response data for debugging failures

## Deny list [#deny-list]

By default, we record `AjaxRequest` events for all network requests made by your application.

-   To stop recording all events, add a singular `*` (asterisk) wildcard character.
    -   Example: `*`
-   To stop recording events for a full site, add the domain name.
    -   Example: `mywebsite.com`
-   To stop recording events for a specific page, add the domain and path.
    -   Example: `mywebsite.com/photos`
-   Starting with [agent version 1.307.0](https://docs.newrelic.com/docs/release-notes/new-relic-browser-release-notes/browser-agent-release-notes/browser-agent-v1.307.0/), anywhere we find an `*` (asterisk), we’ll match any length of string.
    -   Example: `mywebsite.com/shop/*` (for a path), `*.mywebsite.com` (for a subdomain), `mywebsite.com/*/shop/*/checkout` (for mid-URL strings).

The protocol, port, search, and hash of a URL are ignored by the deny list.

### Access the deny list [#access-deny-list]

To update the deny list of URLs your application will filter from creating events, go to the app settings page:

1.  Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Browser > (select an app) > Settings > Application settings**.
2.  Under the **AJAX data capture settings** section, in the **Deny list** field, add the filters you would like to apply to your app.
3.  Select **Save** to update the agent configuration.
4.  [Redeploy the browser agent](https://docs.newrelic.com/docs/browser/new-relic-browser/installation/upgrade-browser-agent) (either restarting the associated APM agent or updating the copy/paste browser installation).

> #### ⚠️ IMPORTANT
>
> Saving changes here only updates the `NREUM.init` configuration shown on the **Application settings** page. It doesn't take effect automatically for agents installed via NPM.
>
> If you installed the browser agent using the [NPM package](https://www.npmjs.com/package/@newrelic/browser-agent), you must manually update the `ajax.deny_list` value in your application's `init` configuration (or re-copy it over from the UI), then rebuild and redeploy your application for the change to take effect.

### Validate deny list filters [#validation]

To validate whether the filters you have added work as expected, run a NRQL query for `AjaxRequest` events matching your filter.

```sql
FROM AjaxRequest SELECT * WHERE requestUrl LIKE '%example.com%'
```

## Payload capture data [#payload-capture]

> #### ⚠️ IMPORTANT
>
> Payload capture requires browser agent version [1.317.0](https://docs.newrelic.com/docs/release-notes/new-relic-browser-release-notes/browser-agent-release-notes) or higher.

You can enable payload capture for all requests or only for failed requests. When enabled, the browser agent captures the request and response payloads for all AJAX calls for all the allowed domains. This is useful for debugging failures that aren't visible from metadata alone, such as errors hidden in response bodies.

When you enable AJAX payload capture, the browser agent adds the following attributes to `AjaxRequest` events:

-   `requestBody`: The request payload.
-   `requestHeaders`: Request headers as JSON.
-   `requestQuery`: URL query parameters as JSON.
-   `responseBody`: The response payload.
-   `responseHeaders`: Response headers as JSON.
-   `ajaxRequest.id`: Unique identifier for each AJAX request.

    All payload data attributes are truncated at 4096 bytes. When truncation occurs, the last 4 bytes are replaced with ` ...` to indicate that the content was cut off.

### Enable payload capture [#enable-payload-capture]

You can enable payload capture using one of the following methods:

**Enable via New Relic platform**

To enable payload capture:

1.  Go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Browser > (select an app) > Settings > Application settings**.
2.  In the **AJAX data capture settings** section, enable the **Capture payload for allowed domains** toggle, then select the capture mode:

    -   **Capture only failure responses**: Captures payloads only for requests with a status code of `0`, a code of `400` or higher, or a GraphQL error signature in the `response body`.
    -   **Capture all responses**: Captures payloads for all requests, including successful ones. Use this to debug failures hidden in response bodies, such as GraphQL errors returned with a successful status.

        > #### ⚠️ IMPORTANT
        >
        > Enabling payload capture for **Capture all responses** requests can increase your data ingest. Use **Capture only failure responses** mode unless you specifically need to capture successful responses.
3.  Click **Save** to apply the changes.

**Configure via NerdGraph**

You can use the [NerdGraph API to query and update](https://docs.newrelic.com/docs/apis/nerdgraph/examples/browser-monitoring-config-nerdgraph/#configure-payload-capture) the payload capture setting.

The following values are available for the `capture_payloads` setting:

-   `"none"`: Does not capture any payload data. This is the default setting.
-   `"failures"`: Captures payloads only for requests with a status code of `0`, a code of `400` or higher, or a GraphQL error signature in the `response body`.
-   `"all"`: Captures payload data for all requests, regardless of status code.

**Configure via JavaScript**

If you're using the copy/paste or NPM installation method, you can configure payload capture directly in your JavaScript configuration.

#### Copy/paste installation

Add the `ajax.capture_payloads` setting to your browser configuration before the agent loader:

```js
window.NREUM.init = {
    ...<other init properties>...,
    ajax: {
      deny_list: ["bam.nr-data.net"],
      capture_payloads: 'failures' // or 'none', 'all'
    }
}
```

#### NPM installation

Add the `ajax.capture_payloads` setting when initializing the browser agent:

```js
import { BrowserAgent } from '@newrelic/browser-agent/loaders/browser-agent'

const options = {
  init: {
    ...<other init properties>...,
    ajax: {
      deny_list: ["bam.nr-data.net"],
      capture_payloads: 'failures' // or 'none', 'all'
    }
  },
  info: { ... },
  loader_config: { ... }
}

new BrowserAgent(options)
```

#### Capture modes

The following values are available for the `capture_payloads` setting:

-   `"none"`: Does not capture any payload data. This is the default setting.
-   `"failures"`: Captures payloads only for requests with a status code of `0`, a code of `400` or higher, or a GraphQL error signature in the `response body`.
-   `"all"`: Captures payload data for all requests, regardless of status code.

When you enable payload capture for the first time, New Relic automatically adds baseline obfuscation rules to protect common sensitive data:

-   [**Credit card numbers**](https://docs.newrelic.com/docs/browser/new-relic-browser/configuration/obfuscate-browser-agent-data/#ccn): Detects and masks major credit card formats (Visa, MasterCard, American Express, Discover, etc.)
-   [**Social Security numbers**](https://docs.newrelic.com/docs/browser/new-relic-browser/configuration/obfuscate-browser-agent-data/#ssn): Detects and masks SSN patterns

You can configure obfuscation rules in the New Relic platform to mask sensitive data before it's sent to New Relic. For more details on obfuscation rules, see [Obfuscate browser agent data](https://docs.newrelic.com/docs/browser/new-relic-browser/configuration/obfuscate-browser-agent-data).

After you enable the payload capture setting, you can view the captured payload data at the following pages:

-   [AJAX request details](https://docs.newrelic.com/docs/browser/browser-monitoring/browser-pro-features/ajax-page-identify-time-consuming-calls)
-   [Page view](https://docs.newrelic.com/docs/browser/new-relic-browser/browser-pro-features/page-views-examine-page-performance)
-   [Session replay](https://docs.newrelic.com/docs/browser/browser-monitoring/browser-pro-features/session-replay/get-started)

### How payload capture interacts with the deny list [#payload-deny-list]

Payload capture respects your existing deny list. For any AJAX request:

-   If the URL is on the deny list, the event is dropped entirely and no metadata or payload is captured.
-   If the URL isn't on the deny list, based on your capture payload settings, the agent captures the request and response payloads and applies obfuscation rules before sending the data to New Relic.

## Related documentation [#related-docs]

[Create obfuscation rules](https://docs.newrelic.com/docs/browser/new-relic-browser/configuration/obfuscate-browser-agent-data/)

Learn how to create obfuscation rules to protect sensitive data.

[Browser agent NerdGraph APIs](https://docs.newrelic.com/docs/apis/nerdgraph/examples/browser-monitoring-config-nerdgraph/)

Learn about using the NerdGraph APIs for New Relic browser agent.

[Troubleshooting AJAX data collection](https://docs.newrelic.com/docs/browser/new-relic-browser/troubleshooting/troubleshoot-ajax-data-collection/)

Learn how to troubleshoot issues with AJAX data collection.