# Request variables

> The variables a test can write in double braces, what each resolves to, where they work, and which fields do not take them.

A test often has to send something different each time: a fresh idempotency key, the
current time, a unique order id. Write a variable in double braces and each attempt fills it
in. Variables work in an HTTP test's URL, header values, and body, and in an MCP test's
URL and tool arguments.

## The variables

| Variable | Value |
| --- | --- |
| `{{uuid}}` | a random UUID |
| `{{now}}` | the current time, ISO 8601 in UTC |
| `{{date}}` | today's date in UTC, `YYYY-MM-DD` |
| `{{timestamp}}` | Unix time in seconds |
| `{{timestampMs}}` | Unix time in milliseconds |
| `{{timestampNs}}` | Unix time in nanoseconds |
| `{{randomInt}}` | a random integer from 0 to 1000, inclusive |
| `{{traceId}}` | the run's trace id (see below) |

## When a variable is filled in

A variable has one value per attempt, so `{{uuid}}` in a header and in the body are the
same UUID, and a retry gets fresh values. The exception is `{{traceId}}`, which stays the
same across a run's retries: it is the run's W3C trace id, the same one Fixter sends in
its `traceparent` header (see [the run detail](/api-testing/runs-and-uptime/#what-a-run-records)).
For example, this body creates a distinct order on every attempt:

```json
{ "orderId": "probe-{{uuid}}", "placedAt": "{{now}}" }
```

Names are case-sensitive, and spaces inside the braces are allowed: `{{ now }}` is the same
as `{{now}}`. A name that is not in the table, or a `{{` that is never closed, is sent
exactly as written. To send the literal text `{{now}}`, write `\{{now}}` in the field.

:::caution[Secrets in the body or in a custom header are recorded as sent]
The run detail keeps the request that was sent. It redacts the headers `Authorization`,
`Proxy-Authorization`, `Cookie`, `X-Api-Key` and `Api-Key`, and everything a
[stored credential](/api-testing/credentials/) adds. It does not redact the request body or a
custom header you typed yourself, such as `X-My-Token`. Put secrets in a credential, not in the
body or in a header of your own naming.
:::

## In an MCP test

On a `Tool call` test, the `Tool arguments (JSON)` field (`toolArgumentsJson`) takes the
same variables as the URL. These arguments send a new query id on every attempt:

```json
{ "query": "{{uuid}}", "since": "{{date}}" }
```

## Fields that do not take variables

These fields are sent or compared exactly as written; a `{{` in them is not replaced:

- The HTTP method.
- HTTP header names. Header values do take variables.
- The JSON sample you paste for `JSON_CONTAINS`, `JSON_SHAPE` or `EXACT_MATCH`. The response
  is compared to it after the request; it is never sent, so a `{{uuid}}` in it stays the literal
  text. Under `EXACT_MATCH` that text never equals a real id; under the other two tiers values
  are ignored anyway.
- The MCP tool name.
- The MCP expected tools.