A few ideas show up everywhere in Busymate DevTools. Once these click, the rest of the docs read quickly.
Devices
A device is any capture client paired to your account — an iPhone running the iOS app, a machine running the proxy server, or a Chrome instance captured by bmc. Each device has a stable UUID, a name you can change, and a live status (online/offline, connection type, country). You see and control your devices on the Devices page.
Heads up: Everything in Busymate is keyed by device UUID, not name — so renaming a device never breaks its history or its feed.
Entries and the feed
Every captured request/response pair is an entry. Entries stream into the feed in real time, newest first, and you can search them by host or path, split them by device, and open any one to inspect the full headers and decrypted body. Entries are retained for a window you control per workspace (30 days by default).
What gets decrypted
HTTPS is encrypted end to end, so to read the bodies a capture client has to sit in the middle and re-sign traffic with a certificate you trust. That's why the iOS app and proxy server ask you to install and trust a Root CA — and why bmc doesn't (Chrome hands it already-decrypted traffic over the DevTools Protocol).
Decryption is opt-in per domain. You list the domains you want to decrypt (wildcards like *.example.com work); everything else passes through untouched. This keeps noise down and avoids decrypting things you don't care about. See What gets decrypted (iOS) or the proxy equivalent.
Connection modes (iOS)
The iOS app captures one of two ways: a system VPN tunnel, or a Wi-Fi PAC proxy. VPN captures everything on the device; PAC routes traffic through a per-device proxy port and survives backgrounding well. You choose per device. Full comparison: VPN vs PAC.
Organizing: service groups, tags, workspaces
As traffic piles up you'll want structure:
- Service groups bundle related domains under a name (e.g. "Checkout API"). They double as decryption bundles and as one-click filters.
- Tags auto-label entries that match a URL pattern, with a color.
- Workspaces and tabs save a filtered view — a device selection, a search, a set of filters — so you can jump back to it. Each workspace has its own retention window.
See Service groups & tags and Workspaces & tabs.
Settings flow to your devices
You don't configure devices on the device — you configure them from the dashboard, and the settings are pushed in real time. Settings exist at three levels that merge into one effective config:
A per-device setting overrides (or adds to) the global default. This covers the decryption list, breakpoint patterns, paused domains, the external proxy, and environment variables. Read Remote settings & env.
Permissions
Access is capability-based. Built-in roles are admin (everything) and viewer (your own devices). Custom roles grant view/edit on specific sections (devices, services, tags, users, and more). The same rules are enforced in the database, so they apply to the dashboard, the API, and BusyBro alike. See Roles & permissions.
One token, three APIs
For automation, everything the dashboard can do is available over an API, all authenticated by a single OAuth token: the MCP server (for AI agents), REST (read/write your data), and Realtime (live changes + device control). BusyBro uses exactly these same tools under the hood, scoped to your permissions.