> For the complete documentation index, see [llms.txt](https://docs.burpgpt.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.burpgpt.app/analysis-and-prompts/use-placeholder-reference.md).

# Placeholder reference

Look up the placeholders available in scanner prompt templates.

Placeholders insert values from the HTTP exchange into scanner prompts. Open the `BurpGPT Pro` tab and select `Placeholder reference` to search the same list by name or description.

Use the tokens below in `AI scanner` prompts or in library prompts sent to the scanner. Names are case-sensitive. Unrecognised tokens remain unchanged; they are not custom variables. AI Chat does not expand scanner placeholders.

Unavailable response and timing values are empty. Use `{HAS_RESPONSE}` when the prompt needs to distinguish an absent response.

{% hint style="warning" %}
Placeholders insert data as supplied by Burp, without automatic redaction. Complete-message tokens include headers and bodies. Review the data you include; narrower tokens can limit the context sent to your provider.
{% endhint %}

## Complete messages

| Placeholder      | Value                                                     |
| ---------------- | --------------------------------------------------------- |
| `{REQUEST}`      | The complete scanned request.                             |
| `{RESPONSE}`     | The complete scanned response, or empty when unavailable. |
| `{HAS_RESPONSE}` | Whether the scan item has a response.                     |

## Target service

| Placeholder      | Value                                                |
| ---------------- | ---------------------------------------------------- |
| `{URL}`          | The complete request URL.                            |
| `{HTTP_SERVICE}` | The target HTTP service.                             |
| `{SCHEME}`       | The target URL scheme.                               |
| `{HOST}`         | The target hostname or IP address.                   |
| `{PORT}`         | The target port.                                     |
| `{SECURE}`       | Whether the target service uses a secure connection. |
| `{IP_ADDRESS}`   | The target host's dynamically resolved IP address.   |

## Request metadata

| Placeholder              | Value                                                               |
| ------------------------ | ------------------------------------------------------------------- |
| `{METHOD}`               | The HTTP request method.                                            |
| `{PATH}`                 | The request path, including its query string.                       |
| `{PATH_WITHOUT_QUERY}`   | The request path without its query string.                          |
| `{QUERY}`                | The request query string.                                           |
| `{FILE_EXTENSION}`       | The file extension in the request path.                             |
| `{REQUEST_HTTP_VERSION}` | The request HTTP version.                                           |
| `{REQUEST_CONTENT_TYPE}` | The request content type detected by Burp.                          |
| `{REQUEST_HEADERS}`      | The request headers, one per line.                                  |
| `{REQUEST_BODY}`         | The request body.                                                   |
| `{REQUEST_BODY_LENGTH}`  | The request body length in bytes.                                   |
| `{REQUEST_LENGTH}`       | The complete request length in bytes.                               |
| `{REQUEST_BODY_OFFSET}`  | The byte offset at which the request body starts.                   |
| `{REQUEST_PARAMETERS}`   | The request parameters parsed by Burp.                              |
| `{REQUEST_IN_SCOPE}`     | Whether the request URL is in Burp's target scope.                  |
| `{REQUEST_MARKERS}`      | The request marker ranges as start-inclusive/end-exclusive offsets. |

## Response metadata

| Placeholder                     | Value                                                                |
| ------------------------------- | -------------------------------------------------------------------- |
| `{STATUS_CODE}`                 | The response HTTP status code, or empty when unavailable.            |
| `{REASON_PHRASE}`               | The response HTTP reason phrase, or empty when unavailable.          |
| `{RESPONSE_HTTP_VERSION}`       | The response HTTP version, or empty when unavailable.                |
| `{RESPONSE_MIME_TYPE}`          | The response MIME type detected by Burp.                             |
| `{RESPONSE_STATED_MIME_TYPE}`   | The response MIME type stated in its headers.                        |
| `{RESPONSE_INFERRED_MIME_TYPE}` | The response MIME type inferred from its body.                       |
| `{RESPONSE_HEADERS}`            | The response headers, one per line.                                  |
| `{RESPONSE_BODY}`               | The response body, or empty when unavailable.                        |
| `{RESPONSE_BODY_LENGTH}`        | The response body length in bytes, or empty when unavailable.        |
| `{RESPONSE_LENGTH}`             | The complete response length in bytes, or empty when unavailable.    |
| `{RESPONSE_BODY_OFFSET}`        | The byte offset at which the response body starts.                   |
| `{RESPONSE_COOKIES}`            | The cookies set by the response.                                     |
| `{RESPONSE_ATTRIBUTES}`         | The response attributes calculated by Burp.                          |
| `{RESPONSE_MARKERS}`            | The response marker ranges as start-inclusive/end-exclusive offsets. |

## Burp metadata

| Placeholder              | Value                                                                  |
| ------------------------ | ---------------------------------------------------------------------- |
| `{ANNOTATION_NOTES}`     | The notes attached to the scan item.                                   |
| `{ANNOTATION_HIGHLIGHT}` | The highlight colour attached to the scan item.                        |
| `{REQUEST_SENT_AT}`      | The time at which Burp sent the request.                               |
| `{TIME_TO_FIRST_BYTE}`   | The duration from sending the request to receiving the response start. |
| `{TOTAL_RESPONSE_TIME}`  | The duration from sending the request to receiving the response end.   |

## Example

```
Review this exchange for security weaknesses. Separate observations from
hypotheses, cite supporting evidence, and suggest a validation step.

Method: {METHOD}
URL: {URL}
Response available: {HAS_RESPONSE}

Request:
{REQUEST}

Response:
{RESPONSE}
```

Use narrower placeholders when you only need part of the exchange. For example, `{REQUEST_HEADERS}` and `{RESPONSE_HEADERS}` avoid sending bodies when reviewing header configuration.