> For clean Markdown content of this page, append .md to this URL. For the complete documentation index, see https://learning.postman.com/llms.txt.

# View and analyze results

Use the browser and terminal dashboards to review captured traffic, understand how credentials are being used, and export your findings.

## Start the traffic inspector

Run the following command to start the traffic inspector in the background:

```bash
passport lens start
```

For all options, see [`passport lens start`](/docs/postman-passport/passport-cli/lens/#passport-lens-start).

## Route traffic through the proxy

Your tools don't automatically send traffic through the inspector. Setting proxy environment variables tells curl and other HTTP clients to route requests through it so the inspector can capture them.

### Current terminal

To configure your current terminal, run:

```bash
eval "$(passport lens env)"
```

### Future terminals

To configure future terminals automatically, add the following to your shell profile:

**Zsh:**

```bash
echo 'eval "$(passport lens env 2>/dev/null)"' >> ~/.zshrc
```

**Bash:**

```bash
echo 'eval "$(passport lens env 2>/dev/null)"' >> ~/.bashrc
```

For Bash login shells, use `~/.bash_profile` instead of `~/.bashrc`.

New terminals pick this up automatically. To apply the change in your current terminal, run:

```bash
source ~/.zshrc   # or: source ~/.bashrc
```

## Run your tools

With the traffic inspector running, use your AI agents, command-line clients, or scripts as you normally would. The traffic inspector captures every API call they make, recording the destination, client, and any credentials present in each request.

## Open the dashboard

You can view captured traffic in your browser or directly in the terminal.

### In your browser\[#open-browser-dashboard]

The browser dashboard is a live view of captured traffic that opens in your default browser. Run the following command to open it:

```bash
passport lens report
```

For all options, see [`passport lens report`](/docs/postman-passport/passport-cli/lens/#passport-lens-report).

### In the terminal\[#open-terminal-dashboard]

The terminal dashboard is a live, interactive view of captured traffic that runs directly in your terminal. It shows the same findings as the browser dashboard without requiring a browser window.

Run `passport` to open it:

```bash
passport
```

You can customize the display using options such as `--theme`, `--no-animation`, and `--ascii`. For all display options, see [Options](/docs/postman-passport/passport-cli/overview/#options). Once open, you can also adjust settings and navigate using [keyboard shortcuts](#review-terminal-dashboard).

## Review captured traffic

Both dashboards show similar findings. The browser dashboard displays a summary and a searchable findings table. The terminal dashboard shows a live traffic feed alongside system and findings breakdowns.

### In your browser\[#review-browser-dashboard]

The dashboard shows a summary of captured traffic:

* The number of credentials observed.
* The number of unique destinations.
* The number of secret types detected.
* The number of clients observed.
* The date and time of the most recent capture.

The findings table shows each request where a credential was observed, with the following details:

| Column            | Description                                                                                                                     |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------- |
| **Detected at**   | Timestamp when the secret was detected.                                                                                         |
| **Destination**   | The host or endpoint the request was sent to, for example `api.anthropic.com` or `example.com`.                                 |
| **Client**        | The application or user agent that sent the request, for example `claude-code/2.1.212` or `curl/8.7.1`.                         |
| **Type**          | The type of secret detected, for example `x-api-key header` or `Bearer token`.                                                  |
| **Masked secret** | A redacted version of the detected secret. Only a small portion is shown to help identify it while keeping the value protected. |

To filter the table, search by destination, client, type, or masked secret.

To load the latest traffic, click **Refresh**.

To save a copy of your findings, click **Export report** in the upper right of the dashboard.

### In the terminal\[#review-terminal-dashboard]

The terminal dashboard displays the following sections:

**Activity graph** — A graph of findings over time.

**Summary** — The proxied request count, total findings, the most common secret type, and inspector uptime.

**Findings breakdown** — Panels showing finding counts grouped by destination (host), app (client), and detection (secret type).

**System information** — Shows the proxy port, body scanning mode, CA certificate path, daemon PID, and browser report URL.

**Traffic feed** — A live table of captured requests:

| Column       | Description                                              |
| ------------ | -------------------------------------------------------- |
| **Time**     | Timestamp of the request.                                |
| **Method**   | HTTP method, for example `GET`.                          |
| **Host**     | Destination host.                                        |
| **URL**      | Request path.                                            |
| **Status**   | Detection result. Shows `Leaked` when a secret is found. |
| **App**      | Client that made the request, for example `curl/8.7.1`.  |
| **Detector** | Secret type detected, for example `Bearer token`.        |

Use the following keyboard shortcuts to interact with the terminal dashboard:

| Key       | Action                                                 |
| --------- | ------------------------------------------------------ |
| `s`       | Start or stop the traffic inspector.                   |
| `f`       | Toggle findings-only filter.                           |
| `o`       | [Open the browser dashboard](#open-browser-dashboard). |
| `↑` / `↓` | Scroll the traffic feed.                               |
| `w`       | Cycle the time window: 5m, 15m, 30m, or 1h.            |
| `T`       | Cycle the color theme.                                 |
| `?`       | Toggle the help screen.                                |
| `q`       | Quit the terminal dashboard.                           |

## Understand your findings

Reviewing captured traffic gives you visibility into how AI agents and developer tools are using credentials on your local machine:

* **See which APIs your clients are calling** — Get a complete picture of API activity from every agent and client running on your machine. Confirm the destinations and request patterns match what you'd expect.
* **Understand how credentials are being used** — See which credential types appear in requests and which clients are using them. Secrets aren't automatically captured in request bodies. You can use the `--show-body` option to enable request body scanning for more complete coverage.
* **Track credential usage across clients** — Before rotating a secret, use the client and masked secret columns to identify every client and destination currently using it.
* **Review client activity patterns** — The client column shows which clients are active and what they're accessing, giving you a full picture of API activity on your machine.

## Stop the traffic inspector

When you're done, stop the traffic inspector:

```bash
passport lens stop
```

Stopping the inspector doesn't automatically clear the proxy environment variables set by `passport lens env`. Those variables remain active in your shell, and tools like curl will fail trying to route requests through a proxy that's no longer running. Unset them manually after stopping:

```bash
unset HTTP_PROXY HTTPS_PROXY http_proxy https_proxy \
      NODE_EXTRA_CA_CERTS SSL_CERT_FILE \
      REQUESTS_CA_BUNDLE CURL_CA_BUNDLE \
      NO_PROXY no_proxy
```