Comment by mhio

Yeah...

    [Captures]
    csrf_token: xpath "normalize-space(//meta[@name='_csrf_token']/@content)"

The use the name with mustaches

    {{csrf_token}}

- https://hurl.dev/docs/capturing-response.html