Masking API

Base path: /v1/masking Auth: API key — see Authentication. Entitlement: entitlement.masking_pseudonymization (Guardian editions and above).

Reversible tokenization that sits between detectors (prompt-DLP, MCP rule violations, classifiers) and the trust boundary of an LLM or upstream MCP tool. Matched fragments are substituted with opaque, deterministic tokens (<TRT::pii_email::A3F9C0>) before they cross the boundary, and unmasked on the way back. See the Reversible Masking product page.

Token wire format

<TRT::category::short_id>

category is the detector family (pii_email, secret_token, financial_account, phi, …); short_id is a deterministic base62 suffix. The token is stable for the same source fragment within a flow, so models reason about the same identifier across turns.

Endpoints

GET /v1/masking/policy — masking:read

Returns the active masking policy (categories enabled, detector thresholds, per-category token formats).

PUT /v1/masking/policy — masking:write

Upsert the active policy. A change invalidates the in-flight manifest cache.

DELETE /v1/masking/policy — masking:write

Reset to the platform default policy.

GET /v1/masking/policy/default — masking:read

Returns the platform default (read-only reference).

GET /v1/masking/flows/:flowId/manifest — masking:read

The hash-only manifest for a flow — token → original-content-hash mappings, never the cleartext. This is what you ship to an auditor or store long-term; the cleartext lives only in the short-lived reversible cache keyed by flowId.

DELETE /v1/masking/flows/:flowId — masking:write

Crypto-shred a flow — purge the reversible cache entry. After this call, the tokens in any persisted transcript are permanently non-invertible (the manifest's hashes still verify, but no entity can unmask). This is the right-to-be-forgotten primitive.

Integration surfaces

Masking is invoked automatically on three paths — you don't call these endpoints directly:

• LLM Proxy (Chat & Responses API) — masks prompts/responses in flight.
• MCP tool-call path — masks tool inputs/outputs at the boundary.
• Deterministic Inference Receipts (DLIR) — the receipt records the masked form; the manifest is cross-linked by flowId.

See the Reversible Masking architecture for the bidirectional hook diagram.

Errors

HTTP	error.code	When
402	entitlement_missing	Org lacks entitlement.masking_pseudonymization.
404	not_found	flowId not in the reversible cache (already shredded or expired).
409	conflict	Policy upsert races an in-flight manifest build.

v2 plans. Streaming-aware egress unmask, public POST /v1/masking/flows/:flowId/unmask, TEE-backed cache substrate, and format-preserving encryption (FPE) are planned for a later pass.

---

→ Reversible Masking — the product overview. → Errors, rate limits & conventions — shared contract.