Redactions API

List, create, update and delete the redaction rules that remove card numbers, tokens and other sensitive data from captured requests before they are stored.

This page as Markdown

A redaction rule finds sensitive data in captured requests (card numbers, email addresses, an Authorization header) and replaces it before it is stored. Rules apply to the buckets, environments and parts of the request you choose, and run either in your application (client) or when ApiTraffic receives the request (server). See Redactions for how to choose and test rules in the app.

Permissions: any member can list and read rules. Creating, changing and deleting a rule needs an owner or admin, or an administrator API token. Limit: the number of rules an account can create depends on its plan.

Connected SDKs receive rule changes without a restart.

The redaction object

sid (string, required): The rule’s identifier (red_ followed by 27 letters and digits).
accountSid (string, required): The account.
description (string | null): A short description.
type (string, required): A predefined type such as creditCard, or custom.
pattern (string | null, required): For custom rules, the key name or regular expression to look for. Empty for predefined types.
applyTo (string | null, required): For custom rules: key matches JSON or XML keys and header names, and redacts their values; value matches anywhere in the data and redacts what matches. Empty for predefined types.
level (string, required): How matches are replaced. See Redaction levels.
scopes (string[], required): Where to look: request.header, request.body, request.query, response.header, response.body, or ["*"] for everywhere.
buckets (string[], required): The buckets the rule applies to, or ["*"] for all.
environments (string[], required): The environments the rule applies to, or ["*"] for all.
redactAt (string, required): client: your SDK removes the data before it leaves your servers. server: ApiTraffic removes it when the request arrives.
enabled (boolean, required): Whether the rule is active.
createdAt (string, required): When the rule was created (ISO 8601).
updatedAt (string | null): When it was last changed.
deletedAt (string | null): null for an existing rule.

List redactions

GET https://api.apitraffic.io/v1/accounts/{accountSid}/redactions

Returns every redaction rule in the account.

Path parameters

accountSid (path, string, required): The account identifier.

Response

hasMore (boolean, required): Always false: every rule is returned in one response.
records (object[], required): The rules, as redaction objects.

bash

curl https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/redactions \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN"

const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const response = await fetch(`https://api.apitraffic.io/v1/accounts/${accountSid}/redactions`, {
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` },
});
const { records } = await response.json();

json

{
  "hasMore": false,
  "records": [
    {
      "sid": "red_2qW8eR4tY6uI1oP3aS5dF7gH9jK",
      "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
      "description": "Card numbers",
      "buckets": ["*"],
      "scopes": ["*"],
      "pattern": "",
      "type": "creditCard",
      "redactAt": "client",
      "level": "mask",
      "applyTo": "",
      "environments": ["*"],
      "enabled": true,
      "createdAt": "2026-03-02T16:00:00.000Z",
      "updatedAt": null,
      "deletedAt": null
    },
    {
      "sid": "red_2yU4iO6pA8sD1fG3hJ5kL7zX9cV",
      "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
      "description": "Authorization header",
      "buckets": ["*"],
      "scopes": ["request.header"],
      "pattern": "authorization",
      "type": "custom",
      "redactAt": "client",
      "level": "full",
      "applyTo": "key",
      "environments": ["*"],
      "enabled": true,
      "createdAt": "2026-03-02T16:01:00.000Z",
      "updatedAt": null,
      "deletedAt": null
    }
  ]
}

Get redaction

GET https://api.apitraffic.io/v1/accounts/{accountSid}/redactions/{redactionSid}

Returns one redaction rule.

Path parameters

accountSid (path, string, required): The account identifier.
redactionSid (path, string, required): The rule’s identifier (red_…).

Response

A redaction object.

bash

curl https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/redactions/red_2qW8eR4tY6uI1oP3aS5dF7gH9jK \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN"

const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const redactionSid = 'red_2qW8eR4tY6uI1oP3aS5dF7gH9jK';
const response = await fetch(
  `https://api.apitraffic.io/v1/accounts/${accountSid}/redactions/${redactionSid}`,
  { headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` } },
);
const rule = await response.json();

json

{
  "sid": "red_2qW8eR4tY6uI1oP3aS5dF7gH9jK",
  "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
  "description": "Card numbers",
  "buckets": ["*"],
  "scopes": ["*"],
  "pattern": "",
  "type": "creditCard",
  "redactAt": "client",
  "level": "mask",
  "applyTo": "",
  "environments": ["*"],
  "enabled": true,
  "createdAt": "2026-03-02T16:00:00.000Z",
  "updatedAt": null,
  "deletedAt": null
}

List redaction options

GET https://api.apitraffic.io/v1/redactions

Returns the predefined redaction types, with their names and patterns, and the scopes a rule can use. Use it to build a rule editor or to check a type’s id.

Response

redactions (object[], required): The predefined types: id (use it as type), name and pattern.
scopes (object[], required): The scopes, each with id and name.

bash

curl https://api.apitraffic.io/v1/redactions \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN"

const response = await fetch('https://api.apitraffic.io/v1/redactions', {
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` },
});
const { redactions, scopes } = await response.json();

json

{
  "redactions": [
    { "id": "creditCard", "name": "Credit Card", "pattern": "…" },
    { "id": "email", "name": "Email", "pattern": "…" }
  ],
  "scopes": [
    { "id": "request", "name": "Request" },
    { "id": "request.header", "name": "Request Header" },
    { "id": "request.body", "name": "Request Body" },
    { "id": "request.query", "name": "Request Query String" },
    { "id": "response", "name": "Response" },
    { "id": "response.header", "name": "Response Header" },
    { "id": "response.body", "name": "Response Body" }
  ]
}

The example shortens the type list and the patterns.

Create redaction

POST https://api.apitraffic.io/v1/accounts/{accountSid}/redactions

Creates a redaction rule.

Permissions: owner or admin, or an administrator API token. Limit: past the plan’s rule limit, the API answers 409 with code 2213.

Path parameters

accountSid (path, string, required): The account identifier.

Body parameters

type (body, string, required): A predefined type, or custom.
level (body, string, required): full, mask or partial. See Redaction levels.
redactAt (body, string, required): client or server.
enabled (body, boolean, required): Whether the rule is active.
pattern (body, string | null, required): For custom: a key name (with applyTo: "key") or a regular expression (with applyTo: "value"). Up to 512 characters; it must compile and must not be able to backtrack catastrophically, because it runs on every captured request. For predefined types send ""; it is ignored.
applyTo (body, string | null, required): For custom: key or value. For predefined types send "".
scopes (body, string[]): Where to look: any of request.header, request.body, request.query, response.header, response.body, or ["*"] for everywhere.
buckets (body, string[]): Bucket sids, or ["*"] for every bucket.
environments (body, string[]): Environment sids, or ["*"] for every environment.
description (body, string | null): A short description.

Response

The new redaction object.

bash

curl -X POST https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/redactions \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "Customer email addresses",
    "type": "email",
    "level": "partial",
    "redactAt": "client",
    "enabled": true,
    "pattern": "",
    "applyTo": "",
    "scopes": ["request.body", "response.body"],
    "buckets": ["k3m9p2x"],
    "environments": ["*"]
  }'

const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const response = await fetch(`https://api.apitraffic.io/v1/accounts/${accountSid}/redactions`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    description: 'Customer email addresses',
    type: 'email',
    level: 'partial',
    redactAt: 'client',
    enabled: true,
    pattern: '',
    applyTo: '',
    scopes: ['request.body', 'response.body'],
    buckets: ['k3m9p2x'],
    environments: ['*'],
  }),
});
const rule = await response.json();

json

{
  "sid": "red_2gH4jK6lZ8xC1vB3nM5qW7eR9tY",
  "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
  "description": "Customer email addresses",
  "buckets": ["k3m9p2x"],
  "scopes": ["request.body", "response.body"],
  "pattern": "",
  "type": "email",
  "redactAt": "client",
  "level": "partial",
  "applyTo": "",
  "environments": ["*"],
  "enabled": true,
  "createdAt": "2026-10-20T09:30:00.000Z",
  "updatedAt": null,
  "deletedAt": null
}

Update redaction

PUT https://api.apitraffic.io/v1/accounts/{accountSid}/redactions/{redactionSid}

Replaces a redaction rule. Send the whole rule, with the same fields and rules as Create redaction. To pause a rule, send it with enabled: false.

Permissions: owner or admin, or an administrator API token.

Path parameters

accountSid (path, string, required): The account identifier.
redactionSid (path, string, required): The rule’s identifier.

Body parameters

The same as Create redaction: type, level, redactAt, enabled, pattern and applyTo are required; scopes, buckets, environments and description are optional.

Response

The updated redaction object.

bash

curl -X PUT https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/redactions/red_2yU4iO6pA8sD1fG3hJ5kL7zX9cV \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "Authorization header",
    "type": "custom",
    "pattern": "authorization",
    "applyTo": "key",
    "level": "full",
    "redactAt": "client",
    "enabled": false,
    "scopes": ["request.header"],
    "buckets": ["*"],
    "environments": ["*"]
  }'

const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const redactionSid = 'red_2yU4iO6pA8sD1fG3hJ5kL7zX9cV';
const response = await fetch(
  `https://api.apitraffic.io/v1/accounts/${accountSid}/redactions/${redactionSid}`,
  {
    method: 'PUT',
    headers: {
      Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      description: 'Authorization header',
      type: 'custom',
      pattern: 'authorization',
      applyTo: 'key',
      level: 'full',
      redactAt: 'client',
      enabled: false,
      scopes: ['request.header'],
      buckets: ['*'],
      environments: ['*'],
    }),
  },
);
const rule = await response.json();

json

{
  "sid": "red_2yU4iO6pA8sD1fG3hJ5kL7zX9cV",
  "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
  "description": "Authorization header",
  "buckets": ["*"],
  "scopes": ["request.header"],
  "pattern": "authorization",
  "type": "custom",
  "redactAt": "client",
  "level": "full",
  "applyTo": "key",
  "environments": ["*"],
  "enabled": false,
  "createdAt": "2026-03-02T16:01:00.000Z",
  "updatedAt": "2026-10-20T09:35:00.000Z",
  "deletedAt": null
}

Delete redaction

DELETE https://api.apitraffic.io/v1/accounts/{accountSid}/redactions/{redactionSid}

Deletes a redaction rule. Requests captured from then on are no longer redacted by it; requests already stored stay as they were stored.

Permissions: owner or admin, or an administrator API token.

Path parameters

accountSid (path, string, required): The account identifier.
redactionSid (path, string, required): The rule’s identifier.

Response

sid (string, required): The deleted rule’s identifier.
deleted (boolean, required): true.

bash

curl -X DELETE https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/redactions/red_2gH4jK6lZ8xC1vB3nM5qW7eR9tY \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN"

const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const redactionSid = 'red_2gH4jK6lZ8xC1vB3nM5qW7eR9tY';
await fetch(`https://api.apitraffic.io/v1/accounts/${accountSid}/redactions/${redactionSid}`, {
  method: 'DELETE',
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` },
});

json

{
  "sid": "red_2gH4jK6lZ8xC1vB3nM5qW7eR9tY",
  "deleted": true
}

Predefined redaction types

Use one of these ids as type to redact common data without writing a pattern:

`type`	Finds
`creditCard`	Credit card numbers
`email`	Email addresses
`phone`	Phone numbers
`ssn`	US Social Security numbers
`driversLicense`	US driver’s license numbers
`ipV4`	IPv4 addresses
`geographic`	Geographic coordinates
`birthday`	Birthdays
`vin`	Vehicle identification numbers
`aadhar`	Aadhaar numbers
`brazilCPF`	Brazilian CPF numbers
`jwt`	JSON Web Tokens
`custom`	Your own key name or regular expression, set in `pattern` and `applyTo`

Redaction levels

`level`	Replaces a match with	Example for `4111111111111111`
`full`	`[REDACTED]`	`[REDACTED]`
`mask`	One `*` per character, so the length stays visible	`****************`
`partial`	The first and last three characters around `...` (first and last one for values of 3 to 6 characters; a mask for shorter values)	`411...111`

Errors

Status	Code	Meaning
`400`	`1000`	A field is missing or invalid. For `custom` rules this includes a pattern that does not compile, is longer than 512 characters or can backtrack catastrophically; the message starts with `pattern:` and says why.
`403`	`2010`	Creating, changing or deleting a rule without owner, admin or `administrator` access.
`404`	`4000`	No rule with that `redactionSid` in this account.
`409`	`2213`	The plan’s redaction rule limit is reached.

Redactions: Choose and test redaction rules in the app.
Exclusions API: Stop some traffic from being captured at all.

Redactions API

The redaction object #

List redactions #

Path parameters #

Response #

Get redaction #

Path parameters #

Response #

List redaction options #

Response #

Create redaction #

Path parameters #

Body parameters #

Response #

Update redaction #

Path parameters #

Body parameters #

Response #

Delete redaction #

Path parameters #

Response #

Predefined redaction types #

Redaction levels #

Errors #

Related #

The redaction object

List redactions

Path parameters

Response

Get redaction

Path parameters

Response

List redaction options

Response

Create redaction

Path parameters

Body parameters

Response

Update redaction

Path parameters

Body parameters

Response

Delete redaction

Path parameters

Response

Predefined redaction types

Redaction levels

Errors

Related