# Redactions API

> List, create, update and delete the redaction rules that remove card numbers, tokens and other sensitive data from captured requests before they are stored.

Source: https://www.apitraffic.io/docs/api-reference/redactions

A redaction rule finds sensitive data in captured requests (card numbers, email addresses, an `Authorization` header) and replaces it before it is stored. Rules apply to the buckets, environments and parts of the request you choose, and run either in your application (`client`) or when ApiTraffic receives the request (`server`). See [Redactions](https://www.apitraffic.io/docs/data/redactions) for how to choose and test rules in the app.

**Permissions:** any member can list and read rules. Creating, changing and deleting a rule needs an owner or admin, or an `administrator` API token. **Limit:** the number of rules an account can create depends on its plan.

Connected SDKs receive rule changes without a restart.

## The redaction object

- **sid (string, required)**:
  The rule's identifier (`red_` followed by 27 letters and digits).

- **accountSid (string, required)**:
  The account.

- **description (string | null)**:
  A short description.

- **type (string, required)**:
  A [predefined type](#predefined-redaction-types) such as `creditCard`, or `custom`.

- **pattern (string | null, required)**:
  For `custom` rules, the key name or regular expression to look for. Empty for predefined types.

- **applyTo (string | null, required)**:
  For `custom` rules: `key` matches JSON or XML keys and header names, and redacts their values; `value` matches anywhere in the data and redacts what matches. Empty for predefined types.

- **level (string, required)**:
  How matches are replaced. See [Redaction levels](#redaction-levels).

- **scopes (string[], required)**:
  Where to look: `request.header`, `request.body`, `request.query`, `response.header`, `response.body`, or `["*"]` for everywhere.

- **buckets (string[], required)**:
  The buckets the rule applies to, or `["*"]` for all.

- **environments (string[], required)**:
  The environments the rule applies to, or `["*"]` for all.

- **redactAt (string, required)**:
  `client`: your SDK removes the data before it leaves your servers. `server`: ApiTraffic removes it when the request arrives.

- **enabled (boolean, required)**:
  Whether the rule is active.

- **createdAt (string, required)**:
  When the rule was created (ISO 8601).

- **updatedAt (string | null)**:
  When it was last changed.

- **deletedAt (string | null)**:
  `null` for an existing rule.

## List redactions

`GET https://api.apitraffic.io/v1/accounts/{accountSid}/redactions`

Returns every redaction rule in the account.

### Path parameters

- **accountSid (path, string, required)**:
  The account identifier.

### Response

- **hasMore (boolean, required)**:
  Always `false`: every rule is returned in one response.

- **records (object[], required)**:
  The rules, as [redaction objects](#the-redaction-object).

```bash cURL
curl https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/redactions \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN"
```

```js Node.js
const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const response = await fetch(`https://api.apitraffic.io/v1/accounts/${accountSid}/redactions`, {
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` },
});
const { records } = await response.json();
```

```json 200
{
  "hasMore": false,
  "records": [
    {
      "sid": "red_2qW8eR4tY6uI1oP3aS5dF7gH9jK",
      "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
      "description": "Card numbers",
      "buckets": ["*"],
      "scopes": ["*"],
      "pattern": "",
      "type": "creditCard",
      "redactAt": "client",
      "level": "mask",
      "applyTo": "",
      "environments": ["*"],
      "enabled": true,
      "createdAt": "2026-03-02T16:00:00.000Z",
      "updatedAt": null,
      "deletedAt": null
    },
    {
      "sid": "red_2yU4iO6pA8sD1fG3hJ5kL7zX9cV",
      "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
      "description": "Authorization header",
      "buckets": ["*"],
      "scopes": ["request.header"],
      "pattern": "authorization",
      "type": "custom",
      "redactAt": "client",
      "level": "full",
      "applyTo": "key",
      "environments": ["*"],
      "enabled": true,
      "createdAt": "2026-03-02T16:01:00.000Z",
      "updatedAt": null,
      "deletedAt": null
    }
  ]
}
```

## Get redaction

`GET https://api.apitraffic.io/v1/accounts/{accountSid}/redactions/{redactionSid}`

Returns one redaction rule.

### Path parameters

- **accountSid (path, string, required)**:
  The account identifier.

- **redactionSid (path, string, required)**:
  The rule's identifier (`red_…`).

### Response

A [redaction object](#the-redaction-object).

```bash cURL
curl https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/redactions/red_2qW8eR4tY6uI1oP3aS5dF7gH9jK \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN"
```

```js Node.js
const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const redactionSid = 'red_2qW8eR4tY6uI1oP3aS5dF7gH9jK';
const response = await fetch(
  `https://api.apitraffic.io/v1/accounts/${accountSid}/redactions/${redactionSid}`,
  { headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` } },
);
const rule = await response.json();
```

```json 200
{
  "sid": "red_2qW8eR4tY6uI1oP3aS5dF7gH9jK",
  "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
  "description": "Card numbers",
  "buckets": ["*"],
  "scopes": ["*"],
  "pattern": "",
  "type": "creditCard",
  "redactAt": "client",
  "level": "mask",
  "applyTo": "",
  "environments": ["*"],
  "enabled": true,
  "createdAt": "2026-03-02T16:00:00.000Z",
  "updatedAt": null,
  "deletedAt": null
}
```

## List redaction options

`GET https://api.apitraffic.io/v1/redactions`

Returns the predefined redaction types, with their names and patterns, and the scopes a rule can use. Use it to build a rule editor or to check a type's id.

### Response

- **redactions (object[], required)**:
  The predefined types: `id` (use it as `type`), `name` and `pattern`.

- **scopes (object[], required)**:
  The scopes, each with `id` and `name`.

```bash cURL
curl https://api.apitraffic.io/v1/redactions \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN"
```

```js Node.js
const response = await fetch('https://api.apitraffic.io/v1/redactions', {
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` },
});
const { redactions, scopes } = await response.json();
```

```json 200
{
  "redactions": [
    { "id": "creditCard", "name": "Credit Card", "pattern": "…" },
    { "id": "email", "name": "Email", "pattern": "…" }
  ],
  "scopes": [
    { "id": "request", "name": "Request" },
    { "id": "request.header", "name": "Request Header" },
    { "id": "request.body", "name": "Request Body" },
    { "id": "request.query", "name": "Request Query String" },
    { "id": "response", "name": "Response" },
    { "id": "response.header", "name": "Response Header" },
    { "id": "response.body", "name": "Response Body" }
  ]
}
```

The example shortens the type list and the patterns.

## Create redaction

`POST https://api.apitraffic.io/v1/accounts/{accountSid}/redactions`

Creates a redaction rule.

**Permissions:** owner or admin, or an `administrator` API token. **Limit:** past the plan's rule limit, the API answers `409` with code `2213`.

### Path parameters

- **accountSid (path, string, required)**:
  The account identifier.

### Body parameters

- **type (body, string, required)**:
  A [predefined type](#predefined-redaction-types), or `custom`.

- **level (body, string, required)**:
  `full`, `mask` or `partial`. See [Redaction levels](#redaction-levels).

- **redactAt (body, string, required)**:
  `client` or `server`.

- **enabled (body, boolean, required)**:
  Whether the rule is active.

- **pattern (body, string | null, required)**:
  For `custom`: a key name (with `applyTo: "key"`) or a regular expression (with `applyTo: "value"`). Up to 512 characters; it must compile and must not be able to backtrack catastrophically, because it runs on every captured request. For predefined types send `""`; it is ignored.

- **applyTo (body, string | null, required)**:
  For `custom`: `key` or `value`. For predefined types send `""`.

- **scopes (body, string[])**:
  Where to look: any of `request.header`, `request.body`, `request.query`, `response.header`, `response.body`, or `["*"]` for everywhere.

- **buckets (body, string[])**:
  Bucket sids, or `["*"]` for every bucket.

- **environments (body, string[])**:
  Environment sids, or `["*"]` for every environment.

- **description (body, string | null)**:
  A short description.

### Response

The new [redaction object](#the-redaction-object).

```bash cURL
curl -X POST https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/redactions \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "Customer email addresses",
    "type": "email",
    "level": "partial",
    "redactAt": "client",
    "enabled": true,
    "pattern": "",
    "applyTo": "",
    "scopes": ["request.body", "response.body"],
    "buckets": ["k3m9p2x"],
    "environments": ["*"]
  }'
```

```js Node.js
const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const response = await fetch(`https://api.apitraffic.io/v1/accounts/${accountSid}/redactions`, {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    description: 'Customer email addresses',
    type: 'email',
    level: 'partial',
    redactAt: 'client',
    enabled: true,
    pattern: '',
    applyTo: '',
    scopes: ['request.body', 'response.body'],
    buckets: ['k3m9p2x'],
    environments: ['*'],
  }),
});
const rule = await response.json();
```

```json 200
{
  "sid": "red_2gH4jK6lZ8xC1vB3nM5qW7eR9tY",
  "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
  "description": "Customer email addresses",
  "buckets": ["k3m9p2x"],
  "scopes": ["request.body", "response.body"],
  "pattern": "",
  "type": "email",
  "redactAt": "client",
  "level": "partial",
  "applyTo": "",
  "environments": ["*"],
  "enabled": true,
  "createdAt": "2026-10-20T09:30:00.000Z",
  "updatedAt": null,
  "deletedAt": null
}
```

## Update redaction

`PUT https://api.apitraffic.io/v1/accounts/{accountSid}/redactions/{redactionSid}`

Replaces a redaction rule. Send the whole rule, with the same fields and rules as [Create redaction](#create-redaction). To pause a rule, send it with `enabled: false`.

**Permissions:** owner or admin, or an `administrator` API token.

### Path parameters

- **accountSid (path, string, required)**:
  The account identifier.

- **redactionSid (path, string, required)**:
  The rule's identifier.

### Body parameters

The same as [Create redaction](#create-redaction): `type`, `level`, `redactAt`, `enabled`, `pattern` and `applyTo` are required; `scopes`, `buckets`, `environments` and `description` are optional.

### Response

The updated [redaction object](#the-redaction-object).

```bash cURL
curl -X PUT https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/redactions/red_2yU4iO6pA8sD1fG3hJ5kL7zX9cV \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "description": "Authorization header",
    "type": "custom",
    "pattern": "authorization",
    "applyTo": "key",
    "level": "full",
    "redactAt": "client",
    "enabled": false,
    "scopes": ["request.header"],
    "buckets": ["*"],
    "environments": ["*"]
  }'
```

```js Node.js
const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const redactionSid = 'red_2yU4iO6pA8sD1fG3hJ5kL7zX9cV';
const response = await fetch(
  `https://api.apitraffic.io/v1/accounts/${accountSid}/redactions/${redactionSid}`,
  {
    method: 'PUT',
    headers: {
      Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}`,
      'Content-Type': 'application/json',
    },
    body: JSON.stringify({
      description: 'Authorization header',
      type: 'custom',
      pattern: 'authorization',
      applyTo: 'key',
      level: 'full',
      redactAt: 'client',
      enabled: false,
      scopes: ['request.header'],
      buckets: ['*'],
      environments: ['*'],
    }),
  },
);
const rule = await response.json();
```

```json 200
{
  "sid": "red_2yU4iO6pA8sD1fG3hJ5kL7zX9cV",
  "accountSid": "acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa",
  "description": "Authorization header",
  "buckets": ["*"],
  "scopes": ["request.header"],
  "pattern": "authorization",
  "type": "custom",
  "redactAt": "client",
  "level": "full",
  "applyTo": "key",
  "environments": ["*"],
  "enabled": false,
  "createdAt": "2026-03-02T16:01:00.000Z",
  "updatedAt": "2026-10-20T09:35:00.000Z",
  "deletedAt": null
}
```

## Delete redaction

`DELETE https://api.apitraffic.io/v1/accounts/{accountSid}/redactions/{redactionSid}`

Deletes a redaction rule. Requests captured from then on are no longer redacted by it; requests already stored stay as they were stored.

**Permissions:** owner or admin, or an `administrator` API token.

### Path parameters

- **accountSid (path, string, required)**:
  The account identifier.

- **redactionSid (path, string, required)**:
  The rule's identifier.

### Response

- **sid (string, required)**:
  The deleted rule's identifier.

- **deleted (boolean, required)**:
  `true`.

```bash cURL
curl -X DELETE https://api.apitraffic.io/v1/accounts/acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa/redactions/red_2gH4jK6lZ8xC1vB3nM5qW7eR9tY \
  -H "Authorization: Bearer $APITRAFFIC_TOKEN"
```

```js Node.js
const accountSid = 'acc_2mXq7RbT4kPz9WvN3cHd8LsYfQa';
const redactionSid = 'red_2gH4jK6lZ8xC1vB3nM5qW7eR9tY';
await fetch(`https://api.apitraffic.io/v1/accounts/${accountSid}/redactions/${redactionSid}`, {
  method: 'DELETE',
  headers: { Authorization: `Bearer ${process.env.APITRAFFIC_TOKEN}` },
});
```

```json 200
{
  "sid": "red_2gH4jK6lZ8xC1vB3nM5qW7eR9tY",
  "deleted": true
}
```

## Predefined redaction types

Use one of these ids as `type` to redact common data without writing a pattern:

| `type` | Finds |
| --- | --- |
| `creditCard` | Credit card numbers |
| `email` | Email addresses |
| `phone` | Phone numbers |
| `ssn` | US Social Security numbers |
| `driversLicense` | US driver's license numbers |
| `ipV4` | IPv4 addresses |
| `geographic` | Geographic coordinates |
| `birthday` | Birthdays |
| `vin` | Vehicle identification numbers |
| `aadhar` | Aadhaar numbers |
| `brazilCPF` | Brazilian CPF numbers |
| `jwt` | JSON Web Tokens |
| `custom` | Your own key name or regular expression, set in `pattern` and `applyTo` |

## Redaction levels

| `level` | Replaces a match with | Example for `4111111111111111` |
| --- | --- | --- |
| `full` | `[REDACTED]` | `[REDACTED]` |
| `mask` | One `*` per character, so the length stays visible | `****************` |
| `partial` | The first and last three characters around `...` (first and last one for values of 3 to 6 characters; a mask for shorter values) | `411...111` |

## Errors

| Status | Code | Meaning |
| --- | --- | --- |
| `400` | `1000` | A field is missing or invalid. For `custom` rules this includes a pattern that does not compile, is longer than 512 characters or can backtrack catastrophically; the message starts with `pattern:` and says why. |
| `403` | `2010` | Creating, changing or deleting a rule without owner, admin or `administrator` access. |
| `404` | `4000` | No rule with that `redactionSid` in this account. |
| `409` | `2213` | The plan's redaction rule limit is reached. |

## Related

- [Redactions](https://www.apitraffic.io/docs/data/redactions):
    Choose and test redaction rules in the app.

- [Exclusions API](https://www.apitraffic.io/docs/api-reference/exclusions):
    Stop some traffic from being captured at all.