Use as a REST API

This is the default mode (mode: "rest"). Send a JSON or XML payload to /v1/anonymize and get back the same shape with PII redacted.

JSON payloads

Send a POST request to /v1/anonymize with a JSON payload containing the data you want to anonymize.

POST /v1/anonymize
Content-Type: application/json

{
  "email": "john@example.com",
  "ssn": "123-45-6789",
  "text": "Contact john@example.com or call 555-123-4567. SSN on file: 123-45-6789."
}

→ 200 OK
{
  "email": "[REDACTED]",
  "ssn": "[REDACTED]",
  "text": "Contact [REDACTED] or call [REDACTED]. SSN on file: [REDACTED]."
}

XML payloads

Send a POST request to /v1/anonymize with an XML payload, either via ?type=xml or a Content-Type: application/xml header.

POST /v1/anonymize?type=xml
Content-Type: application/xml

<person><email>john@example.com</email><name>Jane</name></person>

→ 200 OK
<person><email>[REDACTED]</email><name>[REDACTED]</name></person>

Batch JSON payloads

Send a POST request to /v1/anonymize/batch with a JSON array of the items you want to anonymize, up to server.max_batch_items.

POST /v1/anonymize/batch
Content-Type: application/json

[
  {"email":"a@b.com"},
  {"ssn":"123-45-6789"},
  {"note":"call 555-123-4567"}
]

→ 200 OK
[
  {"email":"[REDACTED]"},
  {"ssn":"[REDACTED]"},
  {"note":"call [REDACTED]"}
]

Batch XML payloads

Send a POST request to /v1/anonymize/batch?type=xml with a root element wrapping one child element per item.

POST /v1/anonymize/batch?type=xml
Content-Type: application/xml

<batch>
  <item><email>john@example.com</email></item>
  <item><ssn>123-45-6789</ssn></item>
  <item><note>call 555-123-4567</note></item>
</batch>

→ 200 OK
<batch>
  <item><email>[REDACTED]</email></item>
  <item><ssn>[REDACTED]</ssn></item>
  <item><note>call [REDACTED]</note></item>
</batch>

Restricting who can call it

Browser-facing deployments should whitelist the origins allowed to call the API via server.allowed_origins in config.yaml. Requests from any other Origin won't receive CORS headers, so browsers will block them.

server:
  allowed_origins: ["https://app.example.com"]
  # allowed_origins: ["*"]  # allow any origin -- its best practice to define a list with the allowed domains accessing your service