PII settings API

Squasher checks every log, span, metric point, and AI record it receives for secrets and personal data: private keys, API keys and tokens, JWTs, card numbers, SSNs, emails, phone numbers, and values under secret-named keys such as password or authorization.

Detection is always on. The first hit in a service and attribute opens one pii_leak finding (see the Findings API). The finding holds a masked sample (for example AKIA**** or **** **** **** 1111) and the attribute path, never the value. Detection never pages anyone.
Redaction is off by default. When you turn it on for a project, Squasher replaces each detected value with [redacted:<kind>] (for example [redacted:aws_access_key]) before it stores the data. A value under a secret-named key is replaced as a whole. Data that is already stored does not change.

A change takes effect for new data within about 60 seconds.

Operations

Operation	Method and path	Purpose
`security.pii.getSettings`	`GET /v1/projects/{project_id}/security/pii-settings`	Read the project’s PII settings.
`security.pii.updateSettings`	`PATCH /v1/projects/{project_id}/security/pii-settings`	Turn redaction on or off, or preview it.

security.pii.getSettings needs project:read. security.pii.updateSettings needs project:write. Each change is recorded in the project’s audit log with the key or user that made it.

Read the settings

curl "https://api.squasher.ai/v1/projects/$SQUASHER_PROJECT_ID/security/pii-settings" \
  -H "Authorization: Bearer $SQUASHER_API_KEY"

{
  "project_id": "7063a770-8cc6-4284-b5f9-c0cb19e6fa79",
  "redaction_enabled": false,
  "detection_enabled": true,
  "redacted_kinds": [],
  "updated_at": "2026-11-01T05:00:00.000Z"
}

Field	Meaning
`redaction_enabled`	`true` when detected values are replaced before storage.
`detection_enabled`	Always `true`.
`redacted_kinds`	The kinds Squasher replaces now. Empty when redaction is off.
`updated_at`	When the project last changed.

Kinds: private_key, aws_access_key, github_token, gitlab_token, slack_token, stripe_key, google_api_key, jwt, http_auth, url_password, azure_sas, email, phone, card_number, ssn, sensitive_key.

Turn redaction on or off

Preview first with dry_run=true. The response shows the kinds that would be redacted and whether the value changes. Nothing is written.

curl -X PATCH "https://api.squasher.ai/v1/projects/$SQUASHER_PROJECT_ID/security/pii-settings?dry_run=true" \
  -H "Authorization: Bearer $SQUASHER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"redaction_enabled": true}'

{
  "dry_run": true,
  "redaction_enabled": true,
  "redacted_kinds": ["private_key", "aws_access_key", "...", "sensitive_key"],
  "changed": true
}

Send the same request without dry_run to apply it. The response is the new settings object. A body other than { "redaction_enabled": boolean } returns 422.

CLI

squasher findings pii get --project $SQUASHER_PROJECT_ID
squasher findings pii set --project $SQUASHER_PROJECT_ID --redaction true --dry-run
squasher findings pii set --project $SQUASHER_PROJECT_ID --redaction true

TypeScript client

const settings = await client.security.getPiiSettings();
const preview = await client.security.updatePiiSettings(
  { redaction_enabled: true },
  { dryRun: true },
);
await client.security.updatePiiSettings({ redaction_enabled: true });

Start here

Resources

Operations

Read the settings

Turn redaction on or off

CLI

TypeScript client

​Operations

​Read the settings

​Turn redaction on or off

​CLI

​TypeScript client

Operations

Read the settings

Turn redaction on or off

CLI

TypeScript client