> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squasher.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# PII settings API

> Read and change how Squasher handles secrets and personal data that your telemetry sends: detection is always on, redaction before storage is opt-in per project.

Squasher checks every log, span, metric point, and AI record it receives for secrets and
personal data: private keys, API keys and tokens, JWTs, card numbers, SSNs, emails, phone numbers,
and values under secret-named keys such as `password` or `authorization`.

* **Detection** is always on. The first hit in a service and attribute opens one `pii_leak`
  finding (see the [Findings API](https://docs.squasher.ai/api-reference/findings.md)). The finding holds a masked sample
  (for example `AKIA****` or `**** **** **** 1111`) and the attribute path, never the value.
  Detection never pages anyone.
* **Redaction** is off by default. When you turn it on for a project, Squasher replaces each
  detected value with `[redacted:<kind>]` (for example `[redacted:aws_access_key]`) before it
  stores the data. A value under a secret-named key is replaced as a whole. Data that is already
  stored does not change.

A change takes effect for new data within about 60 seconds.

## Operations

| Operation | Method and path | Purpose |
| - | - | - |
| `security.pii.getSettings` | `GET /v1/projects/{project_id}/security/pii-settings` | Read the project's PII settings. |
| `security.pii.updateSettings` | `PATCH /v1/projects/{project_id}/security/pii-settings` | Turn redaction on or off, or preview it. |

`security.pii.getSettings` needs `project:read`. `security.pii.updateSettings` needs
`project:write`. Each change is recorded in the project's audit log with the key or user that made
it.

## Read the settings

```bash theme={null}
curl "https://api.squasher.ai/v1/projects/$SQUASHER_PROJECT_ID/security/pii-settings" \
  -H "Authorization: Bearer $SQUASHER_API_KEY"
```

```json theme={null}
{
  "project_id": "7063a770-8cc6-4284-b5f9-c0cb19e6fa79",
  "redaction_enabled": false,
  "detection_enabled": true,
  "redacted_kinds": [],
  "updated_at": "2026-11-01T05:00:00.000Z"
}
```

| Field | Meaning |
| - | - |
| `redaction_enabled` | `true` when detected values are replaced before storage. |
| `detection_enabled` | Always `true`. |
| `redacted_kinds` | The kinds Squasher replaces now. Empty when redaction is off. |
| `updated_at` | When the project last changed. |

Kinds: `private_key`, `aws_access_key`, `github_token`, `gitlab_token`, `slack_token`,
`stripe_key`, `google_api_key`, `jwt`, `http_auth`, `url_password`, `azure_sas`, `email`, `phone`, `card_number`, `ssn`, `sensitive_key`.

## Turn redaction on or off

Preview first with `dry_run=true`. The response shows the kinds that would be redacted and
whether the value changes. Nothing is written.

```bash theme={null}
curl -X PATCH "https://api.squasher.ai/v1/projects/$SQUASHER_PROJECT_ID/security/pii-settings?dry_run=true" \
  -H "Authorization: Bearer $SQUASHER_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"redaction_enabled": true}'
```

```json theme={null}
{
  "dry_run": true,
  "redaction_enabled": true,
  "redacted_kinds": ["private_key", "aws_access_key", "...", "sensitive_key"],
  "changed": true
}
```

Send the same request without `dry_run` to apply it. The response is the new settings object.
A body other than `{ "redaction_enabled": boolean }` returns 422.

## CLI

```bash theme={null}
squasher findings pii get --project $SQUASHER_PROJECT_ID
squasher findings pii set --project $SQUASHER_PROJECT_ID --redaction true --dry-run
squasher findings pii set --project $SQUASHER_PROJECT_ID --redaction true
```

## TypeScript client

```ts theme={null}
const settings = await client.security.getPiiSettings();
const preview = await client.security.updatePiiSettings(
  { redaction_enabled: true },
  { dryRun: true },
);
await client.security.updatePiiSettings({ redaction_enabled: true });
```


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.