PII & Secrets Detection

Scan text for personally identifiable information (PII) and secrets such as API keys, private keys, and credential pairs. Optionally redact detected values with placeholders.

Endpoint

POST /api/v1/security/pii-secrets

Request body

{
  "text": "Text to scan (required, 1–32,000 characters)",
  "redact": false
}

Set redact: true to receive a redacted_text field with detected values replaced by placeholders like [EMAIL], [API_KEY], or [SSN].

Example request

curl -X POST "https://www.identicapi.com/api/v1/security/pii-secrets" \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
  "text": "Contact me at alice@example.com or call 555-123-4567. API key: sk_live_abc123xyz789",
  "redact": true
}'

const response = await fetch("https://www.identicapi.com/api/v1/security/pii-secrets", {
  method: "POST",
  headers: {
    "Authorization": "Bearer process.env.IDENTICAPI_KEY",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "text": "Contact me at alice@example.com or call 555-123-4567. API key: sk_live_abc123xyz789",
    "redact": true
  })
});

const data = await response.json();
console.log(data);

Response

{
  "request_id": "req_abc123",
  "api": "pii-secrets-detection",
  "verdict": "unsafe",
  "risk": "high",
  "confidence": 0.95,
  "findings": [
    {
      "category": "email",
      "reason": "Detected email (pii)",
      "confidence": 0.95,
      "start": 14,
      "end": 31
    },
    {
      "category": "phone",
      "reason": "Detected phone (pii)",
      "confidence": 0.8,
      "start": 40,
      "end": 52
    },
    {
      "category": "stripe_key",
      "reason": "Detected stripe key (secret)",
      "confidence": 0.95,
      "start": 63,
      "end": 84
    }
  ],
  "reasons": [
    "Detected email (pii)",
    "Detected phone (pii)",
    "Detected stripe key (secret)"
  ],
  "redacted_text": "Contact me at [EMAIL] or call [PHONE]. API key: [API_KEY]",
  "usage_units": 1,
  "processing_time_ms": 5,
  "detector_version": "1.0.0"
}

Verdict semantics

Verdict	Risk	Meaning
`safe`	low	No PII or secrets detected.
`suspicious`	medium	PII detected (email, phone, SSN, IBAN, IP address).
`unsafe`	high	Secrets detected (API keys, private keys, tokens, credentials).

Detected types

PII

email — email addresses
phone — phone numbers (US format)
credit_card — card numbers validated with Luhn checksum
iban — international bank account numbers
ipv4 — IPv4 addresses
ssn — US Social Security numbers (XXX-XX-XXXX)

Secrets

private_key — PEM private keys
stripe_key, aws_access_key, github_token, github_oauth
slack_token, google_api_key, openai_key
api_key — IdenticAPI keys (idapi_live_ / idapi_test_)
bearer_token, credential_pair

Usage

Each request consumes 1 usage unit.

Limitations

Regex-based detection — may produce false positives on formatted numbers or false negatives on obfuscated secrets.
Credit card detection requires a valid Luhn checksum.
Redaction replaces values in-place; overlapping matches are handled from end to start.
Text input limited to 32,000 characters.