# Redact sensitive fields

Redaction removes values from the payloads of a request before the gateway stores them. Each environment has its own redaction settings. A change applies to new requests. Requests already stored are not rewritten.

## What is always removed

These rules cannot be turned off. **Log settings** lists them with an **Always on** mark.

- The `Authorization`, `Proxy-Authorization`, `Cookie`, `Set-Cookie` and `X-Api-Key` headers of every recorded request and response.
- Every connection credential, by value, wherever it appears: keys, passwords, client secrets, script secrets and the tokens obtained with them, in URLs, headers, bodies and console output.
- The API key or session token the agent called with.
- For each API with authentication, the headers and query parameters its sign-in sets.

## Turn built-in detectors on or off

1. In the portal, go to [**Agent Gateway**](https://auth.faustine.ai/go?to=%2Fintegrations%2Fagent-gateway) and select your gateway.
2. Select the **Logs** tab, then **Log settings**.
3. Under **Redaction**, turn each detector on or off.
4. Select **Save**.

| Detector | What it removes | Default |
| --- | --- | --- |
| **Sensitive field names** | Fields named `password`, `secret`, `token`, `api_key`, `authorization`, `cookie`, `card_number`, `cvv` and similar, at any depth. | On |
| **Sensitive schema fields** | Fields marked `writeOnly` or `format: password` in the schemas of the operations. The row lists the fields found for each API. | On |
| **Card numbers** | Numbers that pass the Luhn check. | On |
| **JWTs** | Values shaped like a JSON Web Token. | On |
| **Bearer and Basic credentials** | Values that start with `Bearer ` or `Basic `. | On |
| **Email addresses** | Email addresses anywhere in a body or header. | Off |
| **Phone numbers** | Phone numbers anywhere in a body or header. | Off |
| **IP addresses** | IPv4 addresses anywhere in a body or header. | Off |

## Add a custom rule

A custom rule redacts a header, a field or a pattern that is specific to your API. An environment can have up to 50 rules.

1. Under **Custom rules**, select **Add rule**.
2. Enter a **Name** of up to 60 characters. A masked value is stored as `[redacted: <name>]`.
3. Select the **Target** and enter what to match:
   - **Header**: a header name, matched without regard to case, on requests to and responses from your API.
   - **Field path**: a path in a JSON body, such as `customer.tax_id`. `items[*].card` matches every item of an array, `*.token` matches one key at any position, and `**.iban` matches at any depth.
   - **Pattern**: a regular expression without slashes or flags, matched on every string value, such as `ACCT-[0-9]{8}`. Lookahead, lookbehind and backreferences are not supported.
4. Under **Where**, select **All operations**, **An API** or **An operation**.
5. Under **Direction**, select **Request**, **Response** or **Both**.
6. Select the **Action**.
7. Under **Test**, select **A recent request** or **Paste a sample**. The panel shows the payload before and after the rule.
8. Select **Add rule**.
9. Select **Save** in the **Redaction** section. The rule does not apply until you save the section.

| Action | Result for the value `ACCT-00482913` |
| --- | --- |
| **Mask** | `[redacted: <name>]` |
| **Remove** | The header or field is dropped, name and value. For a pattern, only the matched text is dropped. |
| **Partial** | `••••2913`, the last four characters. |
| **Hash** | `hash:` followed by 12 hexadecimal characters. Equal values give equal hashes within your workspace, and the value cannot be recovered. |

Custom rules run in the order of the list, after the rules that are always on and the built-in detectors. The first rule that matches a value decides what happens to it. Use the arrows in the first column to change the order.

## Remove data that is already stored

Redaction does not change stored requests. To remove them, use **Stored data** in **Log settings**:

- **Delete payloads** deletes the stored bodies, headers, scripts and console output of the environment. The metadata stays.
- **Delete all logs** deletes every request of the environment with its calls, upstream attempts and payloads.

Neither can be undone. On the default environment, the dialog asks you to type the environment's slug.

## Troubleshooting

| Symptom | Cause | Fix |
| --- | --- | --- |
| The test says "The rule reaches no recorded part of this request" | The request does not include the API, operation or direction the rule is limited to. | Widen **Where** or **Direction**, or test against another request. |
| A rule shows "The pattern matches an empty string." | The regular expression can match nothing, such as `\d*`. | Require at least one character, such as `\d+`. |
| A value still appears in an older request | The request was stored before the rule existed. | Delete the stored payloads. |

## Next steps

- [Set recording and retention](https://docs.faustine.ai/agent-gateway/retention/): choose what is recorded and for how long.
- [Log streams](https://docs.faustine.ai/agent-gateway/log-streams/): streams send what the logs hold, after redaction.
- [Logs](https://docs.faustine.ai/agent-gateway/logs/): how a redacted value appears in a request.