Redact sensitive fields | Faustine Docs

Redaction removes values from the payloads of a request before the gateway stores them. Each environment has its own redaction settings. A change applies to new requests. Requests already stored are not rewritten.

What is always removed

These rules cannot be turned off. Log settings lists them with an Always on mark.

The Authorization, Proxy-Authorization, Cookie, Set-Cookie and X-Api-Key headers of every recorded request and response.
Every connection credential, by value, wherever it appears: keys, passwords, client secrets, script secrets and the tokens obtained with them, in URLs, headers, bodies and console output.
The API key or session token the agent called with.
For each API with authentication, the headers and query parameters its sign-in sets.

Turn built-in detectors on or off

In the portal, go to Agent Gateway and select your gateway.
Select the Logs tab, then Log settings.
Under Redaction, turn each detector on or off.
Select Save.

Detector	What it removes	Default
Sensitive field names	Fields named `password`, `secret`, `token`, `api_key`, `authorization`, `cookie`, `card_number`, `cvv` and similar, at any depth.	On
Sensitive schema fields	Fields marked `writeOnly` or `format: password` in the schemas of the operations. The row lists the fields found for each API.	On
Card numbers	Numbers that pass the Luhn check.	On
JWTs	Values shaped like a JSON Web Token.	On
Bearer and Basic credentials	Values that start with `Bearer` or `Basic` .	On
Email addresses	Email addresses anywhere in a body or header.	Off
Phone numbers	Phone numbers anywhere in a body or header.	Off
IP addresses	IPv4 addresses anywhere in a body or header.	Off

Add a custom rule

A custom rule redacts a header, a field or a pattern that is specific to your API. An environment can have up to 50 rules.

Under Custom rules, select Add rule.
Enter a Name of up to 60 characters. A masked value is stored as [redacted: <name>].
Select the Target and enter what to match:
- Header: a header name, matched without regard to case, on requests to and responses from your API.
- Field path: a path in a JSON body, such as customer.tax_id. items[*].card matches every item of an array, *.token matches one key at any position, and **.iban matches at any depth.
- Pattern: a regular expression without slashes or flags, matched on every string value, such as ACCT-[0-9]{8}. Lookahead, lookbehind and backreferences are not supported.
Under Where, select All operations, An API or An operation.
Under Direction, select Request, Response or Both.
Select the Action.
Under Test, select A recent request or Paste a sample. The panel shows the payload before and after the rule.
Select Add rule.
Select Save in the Redaction section. The rule does not apply until you save the section.

Action	Result for the value `ACCT-00482913`
Mask	`[redacted: <name>]`
Remove	The header or field is dropped, name and value. For a pattern, only the matched text is dropped.
Partial	`••••2913`, the last four characters.
Hash	`hash:` followed by 12 hexadecimal characters. Equal values give equal hashes within your workspace, and the value cannot be recovered.

Custom rules run in the order of the list, after the rules that are always on and the built-in detectors. The first rule that matches a value decides what happens to it. Use the arrows in the first column to change the order.

Remove data that is already stored

Redaction does not change stored requests. To remove them, use Stored data in Log settings:

Delete payloads deletes the stored bodies, headers, scripts and console output of the environment. The metadata stays.
Delete all logs deletes every request of the environment with its calls, upstream attempts and payloads.

Neither can be undone. On the default environment, the dialog asks you to type the environment's slug.

Troubleshooting

Symptom	Cause	Fix
The test says "The rule reaches no recorded part of this request"	The request does not include the API, operation or direction the rule is limited to.	Widen Where or Direction, or test against another request.
A rule shows "The pattern matches an empty string."	The regular expression can match nothing, such as `\d*`.	Require at least one character, such as `\d+`.
A value still appears in an older request	The request was stored before the rule existed.	Delete the stored payloads.

Next steps

Set recording and retention: choose what is recorded and for how long.
Log streams: streams send what the logs hold, after redaction.
Logs: how a redacted value appears in a request.