Masking APIs
Overview of all Protecto masking endpoints — from explicit token-based masking to auto-detection of PII in free-form text.
Overview
The Masking APIs transform sensitive input values into secure, deterministic tokens. Depending on how you call the API, Protecto can:
- Mask known values using explicit token types
- Preserve structure using formats (email, phone, URL)
- Automatically detect and mask PII in free-form text
- Apply masking behavior defined in a named policy
- Attach custom metadata to masked values
All masking operations use HTTP PUT and require a valid authorization token.
Authentication
| Header | Value |
|---|---|
Authorization | Bearer <AUTH_TOKEN> |
Base URLs
For POC/Trial access, please contact us at sales@protecto.ai.
| Environment | Base URL |
|---|---|
| Production | https://api.protecto.ai |
Available masking modes
Mask with Token
Explicitly specify the token type when you already know the data type.
Mask with Format
Preserve value structure (phone format, email format) while replacing the actual content.
Identify and Mask (Auto-Detect)
Detect and mask all PII in free-form text automatically, driven by your active policy.
Mask with Policy
Apply policy-defined masking behavior, including anonymization vs pseudonymization rules.
Mask with Attributes
Attach custom metadata key-value pairs to masked values.
Prefix & Suffix Behavior
Understand how entity tags wrap masked values and how to customize them.
Choosing the right masking mode
| Input type | Recommended mode |
|---|---|
| Free-form text, logs, prompts | Identify and Mask (Auto-Detect) |
| Known structured fields | Mask with Token |
| Fields requiring format preservation | Mask with Format |
| Policy-governed workflows | Mask with Policy |
| Values needing custom metadata | Mask with Attributes |