Unmasking APIs

Reverse tokenized values back to their original sensitive content. Unmasking is a privileged operation governed by permissions and policies.

Overview

The Unmasking API reverses tokenized content back to its original sensitive values. It is designed for authorized recovery of tokenized text — including entities such as names, emails, phone numbers, URLs, addresses, and nationalities.

Unmasking is a privileged operation and must only be used by authorized users in accordance with your organization's security and compliance requirements.

All unmasking operations use HTTP PUT.

Unmasking exposes original sensitive data. Restrict access to unmasking endpoints, enforce role-based access controls, and audit all unmask operations.