§ Find and remove
Redact PII API
Finds personal information in a UTF-8 text file and replaces it, in one pass, with nothing kept afterwards. Detection is regular expressions and an optional exact-match term list — pattern matching, not comprehension. It will miss a name written in running prose, and it will find a date you did not mean. Use it to reduce what leaves your building, not to certify that a document is clean.
- Endpoint
- POST /text/redact
- Inputs
- Exactly 1 UTF-8 text file
- Returns
- text/plain; charset=utf-8
- Limits
- 2 MB per file, 4 MB per request, 1,000 custom terms.
- Price
- $0.001
§ 01 The request
One POST, and the file comes back.
curl -sS --fail-with-body \
-o redacted.txt \
-H "Authorization: Bearer $OHMYWRAP_KEY" \
-F "file=@notes.txt" \
-F 'options={"detect":["email-address","ssn"],"strategy":"redact"}' \
https://api.ohmywrap.com/text/redactOptions
| Option | Type | Default | What it does |
|---|---|---|---|
| detect | string[] | the 13 defaults | Which detectors to run. Omitting it means the defaults; sending [] means none of them, which is how you ask for `terms` and nothing else. `date`, `age`, `zip-code` and `url` exist but are off by default, because they fire constantly in ordinary prose. |
| strategy | string | redact | `redact`, `mask`, `hash`, `last4`, `static`, or `random`. |
| redactionFormat | string | [REDACTED-%t] | `redact` only. `%t` is the detector name. `%v` is refused: it puts the matched value back inside its own placeholder, so the output looks redacted and is not. |
| staticReplacement | string | — | Required when `strategy` is `static`. |
| maskCharacter | string | * | `mask` only. Exactly one character; a multi-byte one is fine. |
| terms | string[] | — | An inline dictionary of exact phrases to treat as sensitive. Up to 1,000 terms of 256 bytes each. Every entry is another pass over the input, bought for the same single call. |
| caseSensitive | bool | false | Applies to `terms` only. The built-in detectors set their own case rules per pattern. |
| onlyValidCreditCardNumbers | bool | false | Run a Luhn check before reporting a card. Trades a little recall for far fewer false positives on long digit runs. |
Worth knowing
Seventeen detectors, allowlisted. A name that is not on the list is 422 unknown_detector and the error names the ones that are, because a detector that is accepted and silently finds nothing is the worst failure this endpoint has. This does not redact PDFs: a black box drawn over a page leaves the text selectable underneath.
Your first /text/redact call takes one line of curl.
Ten thousand calls cost ten dollars, the pack never expires, and nothing you send is kept.
10,000 calls for $10. No subscription, no expiry.