ohmywrap
Get an API key

§ Find and remove

Redact PII API

Finds personal information in a UTF-8 text file and replaces it, in one pass, with nothing kept afterwards. Detection is regular expressions and an optional exact-match term list — pattern matching, not comprehension. It will miss a name written in running prose, and it will find a date you did not mean. Use it to reduce what leaves your building, not to certify that a document is clean.

Endpoint
POST /text/redact
Inputs
Exactly 1 UTF-8 text file
Returns
text/plain; charset=utf-8
Limits
2 MB per file, 4 MB per request, 1,000 custom terms.
Price
$0.001

§ 01 The request

One POST, and the file comes back.

POST /text/redact
curl -sS --fail-with-body \
  -o redacted.txt \
  -H "Authorization: Bearer $OHMYWRAP_KEY" \
  -F "file=@notes.txt" \
  -F 'options={"detect":["email-address","ssn"],"strategy":"redact"}' \
  https://api.ohmywrap.com/text/redact

Options

Options accepted inside the options JSON object
OptionTypeDefaultWhat it does
detectstring[]the 13 defaultsWhich detectors to run. Omitting it means the defaults; sending [] means none of them, which is how you ask for `terms` and nothing else. `date`, `age`, `zip-code` and `url` exist but are off by default, because they fire constantly in ordinary prose.
strategystringredact`redact`, `mask`, `hash`, `last4`, `static`, or `random`.
redactionFormatstring[REDACTED-%t]`redact` only. `%t` is the detector name. `%v` is refused: it puts the matched value back inside its own placeholder, so the output looks redacted and is not.
staticReplacementstringRequired when `strategy` is `static`.
maskCharacterstring*`mask` only. Exactly one character; a multi-byte one is fine.
termsstring[]An inline dictionary of exact phrases to treat as sensitive. Up to 1,000 terms of 256 bytes each. Every entry is another pass over the input, bought for the same single call.
caseSensitiveboolfalseApplies to `terms` only. The built-in detectors set their own case rules per pattern.
onlyValidCreditCardNumbersboolfalseRun a Luhn check before reporting a card. Trades a little recall for far fewer false positives on long digit runs.

Worth knowing

Seventeen detectors, allowlisted. A name that is not on the list is 422 unknown_detector and the error names the ones that are, because a detector that is accepted and silently finds nothing is the worst failure this endpoint has. This does not redact PDFs: a black box drawn over a page leaves the text selectable underneath.

Your first /text/redact call takes one line of curl.

Ten thousand calls cost ten dollars, the pack never expires, and nothing you send is kept.

10,000 calls for $10. No subscription, no expiry.