AI Safety & Agents Live on RapidAPI & Zyla POST /v1/pii-redactor

PII Redactor API — Mask Personal Data Before Sending Prompts to LLMs

Mask emails, phones, IBANs, cards, and EU IDs with reversible tokens before LLM calls. Stateless PII redaction API that masks emails, phones, IBANs, SSNs, credit cards, and EU national IDs with reversible HMAC tokens before LLM calls.

Additional endpoints in this module: POST /v1/pii-redactor/restore

Try It Live in Your Browser · No API Key Required

1. Interactive Sandbox & Sample JSON Output

200 OK · Ready

Editable Request JSON (`POST /v1/pii-redactor`)

Live 200 OK Response Envelope

{
  "ok": true,
  "data": {
    "redacted_text": "Customer [PII_EMAIL_1] (IBAN [PII_IBAN_1]) requested a refund.",
    "findings": [
      {
        "type": "EMAIL",
        "start": 9,
        "end": 32,
        "token": "[PII_EMAIL_1]",
        "locale": "GLOBAL",
        "validated": false
      },
      {
        "type": "IBAN",
        "start": 39,
        "end": 67,
        "token": "[PII_IBAN_1]",
        "locale": "EU",
        "validated": true
      }
    ],
    "counts": {
      "EMAIL": 1,
      "IBAN": 1
    },
    "total_redacted": 2,
    "tokens": {
      "[PII_EMAIL_1]": "janos.kovacs@example.hu",
      "[PII_IBAN_1]": "HU42117730161111101800000000"
    }
  },
  "meta": {
    "request_id": "req_pii_01",
    "ms": 1
  }
}

Get API Key on RapidAPI Get API Key on Zyla Hub Download OpenAPI 3.0.3 Spec

2. Quickstart Code Examples

Full TypeScript & Python SDK →

curl -X POST "https://api.tinplate.dev/v1/pii-redactor" \
  -H "Content-Type: application/json" \
  -H "X-RapidAPI-Key: YOUR_RAPIDAPI_KEY" \
  -d '{"text":"Customer janos.kovacs@example.hu (IBAN HU42117730161111101800000000) requested a refund.","mode":"token"}'

import { TinplateClient } from "@tinplate/sdk"; // npm install @tinplate/sdk

const tinplate = new TinplateClient({
  rapidApiKey: process.env.RAPIDAPI_KEY!,
});

const { data, meta } = await tinplate.call("/v1/pii-redactor", {
  "text": "Customer janos.kovacs@example.hu (IBAN HU42117730161111101800000000) requested a refund.",
  "mode": "token"
});
console.log(`[${meta.ms} ms]`, data);

import requests

response = requests.post(
    "https://api.tinplate.dev/v1/pii-redactor",
    headers={
        "Content-Type": "application/json",
        "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
    },
    json={
  "text": "Customer janos.kovacs@example.hu (IBAN HU42117730161111101800000000) requested a refund.",
  "mode": "token"
}
)
print(response.json())

const response = await fetch("https://api.tinplate.dev/v1/pii-redactor", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RapidAPI-Key": "YOUR_RAPIDAPI_KEY",
  },
  body: JSON.stringify({
  "text": "Customer janos.kovacs@example.hu (IBAN HU42117730161111101800000000) requested a refund.",
  "mode": "token"
}),
});
const result = await response.json();
console.log(result);

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "tinplate_pii_redactor",
    "arguments": {
      "text": "Customer janos.kovacs@example.hu (IBAN HU42117730161111101800000000) requested a refund.",
      "mode": "token"
    }
  }
}

OpenAPI 3.0.3 Schema Contract

Request Parameters & Response Schema Reference

Request Body Parameters (`POST /v1/pii-redactor`)

Parameter	Type & Constraints	Description
`text`required	`string` minLen: 1, maxLen: 262144	Input text to scan and redact (max 256 KB).
`locales`optional	`string[]`	Locale packs to enable (defaults to ['GLOBAL', 'EU']).
`mode`optional	`"token" \| "mask"`	'token' returns reversible [PII_<TYPE>_N] tokens + caller-only tokens map; 'mask' returns [REDACTED:<TYPE>] with an empty tokens map.
`types`optional	`string[]`	Optional whitelist of PII entity types to redact.

Response `data` Object Fields (`200 OK`)

Field	Type	Description
`redacted_text`	`string`	Field 'redacted_text'
`findings`	`object[]`	Field 'findings'
`counts`	`object`	Field 'counts'
`total_redacted`	`integer`	Field 'total_redacted'
`tokens`	`object`	Reversible token map returned only to the caller (never stored server-side). Empty in 'mask' mode.

3. What PII Redactor API Detects & Validates

Email addresses, international phone numbers, IPv4/IPv6 addresses, and MAC addresses
Credit cards (Luhn-validated) and IBAN numbers (MOD 97-10 checksum verified)
US SSN, UK NIN, German Steuer-ID, Hungarian TAJ & Személyi szám, Spanish DNI/NIE, French NIR, Polish PESEL
Reversible placeholder tokens ([EMAIL_1]) or deterministic HMAC-SHA256 pseudonymization
Stateless restoration via POST /v1/pii-redactor/restore using caller-held map

Honest Engineering Boundaries

4. Known Limitations & Test Verification

Release Version: v1.0.7 · Last Verified / Benchmarked: 14 November 2026 · Latency Note: Sub-millisecond figures measure in-Worker V8 compute time (typical client HTTPS network RTT to the nearest Cloudflare PoP is 15–65 ms) · See Full Portfolio Benchmarks & Corpora →

Deterministic pattern + checksum detector; does not perform open-ended NER on arbitrary person names without structured context.
Restoration requires keeping the returned redaction map in your own session state (Tinplate stores nothing).
Tested suite v1.0.4 (14 November 2026): 100% precision on Luhn/IBAN/EU national ID checksum fixtures.

5. Marketplace Plans & Payload Quotas

Plan	Monthly Price	Included Requests	Rate Limit	Max Request Payload	Best For
BASIC	$0.00 / month	500 / month (hard limit)	10 req / min	64 KB	Evaluation, local development & CI smoke tests
PRO	$9.99 / month	15,000 / month	60 req / min	128 KB	Solo developers & production apps
ULTRA	$29.99 / month	100,000 / month	300 req / min	256 KB	Growing SaaS & multi-agent pipelines
MEGA	$79.99 / month	500,000 / month	1,000 req / min	256 KB	High-volume enterprise workloads

Subscribe on RapidAPI Subscribe on Zyla Hub Full Pricing Details

6. Frequently Asked Questions

How do I restore redacted placeholders after the LLM responds?

Keep the entities map returned by /v1/pii-redactor in your application memory and send the LLM output plus that map to POST /v1/pii-redactor/restore.

Does it validate checksums to prevent false positives?

Yes. Credit cards require Luhn validation, IBANs require ISO 13616 MOD-97 verification, and national IDs validate check digits before masking.

Is any personal data logged or retained?

Never. Workers Observability and invocation logs are disabled in wrangler.toml (observability.enabled = false).

Zero Payload Logging

7. Data Handling, Privacy & Marketplace Proxy Disclosure

100% stateless V8 isolate execution. Raw PII and redaction maps are never written to disk, KV, D1, or console logs.

Worker Zero-Logging Guarantee: Cloudflare Workers Observability and invocation logging are disabled in configuration (observability.enabled = false, head_sampling_rate = 0, invocation_logs = false). Payloads are processed strictly in volatile V8 memory and never logged or stored by Tinplate.

Marketplace Proxies vs. Direct Bearer Key: Requests sent via RapidAPI or Zyla API Hub pass through those marketplaces' proxy infrastructure (subject to their respective privacy policies). Security-sensitive workloads requiring end-to-end zero-intermediary processing can connect directly to https://api.tinplate.dev using a Direct Bearer Key (Authorization: Bearer <API_KEY>). Read our full Privacy Notice and OpenAPI 3.0.3 JSON Schema.