API reference

One HTTP endpoint does the work: you send text or a file, you get it back with personal data replaced by stable tokens. Everything on this page is live — paste your workspace key and the Send buttons hit your real workspace.

Overview

Base URL is https://piishield.ai. Requests and responses are JSON. There is no SDK to install — the whole integration is one POST.

Authentication

Your workspace key identifies the workspace, applies its coverage settings, and meters usage. Pass it as a query parameter:

POST https://piishield.ai/api/my/redact-document?key=shield_…

How tokens work

Each distinct value becomes a numbered token — [EMAIL_1], [PERSON_2]. Within one request the same value always gets the same token, so a model can still reason about identity: “[PERSON_1] applied twice” is a true sentence about one person.

Redact text

Detect only — no rewriting

Redact a file

Declare values you already know

Rules for one request only

Workspace & quota

Coverage catalogue

Leak Audit

Errors

Limits & billing

One request is one billable unit regardless of size, which is another reason to send a whole record in one call rather than field by field. Plans and allowances are on your dashboard; the live figures are below.

Recipes

Before you write any code: is there an MCP server already?

If the system holding the data ships an MCP server — most ATSs, CRMs and helpdesks now do — you may not need this API at all. Put the shield in front of that server and neither you nor the vendor writes an integration:

{ "mcpServers": { "ats": {
    "command": "node",
    "args": ["~/.claude/plugins/pii-shield/mcp-wrap.mjs",
             "--", "npx", "-y", "mcp-remote", "https://your-ats.example.com/mcp"],
    "env": { "PII_SHIELD_KEY": "shield_…" } } } }

Is your vendor's server remote or local? Most hosted ATS MCP servers — Greenhouse's among them — are https:// endpoints, not programs. There is nothing to spawn, so mcp-remote bridges the endpoint to stdio and the wrapper fronts the bridge; it handles the OAuth. A server that already runs locally needs no bridge — put its own command after the --. Take the URL from your vendor's documentation.

Tool results are redacted on the way to the model; the model's tokens are turned back into real values on the way out, so a follow-up find_by_email("[EMAIL_1]") still resolves. Tool names and schemas are untouched. It fails closed. Ships with the Claude Code plugin; see the guide.

Not doing the setup yourself? The guide has a copy-paste prompt that has Claude Code do it and then prove the redaction worked.

Node — redact before an LLM call

const r = await fetch(`https://piishield.ai/api/my/redact-document?key=${process.env.PII_SHIELD_KEY}`, {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ text: JSON.stringify(record), filename: "record.json", mediaType: "text/plain" }),
});
const out = await r.json();
if (!r.ok || out.error) throw new Error("PII Shield unavailable — refusing to send raw data");
await claude.messages.create({ /* … */ content: out.redacted });

Python

import os, requests
r = requests.post(
    "https://piishield.ai/api/my/redact-document",
    params={"key": os.environ["PII_SHIELD_KEY"]},
    json={"text": text, "filename": "record.txt", "mediaType": "text/plain"},
    timeout=30,
)
r.raise_for_status()
safe = r.json()["redacted"]

curl

curl -s "https://piishield.ai/api/my/redact-document?key=$PII_SHIELD_KEY" \
  -H 'content-type: application/json' \
  -d '{"text":"call jane@acme.com","filename":"n.txt","mediaType":"text/plain"}'