Redaction Policies API
Redaction policies strip or obscure sensitive data (PII, secrets, tokens) from webhook payloads and headers. A policy is a set of rules; each rule matches part of the payload and applies an action. Policies can apply org-wide or to a single source.
Endpoints
| Method | Path | Description |
|---|---|---|
| GET | /api/redaction-policies | List policies (optionally by source) |
| GET | /api/redaction-policies/{id} | Get a policy |
| POST | /api/redaction-policies | Create a policy |
| PUT | /api/redaction-policies/{id} | Update a policy |
| DELETE | /api/redaction-policies/{id} | Delete a policy |
| POST | /api/redaction-policies/preview | Preview rules against a sample payload |
Rule Model
A rule has a match and an action:
match.type | Matches |
|---|---|
path | A JSON path (e.g. data.card.number) |
field_name | Any field with this name, at any depth |
regex_value | Any value matching the regex (match.flags optional) |
header | A request header by name |
action.type | Effect |
|---|---|
redact | Replace the value with a fixed marker |
mask | Mask all but the last keepLastN characters |
hash | Replace with a hash of the value |
remove | Delete the field entirely |
Scope (scope) controls where a policy applies: storage (what Hookbase stores), delivery (what's forwarded to destinations), or both.
Policy Object
{
"id": "rdp_abc123",
"organizationId": "org_123",
"sourceId": "src_stripe",
"name": "Mask card numbers",
"scope": "both",
"isActive": true,
"rules": [
{
"match": { "type": "path", "value": "data.object.card.number" },
"action": { "type": "mask", "keepLastN": 4 }
},
{
"match": { "type": "field_name", "value": "cvc" },
"action": { "type": "remove" }
}
],
"createdAt": "2024-01-15T10:30:00Z",
"updatedAt": "2024-01-15T10:30:00Z"
}List Policies
GET /api/redaction-policiesQuery Parameters
| Parameter | Type | Description |
|---|---|---|
| sourceId | string | Only policies scoped to this source |
Create Policy
POST /api/redaction-policiesRequest Body
| Field | Type | Required | Description |
|---|---|---|---|
| name | string | Yes | Display name |
| rules | Rule[] | Yes | Array of { match, action } rules |
| scope | string | Yes | storage, delivery, or both |
| sourceId | string | No | Scope to a single source (omit for org-wide) |
Example
curl -X POST https://api.hookbase.app/api/redaction-policies \
-H "Authorization: Bearer whr_your_api_key" \
-H "Content-Type: application/json" \
-d '{
"name": "Mask card numbers",
"scope": "both",
"sourceId": "src_stripe",
"rules": [
{ "match": { "type": "path", "value": "data.object.card.number" },
"action": { "type": "mask", "keepLastN": 4 } }
]
}'Update Policy
PUT /api/redaction-policies/{id}Send the full policy (name, rules, scope, sourceId, isActive) — PUT replaces the policy.
Preview
Test a rule set against a sample payload (and optional headers) without saving anything. Returns the redacted result plus how many values were changed.
POST /api/redaction-policies/previewRequest Body
| Field | Type | Required | Description |
|---|---|---|---|
| rules | Rule[] | Yes | Rules to apply |
| payload | object | Yes | Sample payload |
| headers | object | No | Sample headers |
Response
{
"payload": { "data": { "object": { "card": { "number": "************4242" } } } },
"headers": {},
"redactionCount": 1,
"fired": true
}Info
Redaction runs before payloads are stored and/or delivered based on scope. For related field-level controls, see the Field Encryption guide.