Uploads a document to the vault, handing back a reference ID. The document is immutable: repeating this operation results in a new stored document and reference ID.

Download the original document given the document ID

Delete a document with a given ID

Retrieve Data Security Risks discovered across your integrated applications. Query and filter risks by application type, date ranges, sensitive data types, and other criteria. The response includes detailed risk records, aggregated statistics, and applied policies to help you understand and remediate security risks.

Retrieve audit events for monitoring user actions and system activities. Query and filter events by date ranges, email addresses, and other criteria to track who performed which actions and when they occurred.

Send sensitive data to the vault, handing back a reference identifier. The token is immutable after creation unless your API key grants additional permissions to perform an update or deletion. By default, a new token is generated for each request unless idempotent: true is specified.

Delete an existing token. Access to this API is restricted to server-to-server connections. Please contact Strac to add your IP addresses to the allowlist only for live.

Update an existing token's value and type. Updates to tokens created with idempotency, as well as updates to tags, are not supported. Access to this API is restricted to server-to-server connections. Please contact Strac to add your IP addresses to the allowlist only for live.

Send up to 200 sensitive data elements to the vault, handing back reference identifiers for each data element. The tokens are immutable after creation unless your API key grants additional permission to perform an update or deletion. Each requests produces a new set of tokens. If any of the data elements in the request fail to be created, the entire request will fail.

Search for tokens by data. Access to this API is restricted to server-to-server connections. Please contact Strac to add your IP addresses to the allowlist only for live.

Search for tokens by tag. Access to this API is restricted to server-to-server connections. Please contact Strac to add your IP addresses to the allowlist only for live.

Extract information about the token without revealing the original sensitive data in full. For example, last four digits of a social security number. See HTTP 200 Success response schema for supported token types and attributes that can be revealed.

Retrieve the original sensitive data for up to 10 tokens. Access to this API is restricted to server-to-server connections. Please contact Strac to add your IP addresses to the allowlist only for live. For browser-to-server use cases, see Detokenize Proxy.

Detect sensitive data from a document or text

Performs redaction against a document in the vault. To retrieve the redacted document you will need to call Get redacted document API.

Here is an example of a W2 Tax Return and how it looks like after redaction:

Performs redaction against inline text content. The way text is redacted depends on the redact field mode; for modes that replace sensitive text with a link to the Strac document vault, you must onboard with the Strac vault website and supply a base strac endpoint.

For example, with input text: Please onboard the user with SSN 123-45-6789 and type text, the redaction would produce: Please onboard the user with SSN <sensitive_data: https://test.strac.io/#/detokenize/tkn_0QLgEGZSerpfuFSEbotIN75o>.

Download the redacted document given the document ID

Retrieve token identifiers within a redacted document.

Performs anonymization against a Google Sheet document. This API aims to provide an extra layer of privacy and security to your spreadsheets by replacing sensitive fields like phone numbers, names, emails, and ZIP codes with pseudonyms or tokens. It integrates seamlessly with your Google Workspace through domain-wide delegation and can run on a recurring basis.

To integrate with your Google Workspace, please reach out to hello@strac.io.

Restores an anonymized Google Sheet document in a specified Google Drive folder. This API reverses the effects of the anonymize Google Sheets operation.

To integrate with your Google Workspace, please reach out to hello@strac.io.

Retrieves recurring anonymization jobs.

Send any HTTP request (e.g., POST, PUT, PATCH, GET, DELETE, and OPTIONS) to third-party using tokens in place of sensitive data. Please contact Strac to add the third-party URL and schema into the allow list.

Call flow from your back-end servers (client) to third-party does not change except for the following:

(1) you will call Strac's proxy instead of the third-party directly

(2) you can send tokens instead of sensitive data such as API keys and SSN

(3) you can receive tokens for sensitive data you expect in the response

The diagram below illustrates the standard call flow:

If an error occurs due to integration with Strac (e.g., authentication, configuration, outage), a x-strac-error header will be set with the value true. This header will not be set if the failure is caused by third-party errors.

Send any HTTP request (e.g., POST, PUT, PATCH, GET, DELETE, and OPTIONS) to a third-party service but with sensitive data replaced by redacted, non-sensitive equivalents. This ensures the security and privacy of the original information while still enabling interactions with third-party services such as Large Language Models (LLMs). Please contact Strac to add the third-party URL and schema into the allow list.

Call flow from your back-end servers (client) to third-party does not change except for the following:

(1) you will call Strac's proxy instead of the third-party directly

(2) your sensitive data such as SSN, passport numbers will be replaced with a non-sensitive equivalent (e.g., [REDACTED])

The diagram below illustrates the standard call flow:

If an error occurs due to integration with Strac (e.g., authentication, configuration, outage), a x-strac-error header will be set with the value true. This header will not be set if the failure is caused by third-party errors.

Retrieve the original sensitive data from browsers and apps for up to 10 tokens. When this API is invoked, the request headers and body are forwarded to your authorization server for end-user authorization. Once the request is authorized, the original sensitive data will be returned to the caller.

The diagram below illustrates the standard call flow:

Receive any HTTP webhook requests from third-party using tokens in place of sensitive data. Please contact Strac to generate a webhookId and setup your API endpoint.

Call flow from third-party servers to your servers does not change except for the following:

(1) you will configure the webhook to call Strac's proxy instead of your own endpoint

(2) you can receive tokens instead of sensitive data such as SSN and bank account numbers

(3) you can send tokens instead of sensitive data such as SSN and bank account numbers

The diagram below illustrates the standard call flow:

Send any request to third-party using tokens in place of sensitive data through your function hosted on Strac. Please contact Strac to upload your function and enable communication with the third-party.

Functions are small programs (e.g., NodeJS function) that send sensitive data to third-party APIs. Hosted functions give you the power of standard programming languages to perform advanced integrations that are harder to do using Strac's default schema based outbound proxy API. Suitable use cases include integrations that rely on thick clients or custom protocols.

Your call flow from your back-end servers (client) to third-party will need to change in the following ways when hosting functions on Strac:

(1) you will call Strac's proxy instead of the third-party directly

(2) your function will need to take inputs from Strac instead of directly from your back-end servers

(3) you can send tokens instead of sensitive data such as crypto keys and SSN

(4) you can receive tokens for sensitive data you expect in the response

The diagram below illustrates the standard call flow:

In order for the hosted functions to interoperate with Strac, it must make the following changes:

(1) it must expose a single handler that takes in an object that represents the request.

(2) it must return a JSON payload that represent the HTTP response for the calling client.

The example below illustrate this for a NodeJS function:

  // Imports will need to be declared in a standard package.json file not shown here
  const fooClient = require('foo-thick-lib');

  // Request is a dictionary that contains detokenized input sent by the calling client,
  // we will use the curl example here
  async function run(request) {
    // string containing plaintext tin after token tkn_lT8RtnYLfpmfecvAfWqzlMnO has been detokenized (see curl example)
    const tin = request.tin;
    // the number 26 (see curl example)
    const age = request.citizenship.age;
    return await fooClient.call(tin, age);
  }

  exports.handler = async (request) => {
      const result = await run(request);
      return {
        statusCode: 200,
        headers: {"Content-Type": "application/json"},
        body: JSON.stringify(result)
      }
  }