Schema Sample Redactor

Overview

You send a JSON Schema, an OpenAPI document, or any JSON object, and we replace the values that look sensitive — addresses, JWTs, AWS keys, private keys, card and IBAN numbers, and anything under a credential-sounding field name — with a safe placeholder or a mask. The structure, the keys, and the schema constraints all stay exactly as they were, so the document still validates and still reads the same. This catches the common shapes rather than everything, so it is a strong safety net before you publish and not a compliance guarantee.

Example values are written in a hurry against a real account, and then they live in the docs forever. Reading a whole document looking for the one address or token that should not be public is exactly the job a machine should do.

When to use it

Scope

Non-goals

• We never promise complete removal; this catches known shapes, not everything
• We never touch schema constraints, so a format of email still says email
• We never scan free-running prose for secrets — that is security.detect_secrets

Properties

Capabilities

Cost & billing

Flat rate per invocation

File handling

How we handle your data

Input schema

Output schema

API contract

curl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"schema.redact_schema_samples","input":{"document":{"example":"[email protected]"}}}'

import { Squillify } from "@squillify/sdk";

const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });

const { output } = await sq.execute("schema.redact_schema_samples", {"document":{"example":"[email protected]"},"documentKind":"generic_json"});

Errors

Other limits

Limitations

• We never promise complete removal; this catches known shapes, not everything
• We never touch schema constraints, so a format of email still says email
• We never scan free-running prose for secrets — that is security.detect_secrets
• Anything that needs a guarantee of complete personal-data removal
• Scanning free text or source files for secrets (security.detect_secrets)

How to call

POST /v1/execute (requires authentication)

{
  "skillKey": "schema.redact_schema_samples",
  "input": {
    "document": {
      "example": "[email protected]"
    },
    "documentKind": "generic_json"
  }
}

Examples

{
  "document": {
    "example": "[email protected]"
  },
  "documentKind": "generic_json"
}

{
  "redacted": {
    "example": "<REDACTED:email>"
  },
  "findings": [
    {
      "kind": "email",
      "path": "/example",
      "confidence": 0.8,
      "replacement": "<REDACTED:email>"
    }
  ],
  "findingCount": 1
}

{
  "includeReport": false,
  "replacementStyle": "mask",
  "policy": "strict",
  "document": {
    "token": "sk_live_abc123"
  }
}

{
  "findingCount": 1,
  "redacted": {
    "token": "sk**********23"
  }
}

Recommended use cases

• Clean the example values before you publish API documentation
• Share a schema or payload with an outside tool without shipping real data
• Catch the credential someone pasted into an OpenAPI example months ago

Avoid for

• Anything that needs a guarantee of complete personal-data removal
• Scanning free text or source files for secrets (security.detect_secrets)

Related skills

Composable with

Safety & privacy

• Runs without calling any external service.
• Your payloads are never stored permanently.
• Telemetry captures metadata only — never your payload contents.
• We never train models on your payloads.
• No human reviews your payloads.

Tags