Supported Entity Types

150+

Entity Types

How this reference works: every entity name below is a value you can pass in the entities array of a request to detect only those types, or in exclude_entities to skip them. Omit both to detect everything. Each detection in the response includes type, text (the exact match), start/end character offsets, and a confidence score between 0 and 1. Try any of them live in the interactive demo.

Personal Identifiers

The core of PII: values that name or directly describe a specific person. These are detected contextually by the transformer NER model, so "John Smith" in a signature is found even when no label like "Name:" precedes it.

Entity Type	Example	Description
PERSON_NAME	John Smith, Dr. Jane Wilson	Full or partial person names: first, middle, last names, initials, nicknames, and names with honorifics, in any of the 60+ supported languages.
DATE_OF_BIRTH	03/15/1985, March 15, 1985	Birth dates in numeric or written formats. A key identifier under GDPR and one of the 18 HIPAA identifiers.
AGE	40 years old, born in 1985	Explicit ages and age-revealing phrases that can identify a person in combination with other data.
EMPLOYMENT	Senior DBA at Acme Corp	Job titles combined with employers, employee IDs, and other workplace identifiers.

Detect only personal identifiers — cURL
curl -X POST https://piidetectionapi.com/api/moderate.php \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",
    "api_type": "pii_detection",
    "text": "Signed by John Smith, born 03/15/1985.",
    "entities": ["PERSON_NAME", "DATE_OF_BIRTH", "AGE"]
  }'

Contact Information

Ways to reach a person. Contact data appears in nearly every support ticket, CRM export, and email thread, and it is the most common category found in application logs.

Entity Type	Example	Description
EMAIL_ADDRESS	[email protected]	Email addresses in any format, including obfuscated variants like "john [at] example.com".
PHONE_NUMBER	+1 (555) 123-4567	Phone and fax numbers in international and national formats for every country — see language & country coverage.
URL	https://linkedin.com/in/jsmith	URLs, including personal profile links and links containing identifying query parameters.

Detect contact data — Python
resp = requests.post(
    "https://piidetectionapi.com/api/moderate.php",
    json={
        "api_key": "YOUR_API_KEY",
        "api_type": "pii_detection",
        "text": ticket_body,
        "entities": ["EMAIL_ADDRESS", "PHONE_NUMBER", "URL"],
    },
    timeout=30,
)

Government-Issued IDs

Official identification numbers. These carry the highest re-identification risk and are regulated identifiers under GDPR, CCPA, and HIPAA. The model recognizes country-specific formats (SSN, NINO, Steuer-ID, Aadhaar, and many more).

Entity Type	Example	Description
SSN	123-45-6789	US Social Security Numbers, with or without dashes, including SSNs written in prose.
NATIONAL_ID	QQ123456C (UK NINO)	National identity numbers in country-specific formats worldwide.
TAX_ID	98-7654321 (EIN)	Tax identification numbers: EIN, VAT IDs, and national tax references.
PASSPORT_NUMBER	545402246	Passport numbers from any issuing country, usually detected via surrounding context.
DRIVERS_LICENSE_NUMBER	D6101-40706-60905	Driver's license numbers across jurisdictions, including US state-specific formats.

Detect government IDs — JavaScript (Node fetch)
const resp = await fetch("https://piidetectionapi.com/api/moderate.php", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    api_key: "YOUR_API_KEY",
    api_type: "pii_detection",
    text: document_text,
    entities: ["SSN", "NATIONAL_ID", "TAX_ID", "PASSPORT_NUMBER", "DRIVERS_LICENSE_NUMBER"],
  }),
});
const data = await resp.json();

Financial & PCI Data

Cardholder data and banking identifiers regulated by PCI DSS. Finding stray card numbers in tickets, chat logs, and databases is a core cardholder-data-discovery requirement — see the PCI DSS discovery guide.

Entity Type	Example	Description
CREDIT_CARD_NUMBER	4111-1111-1111-1111	Credit and debit card PANs (Visa, Mastercard, Amex, Discover, and more), spaced, dashed, or contiguous.
CREDIT_CARD_EXPIRATION_DATE	12/27	Card expiration dates when they appear in a payment context.
CVV_NUMBER	123	Card verification codes (CVV/CVC/CID). Storing these post-authorization is prohibited by PCI DSS.
FINANCIAL_ACCOUNT_NUMBER	8901234567	Bank and brokerage account numbers, detected via context to avoid flagging arbitrary digits.
IBAN_CODE	DE89 3704 0044 0532 0130 00	International Bank Account Numbers with country-specific lengths and checksum structure.
SWIFT_BIC	COBADEFFXXX	SWIFT/BIC bank identifier codes (8 or 11 characters).
ROUTING_NUMBER	021000021	US ABA routing numbers used for wires and ACH transfers.

PCI sweep with a high confidence threshold — cURL
curl -X POST https://piidetectionapi.com/api/moderate.php \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",
    "api_type": "pii_detection",
    "text": "Card 4111 1111 1111 1111 exp 12/27 CVV 123, IBAN DE89370400440532013000",
    "entities": ["CREDIT_CARD_NUMBER", "CVV_NUMBER", "IBAN_CODE", "ROUTING_NUMBER"],
    "threshold": 0.8
  }'

Medical & PHI Data

Protected Health Information under HIPAA. Beyond record numbers, the model detects free-text clinical content — diagnoses, prescriptions, treatments — that regex approaches cannot find. See the HIPAA 18-identifiers guide.

Entity Type	Example	Description
MEDICAL_RECORD_NUMBER	MRN 445-92-1187	Medical record numbers assigned by hospitals and clinics.
HEALTH_INSURANCE_ID	BCBS-882910334	Health plan beneficiary and member ID numbers.
DIAGNOSIS	Type 2 Diabetes (E11.9)	Medical diagnoses in free text, with or without ICD codes.
PRESCRIPTION	Metformin 500mg twice daily	Medication names, dosages, and prescription instructions.
TREATMENT	chemotherapy, dialysis	Procedures, therapies, and treatment plans.
MEDICAL_DATA	lab result HbA1c 8.2%	General clinical facts: symptoms, observations, lab values, visit dates in a medical context.
MEDICAL_TERM	hypertension	Medical terminology that can reveal a person's health status.
BLOOD_TYPE	O-	Blood group information.
BIOMETRIC_DATA	fingerprint template ID	Biometric identifiers: fingerprint, facial, voiceprint, retinal, and genetic references.

PHI scan of a clinical note — Python
resp = requests.post(
    "https://piidetectionapi.com/api/moderate.php",
    json={
        "api_key": "YOUR_API_KEY",
        "api_type": "pii_detection",
        "text": discharge_summary,
        "entities": ["MEDICAL_RECORD_NUMBER", "HEALTH_INSURANCE_ID",
                     "DIAGNOSIS", "PRESCRIPTION", "PERSON_NAME", "DATE_OF_BIRTH"],
        "mask_mode": "replace",  # also get a de-identified copy back
    },
    timeout=30,
)

Credentials & Secrets

Not classic PII, but the most dangerous data to leak: keys and passwords pasted into tickets, prompts, or logs grant direct system access. Scanning for this category is central to LLM guardrails and log scanning.

Entity Type	Example	Description
PASSWORD	Sup3rS3cret!	Passwords appearing in prose, config fragments, or credential pairs.
API_KEY	sk_live_51Hxk9aB2cD3e...	API keys and secret keys from common providers and generic high-entropy keys.
AUTH_TOKEN	Bearer eyJhbGciOiJI...	Bearer tokens, JWTs, session and OAuth tokens.
AWS_CREDENTIALS	AKIAIOSFODNN7EXAMPLE	AWS access key IDs, secret access keys, and session tokens.
AZURE_AUTH_TOKEN	eyJ0eXAiOiJKV1Qi... (AAD)	Azure AD tokens and service principal credentials.
GCP_CREDENTIALS	"type": "service_account"...	Google Cloud service account keys and API keys.
SSH_KEY / PRIVATE_KEY	-----BEGIN RSA PRIVATE KEY-----	SSH and cryptographic private key material (RSA, ECDSA, Ed25519, PEM blocks).
DATABASE_CONNECTION_STRING	postgres://user:pass@host/db	Connection strings embedding usernames, passwords, and hosts.

Secret scan before sending a prompt to an LLM — JavaScript
const scan = await fetch("https://piidetectionapi.com/api/moderate.php", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    api_key: "YOUR_API_KEY",
    api_type: "pii_detection",
    text: userPrompt,
    entities: ["API_KEY", "PASSWORD", "AWS_CREDENTIALS", "AUTH_TOKEN",
               "PRIVATE_KEY", "DATABASE_CONNECTION_STRING"],
  }),
}).then(r => r.json());
// block or mask before the prompt leaves your perimeter
if (scan.entities_detected > 0) { userPrompt = scan.anonymized_text; }

Location Data

Where a person lives, works, or currently is. Full street addresses are direct identifiers; even city plus ZIP can re-identify people in small populations, which is why geography is quasi-identifying data under GDPR and HIPAA.

Entity Type	Example	Description
ADDRESS	123 Main St, Apt 4B, Austin, TX 78701	Full or partial street and mailing addresses, in local formats worldwide.
CITY	San Francisco	City and town names when they refer to a person's location.
STATE	California, CA	State, province, and region names or codes.
ZIP_CODE	90210, SW1A 1AA	Postal and ZIP codes, including alphanumeric formats such as UK postcodes.
COUNTRY	United Kingdom	Country names and ISO codes in a personal context.
GPS_COORDINATES	37.7749, -122.4194	Latitude/longitude pairs and geotags.

Detect location data but keep countries — cURL
curl -X POST https://piidetectionapi.com/api/moderate.php \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",
    "api_type": "pii_detection",
    "text": "Ship to 123 Main St, Austin, TX 78701, USA",
    "entities": ["ADDRESS", "CITY", "ZIP_CODE", "GPS_COORDINATES"],
    "exclude_entities": ["COUNTRY"]
  }'

Device & Network Data

Online identifiers that GDPR explicitly counts as personal data. This category dominates application logs, analytics events, and security telemetry — the focus of log file PII scanning.

Entity Type	Example	Description
IP_ADDRESS	203.0.113.55, 2001:db8::1	IPv4 and IPv6 addresses.
MAC_ADDRESS	00:1A:2B:3C:4D:5E	Hardware MAC addresses.
DEVICE_ID	550e8400-e29b-41d4-a716-...	Device identifiers: UUID/UDID, advertising IDs, and vendor IDs.
IMEI	353456789012345	Mobile equipment identity numbers.
SERIAL_NUMBER	SN-ABC123456	Hardware and product serial numbers.
COOKIE	session_id=a1b2c3d4...	Cookie values, session IDs, and tracking identifiers.
USER_AGENT	Mozilla/5.0 (Windows NT 10.0...)	Browser user-agent strings usable for fingerprinting.

Scrub network identifiers from a log line — Python
resp = requests.post(
    "https://piidetectionapi.com/api/moderate.php",
    json={
        "api_key": "YOUR_API_KEY",
        "api_type": "pii_detection",
        "text": log_line,
        "entities": ["IP_ADDRESS", "MAC_ADDRESS", "DEVICE_ID", "COOKIE"],
        "mask_mode": "hash",  # consistent hashes keep logs joinable
    },
    timeout=30,
)

Demographic Data

Attributes about who a person is. Several of these are GDPR Article 9 "special category" data, subject to the strictest processing rules, and protected characteristics under anti-discrimination law — important for HR and recruiting workflows.

Entity Type	Example	Description
GENDER	female, non-binary	Gender and sex identifiers.
ETHNIC_GROUP	Hispanic, Han Chinese	Race, ethnicity, and national-origin references. GDPR special category.
RELIGION	Catholic, Muslim	Religious or philosophical beliefs. GDPR special category.
POLITICAL_AFFILIATION	Labour member	Political opinions and party membership. GDPR special category.
SEXUAL_ORIENTATION	gay, bisexual	Sexual orientation information. GDPR special category.
MARITAL_STATUS	married, divorced	Marital and family status.

Special-category audit of survey answers — cURL
curl -X POST https://piidetectionapi.com/api/moderate.php \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_API_KEY",
    "api_type": "pii_detection",
    "text": "Respondent: 42, married, practicing Catholic, votes Green.",
    "entities": ["ETHNIC_GROUP", "RELIGION", "POLITICAL_AFFILIATION", "SEXUAL_ORIENTATION", "MARITAL_STATUS"]
  }'

Using Entity Types in Requests

1. Detect everything (default) — omit entities and exclude_entities; all 150+ types are scanned:

{
  "api_key": "YOUR_API_KEY",
  "api_type": "pii_detection",
  "text": "Contact John Doe at [email protected] or 555-123-4567."
}

2. Detect specific types only — pass an allowlist in entities:

{
  "api_key": "YOUR_API_KEY",
  "api_type": "pii_detection",
  "text": "...",
  "entities": ["PERSON_NAME", "EMAIL_ADDRESS", "SSN"]
}

3. Skip types you don't care about — pass a blocklist in exclude_entities:

{
  "api_key": "YOUR_API_KEY",
  "api_type": "pii_detection",
  "text": "...",
  "exclude_entities": ["URL", "COUNTRY", "MEDICAL_TERM"]
}

4. Tune precision vs. recall — raise threshold (default 0.5) to keep only high-confidence detections, and use custom_instruction for natural-language exceptions:

{
  "api_key": "YOUR_API_KEY",
  "api_type": "pii_detection",
  "text": "...",
  "threshold": 0.8,
  "custom_instruction": "Do not flag 'Acme Corp' or the product name 'ProductX'"
}

Response fields to use: read detections from detected_entities (each with type, text, start, end, confidence); entities_detected gives the total count. If you set a mask_mode (replace, redact, or hash), the privacy-safe copy is returned in anonymized_text.

See These Entity Types Detected Live

Paste your own text into the interactive demo, or follow the tutorial to run your first detection request in minutes.

Try the Live Demo First Request Tutorial API Documentation

Jump to category

See These Entity Types Detected Live