Getting started with PII Detection API is simple. Sign up, grab your API key, and send a single JSON request to find, classify, and locate sensitive data in any text. One endpoint, structured results with character offsets and confidence scores, and an optional masked output when you need it.
From signup to a parsed detected_entities array in under 5 minutes. No SDK required — any HTTP client works.
Pick the plan that matches your monthly scanning volume on the pricing page and register. Every plan includes the full detection engine: all 150+ entity types, custom detection instructions, confidence scores, and every mask mode. If you want to see results before signing up, try the interactive demo first.
1 minuteYour API key is shown in the dashboard right after registration. It authenticates every request, so treat it like a password: keep it out of source control and load it from an environment variable or secret manager.
30 secondsexport PII_API_KEY="your_api_key_here"
POST a JSON body to the detection endpoint. Only three fields are required: your api_key, the api_type value "pii_detection", and the text to scan (up to 50,000 characters per request). Everything else — entity filters, mask mode, threshold — is optional.
curl -X POST "https://piidetectionapi.com/api/moderate.php" \ -H "Content-Type: application/json" \ -d '{ "api_key": "YOUR_API_KEY", "api_type": "pii_detection", "text": "Contact John Doe at [email protected] or 555-123-4567." }'
The response is structured JSON. Iterate over detected_entities to get each finding's type, matched text, character offsets, and confidence score — and use anonymized_text if you asked for a masked copy of the input.
{
"detected_entities": [
{"type": "PERSON_NAME", "text": "John Doe", "start": 8, "end": 16, "confidence": 0.95},
{"type": "EMAIL_ADDRESS", "text": "[email protected]", "start": 20, "end": 36, "confidence": 0.98}
],
"anonymized_text": "Contact [NAME] at [EMAIL] ...",
"entities_detected": 2,
"processing_time_ms": 187,
"mask_mode_used": "replace",
"status": 200
}
The API is plain JSON over HTTPS — no proprietary SDK to learn. These snippets send the same detection request from Python, Node.js, and PHP.
import os, requests resp = requests.post( "https://piidetectionapi.com/api/moderate.php", json={ "api_key": os.environ["PII_API_KEY"], "api_type": "pii_detection", "text": "Contact John Doe at [email protected] or 555-123-4567.", "mask_mode": "replace", }, timeout=30, ) data = resp.json() for e in data["detected_entities"]: print(e["type"], e["text"], e["start"], e["end"], e["confidence"])
const resp = await fetch("https://piidetectionapi.com/api/moderate.php", { method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ api_key: process.env.PII_API_KEY, api_type: "pii_detection", text: "Contact John Doe at [email protected] or 555-123-4567.", mask_mode: "replace" }) }); const data = await resp.json(); for (const e of data.detected_entities) { console.log(e.type, e.text, e.start, e.end, e.confidence); }
<?php $ch = curl_init("https://piidetectionapi.com/api/moderate.php"); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HTTPHEADER, ["Content-Type: application/json"]); curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([ "api_key" => getenv("PII_API_KEY"), "api_type" => "pii_detection", "text" => "Contact John Doe at [email protected] or 555-123-4567.", ])); $data = json_decode(curl_exec($ch), true); foreach ($data["detected_entities"] as $e) { echo $e["type"] . ": " . $e["text"] . PHP_EOL; } ?>
Every response gives you a complete, machine-readable picture of what was found — not just a scrubbed string. That makes the API equally useful for compliance audits, DLP alerting, log scanning, and pre-processing text before it reaches an LLM.
type: The entity classification, such as PERSON_NAME, EMAIL_ADDRESS, SSN, or CREDIT_CARD_NUMBER — one of 150+ supported types listed on the entities page.
text, start, end: The exact matched text and its character offsets in your input, so you can highlight findings, build your own redaction layer, or map detections back to source documents.
confidence: A score from 0 to 1 for each detection. Combine it with the request-level threshold parameter to trade precision against recall for your use case.
anonymized_text & entities_detected: An optional masked copy of the input plus summary counts and processing_time_ms for monitoring.
By default the API scans for all 150+ entity types. In production you usually want a narrower, faster signal — and the request body gives you precise control.
entities: An allowlist of types to detect, e.g. ["PERSON_NAME", "EMAIL_ADDRESS", "SSN"]. Anything not listed is ignored.
exclude_entities: The inverse — detect everything except the listed types. Handy when, say, URLs or countries are expected content rather than sensitive data.
threshold: Minimum confidence from 0 to 1 (default 0.5). Raise it to cut false positives in noisy text; lower it when missing a real identifier is the bigger risk.
custom_instruction: Up to 500 characters of natural-language guidance, such as "do not flag employee names of our own support staff" — no regex required.
resp = requests.post( "https://piidetectionapi.com/api/moderate.php", json={ "api_key": os.environ["PII_API_KEY"], "api_type": "pii_detection", "text": ticket_text, "entities": ["PERSON_NAME", "EMAIL_ADDRESS", "PHONE_NUMBER"], "threshold": 0.7, }, timeout=30, )
Detection always returns the entity list. The mask_mode parameter controls how anonymized_text is produced when you also want a safe copy of the input.
| mask_mode | What it does | Example output | Best for |
|---|---|---|---|
| replace | Default. Substitutes each entity with a typed placeholder, preserving readability and meaning. | Contact [NAME] at [EMAIL] |
Support tickets, chat logs, LLM prompts where context must survive |
| redact | Removes the detected entities from the text entirely. | Contact at |
Publishing, FOIA-style disclosure, strict minimization |
| hash | Replaces each entity with a consistent hash, so the same value always maps to the same token. | Contact 3f9a1c… at b82e77… |
Analytics, deduplication, joining records without exposing identities |
curl -X POST "https://piidetectionapi.com/api/moderate.php" \ -H "Content-Type: application/json" \ -d '{ "api_key": "YOUR_API_KEY", "api_type": "pii_detection", "text": "Refund issued to [email protected] for card 4111 1111 1111 1111.", "entities": ["EMAIL_ADDRESS", "CREDIT_CARD_NUMBER"], "mask_mode": "hash" }'
Every plan includes all 150+ entity types, custom detection instructions, and every mask mode. Pick a monthly word volume — upgrade any time.
1.5 million words per month — perfect for growing teams
9 million words per month — scale with confidence
500M+ words, tailored terms for large organizations
A few habits make PII detection reliable in production, whether you are scanning support tickets, application logs, or text headed into an LLM.
Chunk large inputs: Each request accepts up to 50,000 characters. Split longer documents on natural boundaries (paragraphs, log lines) and remember that offsets in detected_entities are relative to the text you sent in that request.
Handle errors and retries: Check the response status field, apply retries with exponential backoff for transient network failures, and set a sensible client timeout (30 seconds is a good default).
Tune the threshold per use case: Start at the default 0.5, then review real detections. Compliance scans usually favor recall (lower threshold); user-facing filters favor precision (higher threshold).
Watch your quota: Usage is measured in words and returned in every response, so you can alert before hitting your monthly plan limit and upgrade in time.
What Is PII Detection?Deepen your integration with entity references, language coverage, and use-case guides.
Common questions about setting up and using the PII Detection API.
Detect, classify, and locate PII with context-aware AI. Try the live demo or pick a plan and send your first request today.