Redaction

The Foveus SDK applies redaction to help protect sensitive data before telemetry is sent to Foveus. Redaction applies to captured HTTP headers, captured JSON request and response bodies, and query-string parameters (see Query strings for the SDK version). It does not apply to log messages or exception messages.

Redaction is a safety layer. Do not intentionally send secrets, credentials, card data, or highly sensitive personal data to Foveus.

How redaction works

The SDK checks captured headers against the redacted header list, and keys in captured JSON request and response bodies against the redacted field list. When a field or header is redacted, Foveus stores a masked value instead of the original value. For example:

{
  "customerId": "cus_12345",
  "password": "secret-value"
}

becomes:

{
  "customerId": "cus_12345",
  "password": "***"
}

Redacted fields are not useful for context search because the original value is not indexed. The rules are:

Field names match exactly, ignoring case. password and Password are redacted; userPassword is not.
A string, number, boolean or null value under a redacted key is replaced with "***".
An object or array under a redacted key is not masked. Its contents are kept unless their own keys are redacted.
Bodies are redacted before they are truncated to MaxBodyCaptureSizeBytes (64 KB by default).

Default redaction

Foveus redacts these headers by default, plus any you add with RedactedHeaders:

Authorization
Cookie
Set-Cookie
X-API-Key
X-Auth-Token
Authentication

Foveus redacts these JSON field names by default, plus any you add with RedactedFields:

password
token
secret
key
creditCard
ssn
email
phone
address
accessToken
access_token
refreshToken
refresh_token
idToken
id_token
apiKey
api_key
clientSecret
client_secret
authorization
cardNumber
cvv
cvc
pin
otp

Query strings

A query-string parameter whose name is a redacted field has its value replaced with ***. Other parameters are stored as sent. Requires Foveus.SDK 1.1.0-beta.18 or later. Earlier versions store the whole query string as sent, so do not put secrets in query strings.

What is not redacted

Log messages, including structured log properties. Do not log secrets.
Exception messages.
Objects and arrays under a redacted key.
Keys that only contain a redacted name, such as userPassword or customerPhone. Add them to RedactedFields.

Add custom redacted fields

Add RedactedFields when your application uses domain-specific sensitive field names.

{
  "Foveus": {
    "ApiKey": "fov_test_...",
    "RedactedFields": ["nationalId", "accountNumber", "dateOfBirth"]
  }
}

Use this for fields your team considers sensitive. Because matching is exact, the default phone and address entries do not cover names such as customerPhone or homeAddress. Examples:

nationalId
accountNumber
dateOfBirth
customerPhone
homeAddress

Add custom redacted headers

Add RedactedHeaders when your service uses custom sensitive headers.

{
  "Foveus": {
    "ApiKey": "fov_test_...",
    "RedactedHeaders": ["x-internal-token", "x-session-secret"]
  }
}

Redaction and context search

Execution Context Search uses indexed context fields. If a field is redacted, Foveus does not index the original value. For example, if you redact accountNumber:

{
  "Foveus": {
    "ApiKey": "fov_test_...",
    "RedactedFields": ["accountNumber"]
  }
}

And your response contains:

{
  "accountNumber": "1234567890"
}

Foveus stores a masked value instead of the original. You should not expect this search to work:

service:orders-api context:accountNumber="1234567890"

Use a safer identifier instead, such as an internal customer ID, order ID, or request ID.

Redaction and searchable context policy

Foveus also applies a backend safety policy before indexing context for search. The backend refuses to index or search keys that are, or contain, any of these words:

password
passcode
pin
otp
token
authorization
cookie
secret
apikey
api_key
card
pan
cvv
cvc
bvn
nin

It also refuses values that look like tokens. Denylisted keys are not searchable, even if the SDK did not redact them. Because the check matches words inside keys, it can also block harmless keys that contain them, such as company (contains pan). This protects against accidentally indexing sensitive data.

Redaction is key-based

SDK redaction is based on field names and header names. For example, this is redacted because the key is sensitive:

{
  "token": "abc123"
}

But this is not redacted unless you configure the key:

{
  "sessionCredential": "abc123"
}

If your application uses custom names for sensitive values, add them to RedactedFields.

Response body capture

Response body capture can be useful for debugging business outcomes. For example:

{
  "orderStatus": {
    "value": 1,
    "label": "Confirmed"
  }
}

But response bodies can also contain sensitive data. Before enabling response body capture broadly, review:

what your APIs return
which fields should be redacted
whether response body capture is needed in production
whether a lower sampling rate is appropriate

Example:

{
  "Foveus": {
    "ApiKey": "fov_live_...",
    "CaptureResponseBodies": false,
    "RedactedFields": ["nationalId", "accountNumber", "dateOfBirth"]
  }
}

Request body capture

Request body capture helps debug what a client sent to your API. It can also contain sensitive data. Before enabling it broadly, review:

login and authentication routes
payment or account routes
profile update routes
file upload routes
high-volume endpoints

Use path filters when needed.

{
  "Foveus": {
    "ApiKey": "fov_live_...",
    "ExcludedPathPrefixes": ["/auth", "/health", "/metrics"],
    "RedactedFields": ["password", "otp", "nationalId"]
  }
}

Path filtering

Use path filters to skip routes that should not be captured.

{
  "Foveus": {
    "ApiKey": "fov_test_...",
    "ExcludedPathPrefixes": ["/health", "/metrics"]
  }
}

Use exact path exclusions for specific endpoints.

{
  "Foveus": {
    "ApiKey": "fov_test_...",
    "ExcludedExactPaths": ["/auth/login", "/auth/refresh"]
  }
}

IP addresses

IP address anonymization is on by default. It zeroes the last octet of an IPv4 client address, or the last 80 bits of an IPv6 address. It stays on in every capture profile; set AnonymizeIpAddresses to false to store full addresses.

{
  "Foveus": {
    "ApiKey": "fov_test_...",
    "AnonymizeIpAddresses": true
  }
}

Keep IP anonymization enabled unless you have a clear reason to disable it.

Recommended setup for production

The default Balanced profile captures request bodies and does not capture response bodies. If you need response context in production, enable response capture explicitly, together with redaction, sampling, and path exclusions. This lets Foveus show what your service or a third-party provider returned without storing unlimited raw payloads.

{
  "Foveus": {
    "ApiKey": "fov_live_...",
    "CaptureProfile": "Balanced",
    "CaptureRequestBodies": true,
    "CaptureResponseBodies": true,
    "ContextSamplingRate": 0.01,
    "ExcludedPathPrefixes": ["/health", "/metrics"],
    "RedactedFields": ["nationalId", "accountNumber", "dateOfBirth"]
  }
}

Use this setup when you need to:

inspect provider responses
search response fields with Execution Context Search
understand business failures returned inside HTTP 200 responses
debug user complaints without searching raw logs

For highly sensitive endpoints or services, disable body capture or exclude specific paths.

{
  "Foveus": {
    "ApiKey": "fov_live_...",
    "CaptureProfile": "HighThroughput",
    "CaptureRequestBodies": false,
    "CaptureResponseBodies": false,
    "ExcludedPathPrefixes": ["/health", "/metrics", "/auth"],
    "RedactedFields": ["nationalId", "accountNumber", "dateOfBirth"]
  }
}

If you enable response capture, exclude the routes that should not be captured.

Verify redaction

After changing redaction settings:

Trigger a test request.
Open the execution in Foveus.
Inspect request and response context.
Confirm sensitive fields are masked, including fields nested inside objects.
Confirm searchable context only includes safe values.

Use Test mode when validating redaction behavior.

Troubleshooting

A sensitive field is visible

Add the exact field name to RedactedFields. If the field holds an object or array, add the names of the sensitive keys inside it; a redacted key’s object or array value is not masked.

{
  "Foveus": {
    "ApiKey": "fov_test_...",
    "RedactedFields": ["sessionCredential"]
  }
}

Then trigger a new request. Redaction changes apply to newly captured telemetry.

A header is visible

Add the header name to RedactedHeaders.

{
  "Foveus": {
    "ApiKey": "fov_test_...",
    "RedactedHeaders": ["x-session-secret"]
  }
}

Context search cannot find a redacted value

That is expected. Redacted values are masked and are not indexed with their original value. Search using a safe identifier instead.

Too much context is being captured

Use one or more of:

CaptureProfile: "HighThroughput"
CaptureRequestBodies: false
CaptureResponseBodies: false
ContextSamplingRate
ExcludedPathPrefixes
ExcludedExactPaths

Next steps

Configure the SDK: SDK configuration
Review all options: FoveusOptions
Learn about context search: Execution Context Search
Review data safety and retention: Data safety and retention

Start here

Get started

Core concepts

Guides

SDK

Security and data

API reference

How redaction works

Default redaction

Query strings

What is not redacted

Add custom redacted fields

Add custom redacted headers

Redaction and context search

Redaction and searchable context policy

Redaction is key-based

Response body capture

Request body capture

Path filtering

IP addresses

Recommended setup for production

Verify redaction

Troubleshooting

A sensitive field is visible

A header is visible

Context search cannot find a redacted value

Too much context is being captured

Next steps