DLP

Restore PII

Replaces tokens produced by /v1/pii/redact (or by a redacting /v1/guard call) with the original values from the vault.

POST/v1/pii/unredact

Behavior

Tokens match [<LABEL>_<8 hex chars>]. Every occurrence of a known token is restored, even if the same token appears several times in one call.

Tokens that can't be resolved are left unchanged and the call still returns 200 — this covers expired vaults (see vault_ttl on Redact PII), tokens already consumed by a one-time restore, an unknown vault_id, or a different policy or account. Check tokens_restored to see how many were resolved.

Errors

Status	When
`401`	Missing or invalid API key.
`404`	`Policy '<slug>' not found` in the key's account.
`422`	Invalid body (e.g. `policy`, `vault_id` or `messages` missing).
`429`	Rate limit exceeded.
`500`	Internal error during restore.

Using this from an MCP gateway? See DLP in your own MCP gateway for the recommended session-vault setup.

Headers

Authorizationstringrequired

Bearer <GUARDION_API_KEY> — must belong to the same account that redacted.

Content-Typestringrequired

application/json.

Body Parameters

policystringrequired

The same policy slug used on the redact call. Vaults are scoped per account and policy.

vault_idstringrequired

Vault id returned by /v1/pii/redact (or vault_id from /v1/guard).

messagesMessage[]required

Messages containing tokens. Same shapes as /redact — tokens are found anywhere they could have been placed, including tool call arguments and tool results.

one_time_restoreboolean

Default true: each token is consumed once it has been restored, and later calls leave it as-is. Set false to keep tokens restorable until the vault TTL expires.

Response

messagesMessage[]

The messages with every resolvable token replaced by its original value.

restoredboolean

true if at least one token was restored.

tokens_restoredinteger

Number of token occurrences restored.

curl https://api.guardion.ai/v1/pii/unredact \
  -H "Authorization: Bearer $GUARDION_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "policy": "data-protection",
    "vault_id": "sess_42",
    "one_time_restore": false,
    "messages": [
      { "role": "assistant", "content": "Atualizei o cadastro do CPF [GOVERNMENT_ID_3F9A1B2C]." }
    ]
  }'

Response

{
  "messages": [
    {
      "role": "assistant",
      "content": "Atualizei o cadastro do CPF 419.815.118-06.",
      "tool_calls": null,
      "tool_call_id": null
    }
  ],
  "restored": true,
  "tokens_restored": 1
}