How to Redact Data Leaks in Text Using AI in PHP

Regex patters for PII detection don’t age too well. The moment someone adds a new phone number format, or a credential shows up in an unexpected position, there’s suddenly a significant gap in your carefully maintained PII pattern library.

With an AI text redaction API, you can handle PII detection and removal in a single API call across a wide range of data types without a pattern library to babysit. For PHP pipelines that need to scrub sensitive data before it hits some log or third-party tool, implementing this kind of API is easy and sensible. Let’s walk through how to implement one such API in PHP.

SDK Installation

First, we’ll install the API client with this composer command:

composer require cloudmersive/cloudmersive_dlp_api_client

Making the API call

Next, we’ll use the below PHP example code to structure our request. The request body takes our InputText , an Allow flag for each supported data type, and a RedactionMode . With theSemanticTag setting, detected values get replaced with labeled tags rather than asterisks, which keeps the structure readable while stripping out the sensitive data; you can swap to asterisks if you prefer the other way around.

<?php
require_once(__DIR__ . '/vendor/autoload.php');

$config = Swagger\Client\Configuration::getDefaultConfiguration()->setApiKey('Apikey', 'YOUR_API_KEY');

$apiInstance = new Swagger\Client\Api\RedactApi(
    new GuzzleHttp\Client(),
    $config
);
$body = new \Swagger\Client\Model\DlpRedactionRequest();

try {
    $result = $apiInstance->redactText($body);
    print_r($result);
} catch (Exception $e) {
    echo 'Exception when calling RedactApi->redactText: ', $e->getMessage(), PHP_EOL;
}
?>

Here’s what the full request model looks like:

{
  "InputText": "Hello, world!",
  "AllowEmailAddress": false,
  "AllowPhoneNumber": false,
  "AllowStreetAddress": false,
  "AllowPersonName": false,
  "AllowBirthDate": false,
  "AllowPassportNumber": false,
  "AllowDriversLicense": false,
  "AllowSocialSecurityNumber": false,
  "AllowTaxpayerID": false,
  "AllowCreditCardNumber": false,
  "AllowCreditCardExpirationDate": false,
  "AllowCreditCardVerificationCode": false,
  "AllowBankAccountNumber": false,
  "AllowIBAN": false,
  "AllowHealthInsuranceNumber": false,
  "AllowBearerToken": false,
  "AllowHttpCookie": false,
  "AllowPrivateKeys": false,
  "AllowCredentials": false,
  "AllowDeepWebUrls": false,
  "AllowSourceCode": false,
  "AllowIpAddress": false,
  "AllowMacAddress": false,
  "RedactionMode": "SemanticTag"
}

What comes back

In the API response, you’ll get a RedactedText string with disallowed data types scrubbed clean. Additionally, you’ll get a top-level CleanResult Boolean and individual Contains flags for each of the detectable data types.

{
  "RedactedText": "string",
  "CleanResult": true,
  "ContainsEmailAddress": true,
  ...
  "ContainsMacAddress": true
}

Note that each Contains value corresponds to a data type in the request model; not all are included here because it’s a lot of text.

That’s all there is to it: just pass text strings to the endpoint and sanitize them before passing them down the pipeline.