Skip to main content

​
Overview

Guardrails let you redact sensitive data automatically when using an API key.
  • Configure guardrails once on an API key.
  • Use that key normally with /v1/responses.
  • Redaction applies automatically based on that key’s settings.
You can also call the redact-v1 model directly to get a scrubbed copy of your input without invoking an LLM. See Redact as a model.
Guardrails are key-level settings, not request-body parameters on /v1/responses.

​
Configure in Dashboard

  1. Go to Guardrails
  2. Select an API key
  3. Enable redaction
  4. Choose target: input, output, or both
  5. Select entity types
  6. Save changes

​
Settings in UI

  • Enabled / Disabled: turns redaction on or off for the selected key.
  • Target: choose whether redaction applies to input, output, or both.
  • Entity Types: choose which categories of sensitive data to redact.

​
Behavior You Can Expect

  • target: "input" redacts sensitive content before model processing.
  • target: "output" redacts model output before the response is returned.
  • target: "both" applies both.
Output redaction is not applied to streamed responses ("stream": true). Use non-streamed requests if you need output redaction.

​
Tips

  • Start with target: "input" if your main goal is protecting prompt data.
  • Use target: "both" for stricter protection on non-streamed calls.
  • Use entity_types to avoid over-redacting low-risk data.

​
Redact as a model

Set model to redact-v1 (aliases: redact, concentrate-redact) on /v1/responses to redact your input without forwarding it to an upstream LLM. The response returns the scrubbed payload directly, which is useful for:
  • Pre-processing prompts before sending them to a different model or system.
  • Building redaction into pipelines that don’t issue downstream LLM calls.
  • Auditing what guardrails would strip from a given input.

​
Requirements

  • The API key used for the request must have redaction guardrails enabled with at least one entity type selected. Requests fail with 400 otherwise.
  • The model uses the entity types, placeholder, and confidence threshold from the key’s guardrail settings. The target setting is ignored — redact-v1 always returns redacted input.

​
Example

curl https://api.concentrate.ai/v1/responses \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "redact-v1",
    "input": "Email me at jane@example.com about invoice #4823"
  }'
The reply follows the standard Responses shape. The redacted text appears in output[0].content[0].text, and a full redact summary is attached to the reply with the lossless scrubbed payload and any entities that were stripped.

Quickstart

Get started with API keys and first requests

Streaming

Streaming behavior and event format