# Mask API
> Mask a value for safe display. The mask endpoint keeps the first and/or last few characters visible and replaces the rest with a mask character — so a card becomes ••••••••••••1111 and an API token becomes sk**********3456 — and can keep separators (spaces and dashes) intact so the value keeps its shape. A dedicated email masker hides the local part (and optionally the domain) while keeping the address recognisable, e.g. j•••••••@example.com. Choose how many characters to reveal and which mask character to use. Perfect for showing the last four digits of a card, partially hiding emails and phone numbers, and masking tokens and account numbers in UIs, receipts and logs. Pure local computation — no key, no third-party service, instant. Live, nothing stored. 3 endpoints. This masks a known value for display; to find and redact PII inside free text, use a redaction API.

## Authentication
All requests require your oanor API key in the `x-oanor-key` header. Get one at https://www.oanor.com/developer/keys.

```bash
curl -H "x-oanor-key: oanor_live_…" "https://api.oanor.com/mask-api/..."
```

## Pricing
- **Free** (Free) — 1,235 calls/Mo, 2 req/s
- **Starter** ($3/Mo) — 10,750 calls/Mo, 8 req/s
- **Pro** ($23/Mo) — 158,500 calls/Mo, 20 req/s
- **Mega** ($61/Mo) — 835,000 calls/Mo, 50 req/s

## Endpoints

### Mask

#### `GET /v1/email` — Mask an email

**Parameters:**
- `email` (query, required, string) — Email address Example: `john.doe@example.com`
- `show_first` (query, optional, string) — Visible local chars (default 1)
- `mask_domain` (query, optional, string) — true to also mask the domain
- `mask_char` (query, optional, string) — Mask character (default •)

**Example:**
```bash
curl -H "x-oanor-key: $KEY" \
  "https://api.oanor.com/mask-api/v1/email?email=john.doe%40example.com"
```

**Response:**
```json
{
    "data": {
        "email": "john.doe@example.com",
        "domain": "example.com",
        "masked": "j•••••••@example.com",
        "local_part": "john.doe"
    },
    "meta": {
        "timestamp": "2026-06-03T09:25:08.030Z",
        "request_id": "adff3162-3c9b-44c9-b77b-13ea2d24fa7b"
    },
    "status": "ok",
    "message": "Mask an email",
    "success": true
}
```

#### `GET /v1/mask` — Mask a value

**Parameters:**
- `value` (query, required, string) — The string to mask Example: `4111111111111111`
- `show_last` (query, optional, string) — Visible chars at end (default 4) Example: `4`
- `show_first` (query, optional, string) — Visible chars at start (default 0)
- `mask_char` (query, optional, string) — Mask character (default •)
- `keep_separators` (query, optional, string) — true to keep spaces/dashes

**Example:**
```bash
curl -H "x-oanor-key: $KEY" \
  "https://api.oanor.com/mask-api/v1/mask?value=4111111111111111&show_last=4"
```

**Response:**
```json
{
    "data": {
        "shown": 4,
        "masked": "••••••••••••1111",
        "masked_count": 12,
        "original_length": 16
    },
    "meta": {
        "timestamp": "2026-06-03T09:25:08.146Z",
        "request_id": "e2ca0e28-28b7-4271-83ad-c032fff2a1fa"
    },
    "status": "ok",
    "message": "Mask a value",
    "success": true
}
```

### Meta

#### `GET /v1/meta` — Spec

**Example:**
```bash
curl -H "x-oanor-key: $KEY" \
  "https://api.oanor.com/mask-api/v1/meta"
```

**Response:**
```json
{
    "data": {
        "name": "Mask API",
        "notes": "This masks a known value for display (e.g. •••• 1234) — to find and redact PII inside free text, use a redaction API. Nothing is stored.",
        "version": "v1",
        "endpoints": [
            {
                "path": "/v1/mask",
                "params": {
                    "value": "the string (required)",
                    "mask_char": "default •",
                    "show_last": "visible chars at end (default 4)",
                    "show_first": "visible chars at start (default 0)",
                    "keep_separators": "true to keep spaces/dashes"
                },
                "returns": "the masked string"
            },
            {
                "path": "/v1/email",
                "params": {
                    "email": "an email address (required)",
                    "mask_char": "default •",
                    "show_first": "visible local chars (default 1)",
                    "mask_domain": "true to also mask the domain"
                },
                "returns": "the masked email"
            },
            {
                "path": "/v1/meta",
                "params": [],
                "returns": "this document"
            }
        ],
        "description": "Mask a value for safe display — keep the first and/or last few characters visible and replace the rest with a mask character, optionally leaving separators (spaces, dashes) intact so a card or ph
…(truncated, see openapi.json for full schema)
```


---
Marketplace page: https://www.oanor.com/api/mask-api
OpenAPI spec: https://www.oanor.com/api/mask-api/openapi.json