{"openapi":"3.0.3","info":{"title":"AIO Span & Trace Masking API","description":"Admin API for read-time masking to hide or transform parts of traced data (spans and traces) as they are returned by the read APIs and UI. All requests require an `accessKey` and `secretKey` header pair; see the Authentication section for how to generate these.","version":"1.0.0"},"servers":[{"url":"https://{host}/aio/api/v1/private/aio","variables":{"host":{"default":"your-instance.acceldata.app","description":"Base host for the environment being accessed."}}}],"security":[{"accessKeyAuth":[],"secretKeyAuth":[]}],"tags":[{"name":"Masking Rules","description":"Create, list, update, and delete read-time masking rules for spans and traces."}],"paths":{"/masking-rules":{"get":{"tags":["Masking Rules"],"summary":"List Masking Rules","description":"List all rules in the workspace (enabled and disabled).","operationId":"listMaskingRules","responses":{"200":{"description":"A list of masking rules.","content":{"application/json":{"schema":{"type":"array","items":{"$ref":"#/components/schemas/MaskingRule"}}}}},"401":{"$ref":"#/components/responses/Unauthorized"}}},"post":{"tags":["Masking Rules"],"summary":"Create Masking Rule","description":"Create a new masking rule that either drops matching spans, rewires the trace around them, or redacts specific fields within matching entities.","operationId":"createMaskingRule","requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/MaskingRuleInput"},"examples":{"dropToolSpans":{"summary":"Drop and rewire tool spans","value":{"name":"disable-tool-call-spans","entityKind":"SPAN","action":"DROP_AND_REWIRE","filters":[{"field":"type","operator":"=","value":"tool"}],"patches":[]}},"redactSystemToolMessages":{"summary":"Redact system/tool messages","value":{"name":"redact-bedrock-system-tool-messages","entityKind":"SPAN","action":"REDACT","filters":[{"field":"name","operator":"=","value":"ChatBedrockConverse"}],"patches":[{"field":"INPUT","jsonPath":"$.messages[*][?(@.type == 'system' || @.type == 'tool')]","constant":null}]}}}}}},"responses":{"201":{"description":"The masking rule was created.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MaskingRule"}}}},"400":{"$ref":"#/components/responses/BadRequest"},"401":{"$ref":"#/components/responses/Unauthorized"}}}},"/masking-rules/{ruleId}":{"parameters":[{"name":"ruleId","in":"path","required":true,"description":"Unique identifier of the masking rule.","schema":{"type":"string"}}],"patch":{"tags":["Masking Rules"],"summary":"Toggle Rule Status (Enable/Disable)","description":"Enable or disable an existing masking rule without deleting it.","operationId":"toggleMaskingRuleStatus","requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","properties":{"enabled":{"type":"boolean","description":"Whether the rule should be active."}},"required":["enabled"]},"example":{"enabled":false}}}},"responses":{"200":{"description":"The updated masking rule.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/MaskingRule"}}}},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}},"delete":{"tags":["Masking Rules"],"summary":"Delete Masking Rule","description":"Delete a rule permanently from the workspace.","operationId":"deleteMaskingRule","responses":{"204":{"description":"The rule was deleted."},"401":{"$ref":"#/components/responses/Unauthorized"},"404":{"$ref":"#/components/responses/NotFound"}}}}},"components":{"securitySchemes":{"accessKeyAuth":{"type":"apiKey","in":"header","name":"accessKey","description":"API access key generated from the ADOC UI. Both accessKey and secretKey are required on every request. To generate a key pair, see [API Keys](https://docs.acceldata.io/documentation/api-keys)."},"secretKeyAuth":{"type":"apiKey","in":"header","name":"secretKey","description":"API secret key generated from the ADOC UI, paired with accessKey. To generate a key pair, see [API Keys](https://docs.acceldata.io/documentation/api-keys)."}},"schemas":{"MaskingRuleFilter":{"type":"object","properties":{"field":{"type":"string","description":"Field on the entity to filter on."},"operator":{"type":"string","description":"Comparison operator, for example \"=\"."},"value":{"type":"string","description":"Value to compare the field against."}},"required":["field","operator","value"]},"MaskingRulePatch":{"type":"object","properties":{"field":{"type":"string","description":"Field to patch, for example INPUT or OUTPUT."},"jsonPath":{"type":"string","description":"JSONPath expression identifying the portion of the field to patch."},"constant":{"nullable":true,"description":"Value the matched path is replaced with. Null clears the matched content."}},"required":["field","jsonPath"]},"MaskingRuleInput":{"type":"object","properties":{"name":{"type":"string","description":"Unique, descriptive name for the rule."},"entityKind":{"type":"string","enum":["SPAN","TRACE"],"description":"Type of entity the rule applies to."},"action":{"type":"string","enum":["DROP_AND_REWIRE","REDACT"],"description":"DROP_AND_REWIRE removes matching entities and reconnects the trace around them. REDACT replaces matched field content in place."},"filters":{"type":"array","description":"Conditions that determine which entities the rule matches.","items":{"$ref":"#/components/schemas/MaskingRuleFilter"}},"patches":{"type":"array","description":"Field-level redaction patches. Required when action is REDACT; empty for DROP_AND_REWIRE.","items":{"$ref":"#/components/schemas/MaskingRulePatch"}}},"required":["name","entityKind","action","filters"]},"MaskingRule":{"allOf":[{"$ref":"#/components/schemas/MaskingRuleInput"},{"type":"object","properties":{"id":{"type":"string","description":"Unique identifier of the rule."},"enabled":{"type":"boolean","description":"Whether the rule is currently active."}}}]},"Error":{"type":"object","properties":{"message":{"type":"string"}}}},"responses":{"BadRequest":{"description":"The request body was invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"Unauthorized":{"description":"The accessKey/secretKey pair is missing or invalid.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"NotFound":{"description":"No rule exists with the given ruleId.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}}