Context-aware processing
Choose HTML, JSON, CSV or LOG as the target context so the API can apply context-specific sanitization.
Data Protection · REST API
Input Sanitization API
Sanitize input according to its context, detect common security risks and apply optional data-cleaning operations through one configurable REST endpoint.
Free tier available. The endpoint requires a JWT Bearer Token.
Sanitization capabilities
Security risk detection
Detect and mitigate risks such as XSS, CSV injection, log injection and sensitive-data exposure.
Audit details and risk score
Review detected issues, applied actions, explanations and the resulting LOW, MEDIUM or HIGH risk level.
Sanitize HTML content
Use the HTML context to process user-generated markup and select a sanitization mode based on your requirements.
Endpoint
POST /api/v1/data-protection/sanitizeInput: application/json · Output: application/json
Short example
Input
{
"input": "<script>alert('xss')</script><b>Hello</b>",
"context": "HTML",
"mode": "STRICT"
}Example response
{
"sanitized": "<b>Hello</b>",
"contextApplied": "HTML",
"issuesDetected": ["HTML_SANITIZED"],
"actionsApplied": ["REMOVE_UNSAFE_HTML"],
"riskLevel": "MEDIUM",
"riskScore": 60,
"explanations": ["Sanitized HTML by removing potentially unsafe or disallowed elements"]
}HTML sanitization modes
| Parameter | Values | Default |
|---|---|---|
mode | RELAXED, STRICT, HARDENING | RELAXED |
The mode applies to the HTML context. For other contexts, the mode is ignored.
Input sanitization in SwaggerSanitize JSON, CSV and log data
Choose JSON, CSV or LOG to apply context-aware handling to structured text, exported spreadsheet data or log content.
Endpoint
POST /api/v1/data-protection/sanitizeInput: application/json · Output: application/json
Examples by context
CSV injection prevention
Process spreadsheet-bound CSV values to mitigate formula injection risks.
{
"input": "=SUM(A1:A2)",
"context": "CSV"
}Log injection prevention
Clean log content to help prevent forged entries.
{
"input": "User logged in\nERROR: hacked",
"context": "LOG"
}JSON and sensitive data
Sanitize JSON-context input and optionally remove personally identifiable information.
{
"input": "{"email":"user@test.com","name":"Mario"}",
"context": "JSON",
"operations": ["REMOVE_PII"]
}Optional cleaning operations
Add optional operations to normalize whitespace, convert text to lowercase, remove accents or mask personally identifiable information.
| Operation | Description |
|---|---|
NORMALIZE_WHITESPACE | Normalize repeated whitespace. |
LOWERCASE | Convert text to lowercase. |
REMOVE_ACCENTS | Remove accents from characters. |
REMOVE_PII | Remove or mask detected personally identifiable information, such as email addresses and phone numbers. |
Example with transformations
Input
{
"input": " Contact: JOHN.DOE@example.com ",
"context": "HTML",
"operations": ["NORMALIZE_WHITESPACE", "LOWERCASE", "REMOVE_PII"]
}Example response
{
"sanitized": "contact: [EMAIL]",
"contextApplied": "HTML",
"issuesDetected": ["PII_DETECTED"],
"actionsApplied": ["NORMALIZE_WHITESPACE", "LOWERCASE", "REMOVE_PII"],
"riskLevel": "HIGH",
"riskScore": 85,
"explanations": ["Removed sensitive personal data (email/phone)"]
}The returned response reports the sanitization result, detected issues, applied actions, explanations and risk assessment.
Input sanitization in SwaggerWhen to use this API
User-generated content
Process HTML content before passing it to a rendering layer.
Data exports and logs
Reduce common injection risks when preparing CSV exports or processing application logs.
Privacy-aware processing
Apply the REMOVE_PII operation when input needs sensitive-data masking.
Consistent text normalization
Reuse the same optional cleaning operations across services.
Explore more DevHub APIs
Browse the API catalog or consult interactive documentation for request and response details.
