{ "openapi": "3.0.1", "info": { "title": "OTel PII & Secrets Leak Detector", "description": "Scan OpenTelemetry traces, metrics and logs for leaked secrets and PII before they reach your observability backend. Get a risk report, a Collector redaction config and sanitized telemetry. Standby HTTP API included.", "version": "0.1", "x-build-id": "nevuoNG3LdK0aXCAp" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/michiganpublictech~otel-pii-leak-detector/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-michiganpublictech-otel-pii-leak-detector", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/michiganpublictech~otel-pii-leak-detector/runs": { "post": { "operationId": "runs-sync-michiganpublictech-otel-pii-leak-detector", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/michiganpublictech~otel-pii-leak-detector/run-sync": { "post": { "operationId": "run-sync-michiganpublictech-otel-pii-leak-detector", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "properties": { "telemetry": { "title": "Telemetry (OTLP/JSON)", "type": "object", "description": "One OTLP/JSON export request: any of resourceSpans / resourceLogs / resourceMetrics (what the Collector file exporter, otlphttp JSON and SDK debug exporters produce). A simplified object {\"resource\": {...}, \"spans\": [...], \"logs\": [...], \"metrics\": [...]} with plain attribute maps is accepted too. A list is treated as several batches." }, "telemetryBatches": { "title": "Telemetry batches", "type": "array", "description": "Several batches, each an OTLP/JSON document or {\"name\": \"...\", \"telemetry\": {...}}. One report per batch." }, "telemetryText": { "title": "Telemetry as text (JSON / JSON Lines)", "type": "string", "description": "OTLP/JSON text, a JSON array of batches, or JSON Lines (one batch per line — e.g. the Collector file exporter output). Lines that aren't JSON are reported as failed batches and never charged." }, "detectors": { "title": "Detector groups", "type": "array", "description": "Which detector groups to run. Free-text heuristics are off by default (lower confidence).", "items": { "type": "string", "enum": [ "secrets", "credentials", "pii-contact", "pii-identifiers", "network", "financial", "health", "location", "free-text" ], "enumTitles": [ "Secrets & API keys", "Credentials (headers, cookies, URLs, connection strings)", "PII: contact (email, phone, address, names in name fields)", "PII: identifiers (SSN, national IDs, DOB, user.* attributes, device IDs)", "Network identifiers (end-user IPs, MAC)", "Financial (cards, CVV, IBAN, bank accounts)", "Health (ICD-10, MRN, PHI heuristics)", "Location (precise coordinates)", "Free-text heuristics (names in prose, captured bodies) — noisier" ] }, "default": [ "secrets", "credentials", "pii-contact", "pii-identifiers", "network", "financial", "health", "location" ] }, "regimes": { "title": "Regulatory regimes to label", "type": "array", "description": "Only used to LABEL potential exposure (GDPR, CCPA, HIPAA, PCI DSS). Not legal advice or a compliance certification.", "items": { "type": "string", "enum": [ "GDPR", "CCPA", "HIPAA", "PCI_DSS" ], "enumTitles": [ "GDPR (EU/UK)", "CCPA/CPRA (California)", "HIPAA (US health)", "PCI DSS (payment cards)" ] }, "default": [ "GDPR", "CCPA", "HIPAA", "PCI_DSS" ] }, "minConfidence": { "title": "Minimum confidence", "enum": [ "low", "medium", "high" ], "type": "string", "description": "Drop detections below this confidence (they are still counted in data.suppressed).", "default": "low" }, "testValues": { "title": "Known test values", "enum": [ "downgrade", "report", "ignore" ], "type": "string", "description": "What to do with well-known test/documentation values (4111 1111 1111 1111, AKIAIOSFODNN7EXAMPLE, example.com, 555-01xx, documentation IP ranges). They still prove the attribute captures that kind of data.", "default": "downgrade" }, "allowlistAttributes": { "title": "Allowlisted attribute keys", "type": "array", "description": "Attribute keys never reported (exact or glob, e.g. 'app.public_*' or 'user.id'). Matched against the full key and the last segment.", "items": { "type": "string" } }, "allowlistPatterns": { "title": "Allowlisted value patterns", "type": "array", "description": "Regular expressions; a detection whose matched text (or whole value) fully matches one is ignored. Patterns are screened for catastrophic backtracking.", "items": { "type": "string" } }, "customPatterns": { "title": "Custom patterns", "type": "array", "description": "Up to 20 extra detectors: [{\"name\": \"customer-ref\", \"pattern\": \"CUST-[0-9]{8}\", \"severity\": \"medium\", \"action\": \"mask|hash|delete\"}]. Max 300 characters; nested quantifiers such as (a+)+, overlapping repeated alternations and backreferences are rejected (ReDoS guard). RE2-compatible patterns are also added to the generated Collector config." }, "emitSanitizedTelemetry": { "title": "Emit sanitized telemetry", "type": "boolean", "description": "Return a sanitized copy of each batch (masked / hashed / deleted values) plus a self-check that re-scans it. Charged as 'sanitized-output' only when at least one value changed.", "default": true }, "generateCollectorConfig": { "title": "Generate Collector redaction config", "type": "boolean", "description": "Generate an OpenTelemetry Collector config (attributes, transform/OTTL and redaction processors wired between memory_limiter and batch) plus SDK-side hints, and report which leaks it would not catch.", "default": true }, "redactionStrategy": { "title": "Redaction strategy", "enum": [ "balanced", "mask", "hash", "drop" ], "type": "string", "description": "How sanitized output and the generated config treat detected values.", "default": "balanced" }, "collectorFlavor": { "title": "Collector flavor", "enum": [ "contrib", "contrib-legacy" ], "type": "string", "description": "Target distribution for the generated config. See the README for version caveats.", "default": "contrib" }, "hashSalt": { "title": "Hash / fingerprint salt", "type": "string", "description": "Optional secret (8–128 letters, digits, '_' or '-') used to salt value fingerprints and [HASH:…] tokens so they are comparable across runs. Default: a random per-run salt." }, "sampleRetention": { "title": "Evidence retention", "enum": [ "redacted", "none" ], "type": "string", "description": "Raw values are never stored. 'redacted' adds minimal previews such as 'AKIA…LE (20 chars)' or 'j***@***.com'.", "default": "redacted" }, "minSeverity": { "title": "Minimum severity to report", "enum": [ "info", "low", "medium", "high", "critical" ], "type": "string", "description": "Hide findings below this severity (risk summary counts still include them).", "default": "info" }, "failOnSeverity": { "title": "Fail run at severity", "enum": [ "none", "critical", "high", "medium", "low" ], "type": "string", "description": "CI gate: mark the run as FAILED when any finding is at or above this severity.", "default": "none" }, "disabledRules": { "title": "Disabled rules", "type": "array", "description": "Rule IDs to skip (see RULES.md), e.g. LEAK-044. Requires the custom_rules feature (Pro plan and above).", "items": { "type": "string" } }, "licenseKey": { "title": "License key", "type": "string", "description": "Optional. Enterprise / prepaid license key. Store users don't need one." } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 }, "PROXY_UNBLOCKER_UNITS": { "type": "integer", "example": 0 } } } } } } } } } }