Auto-classifying sensitive data fields
G8KEPR inspects the requests and responses flowing through your APIs, MCP servers, and AI tools, and automatically flags fields that appear to contain sensitive data — such as personal, payment, and health information. Each detected field can be assigned a sensitivity tier so you can apply the right redaction, masking, and access rules without hand-tagging every schema.
How classification works
As traffic passes through G8KEPR, each field name and value is scanned against built-in detectors. When a field matches, it's labeled with a data category and a sensitivity tier. Classification runs inline, so labels are typically available as data is seen, without a separate batch job or manual import.
Classification labels metadata about your fields. It does not store the underlying sensitive values unless you explicitly enable payload capture.
Data categories detected
- ▸PII — names, email addresses, phone numbers, physical addresses, national IDs, and similar personal identifiers.
- ▸Payment — card numbers, expiry data, and related financial account details (relevant to PCI-scoped flows).
- ▸Health — diagnoses, medical record identifiers, and other health-related fields (relevant to HIPAA-scoped flows).
Sensitivity tiers
Every classified field is placed into a sensitivity tier, from least to most sensitive:
- 1.Public — safe to expose; no special handling.
- 2.Internal — non-public but low-risk business data.
- 3.Confidential — PII and similar data that requires masking and access controls.
- 4.Restricted — the highest tier, covering payment and health data subject to regulatory obligations.
Higher tiers are intended to inherit stricter default handling, such as redaction in logs and tighter access enforcement.
Enable and review classifications
- 1.Open API Security → Data Classification in your dashboard.
- 2.Confirm classification is enabled for the endpoints or MCP servers you want covered.
- 3.Send representative traffic, then review the detected fields, their categories, and assigned tiers.
- 4.Adjust any field where you want a different tier, or add a custom detector for organization-specific formats.
curl https://api.g8kepr.com/v1/classification/fields \
-H "Authorization: Bearer $G8KEPR_API_KEY"Acting on classified data
Once fields are labeled, you can wire tiers into policy — for example, masking every Restricted field in responses or blocking exports of Confidential data.
Start by monitoring classifications for a few days before enforcing masking, so you can validate the tiers against your real traffic.
To turn labels into enforcement, see Redaction and masking policies and Data loss prevention rules.