Mask sensitive content in traces

Use Cases

Keeping system prompts out of stored traces while still tracing the request.
Excluding user-submitted content from logs to meet data-handling requirements.
Redacting model output from traces without changing what the caller receives.

The security parameter controls what gets written to stored traces. It does not change the live request or response: the caller always receives the full, unmasked output. Only the copy persisted to trace storage is affected.

Masking input, output, system, or all with security.mask only affects the copy of the request written to stored traces. The full, unmasked payload is still sent to the model provider. To prevent PII from leaving in the live request or response, enable the PII Redaction plugin.

security is set per request. There is no workspace, project, or API-key default, so a request that sends no security block is traced in full unless a workspace-level mask applies. To mask every request without repeating the field, enable Trace Scrubbing for the workspace: its masks are merged with the request’s, and a request can add to them but not reduce them. To attach the field automatically instead, set it as a default on the SDK client.

Quick Start

curl -X POST https://my.orq.ai/v3/router/responses \
  -H "Authorization: Bearer $ORQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "openai/gpt-5.4-mini",
    "input": "Summarize AI trends for 2025",
    "security": { "mask": ["input"] }
  }'

import OpenAI from "openai";

const client = new OpenAI({
  apiKey: process.env.ORQ_API_KEY,
  baseURL: "https://my.orq.ai/v3/router",
});

const response = await client.responses.create({
  model: "openai/gpt-5.4-mini",
  input: "Summarize AI trends for 2025",
  // @ts-ignore - orq.ai extension
  security: { mask: ["input"] },
});

console.log(response.output_text);

from openai import OpenAI
import os

client = OpenAI(
    api_key=os.environ.get("ORQ_API_KEY"),
    base_url="https://my.orq.ai/v3/router",
)

response = client.responses.create(
    model="openai/gpt-5.4-mini",
    input="Summarize AI trends for 2025",
    extra_body={"security": {"mask": ["input"]}},
)

print(response.output_text)

const response = await client.chat.completions.create({
  model: "openai/gpt-5.4-mini",
  messages: [{ role: "user", content: "Summarize AI trends for 2025" }],
  // @ts-ignore - orq.ai extension
  security: { mask: ["input"] },
});

Configuration

Parameter	Type	Required	Description
`mask`	string[]	No	Which content to mask in stored traces: `input`, `output`, `system`, `metadata`, `variables`, or `all`.

An unrecognized value in mask is rejected with a 400 error.

What each value masks

Value	Effect on stored traces
`input`	Blanks user message content, and (on tool spans) the tool-call arguments.
`system`	Blanks system and developer message content, and (on tool spans) the resolved tool variables. Also strips `description` and the parameter schema (`parameters` or `input_schema`) from tool definitions, keeping only name and type.
`output`	Blanks assistant message content, and (on tool spans) the tool-call result.
`metadata`	Removes custom request metadata (`metadata.*` and `orq.metadata` attributes) from stored traces.
`variables`	Removes template and tool variables (`orq.variables.*` attributes) from stored traces.
`all`	Shorthand for `input`, `system`, `output`, `metadata`, and `variables` together.

Coverage

security is supported across the AI Gateway’s endpoints, including responses, chat/completions, completions, embeddings, images, ocr, rerank, speech, transcriptions, and translations. security is unrelated to the PII Redaction plugin, which rewrites sensitive values in the live request and response, and to Guardrails, which can block a request outright. security only changes what is written to trace storage, which it shares with the Trace Scrubbing plugin; the two are merged, and Trace Scrubbing can also be set for a workspace or a routing rule.

Overview

APIs

MCP Portal

Routing

Security & Privacy

Model Capabilities

Server Tools

Common Scenarios

Quick Start

Configuration

What each value masks

Coverage

​Quick Start

​Configuration

​What each value masks

​Coverage

Quick Start

Configuration

What each value masks

Coverage