Every PII entity type, DLP secret type, toxicity label and attack label a CID222 detector can report, and where each is declared.

Every entity type, secret/DLP category, toxicity label and attack label a CID222 detector can report — where each one is declared, and which detector emits it. Regenerate with make docs-generate.

There is no shared PiiEntityType (or DlpSecretType) enum in the gateway — both interfaces type detectedEntity.type as a bare string, and the actual vocabulary is the seeded rows of ai_input_filters. This page, and the SCREAMING_SNAKE token sets it feeds to docs-lint rule 2, are built from that seed rather than from a TypeScript type, because that seed is what actually ships to a fresh database.

PII entity types (24)

One row per seeded filter in the "PII & Sensitive Data Protection" group (database/seeds/seed-data/input-filters.json). Detector is regex when the filter carries compiled patterns, ML when at least one of its entity types is also a native NER label — see native ML NER labels below — and both when it is either.

Entity type(s)	Filter	Detector	Regex patterns	Default action
`IBAN`, `ACCOUNT_NUMBER`	`bank-account`	regex, ML	5	`mask`
—	`card-expiry-cvv`	regex	2	`mask`
`CREDIT_CARD`	`credit-card`	regex, ML	3	`mask`
`CRYPTO_ADDRESS`	`crypto-address`	ML	0	`mask`
`DATE_TIME`	`date-time`	ML	0	`flag`
`EMAIL`	`email`	regex, ML	1	`mask`
`ID_DOCUMENT_NO`	`id-document-no`	regex	2	`mask`
`IP_ADDRESS`	`ip-address`	regex, ML	2	`mask`
`LICENSE_PLATE`	`license-plate`	regex, ML	1	`mask`
`LOCATION`, `STREET_ADDRESS`, `CITY`, `ZIPCODE`	`location`	regex, ML	1	`flag`
`TC_KIMLIK`, `ID_NUMBER`	`national-id`	regex, ML	5	`mask`
`ORGANIZATION`	`organization`	ML	0	`flag`
`PASSPORT`	`passport`	regex, ML	5	`mask`
`PERSON_NAME`	`person-name`	regex, ML	1	`mask`
`PHONE`	`phone`	regex, ML	7	`mask`
`SSN`	`ssn`	regex, ML	1	`mask`
`VKN`, `TAX_ID`	`tax-id`	regex	1	`mask`
`URL`	`url`	ML	0	`flag`

Note

The ONNX NER model also emits API_KEY, which the seed does not attach to a dedicated filter row above (folded into another filter's ml_entity_types, or covered only by the model itself). It is still real — a detection reports this type — so it counts toward the PII entity type total.

DLP / secret types (28)

One row per seeded filter in the "Data Leakage Prevention (DLP)" group. Only api-key declares an ml_entity_types label (API_KEY) — every other DLP filter is regex-only, so its type in an API response is the pattern name, while value carries the bracketed placeholder shown here.

Filter	Reported `type`	Placeholder(s)	Regex patterns	Default action
`api-key`	`API_KEY`	`OPENAI_API_KEY`, `AWS_ACCESS_KEY`, `AWS_SECRET_KEY`, `API_KEY`, `ANTHROPIC_API_KEY`, `GITHUB_TOKEN`, `SLACK_TOKEN`, `GOOGLE_API_KEY`, `CID_API_KEY`	10	`mask`
`connection-string`	`postgres_connection`, `mysql_connection`, `mongodb_connection`, `redis_connection`, `url_credentials`	`POSTGRES_CONNECTION`, `MYSQL_CONNECTION`, `MONGODB_CONNECTION`, `REDIS_CONNECTION`, `CREDENTIALS`	5	`mask`
`credential-pair`	`credential_pair_context`	`CREDENTIALS`	1	`mask`
`cve-vulnerability`	`cve_id`	`CVE_ID`	1	`flag`
`mac-address`	`mac_colon`, `mac_hyphen`	`MAC_ADDRESS`	2	`mask`
`medical-record-number`	`mrn_labeled`, `mrn_format`	`MRN`	2	`mask`
`oauth-token`	`jwt_token`, `bearer_token`, `google_refresh_token`, `refresh_token_assignment`	`JWT_TOKEN`, `BEARER_TOKEN`, `REFRESH_TOKEN`	4	`mask`
`password`	`password_assignment`, `turkish_password_assignment`, `db_password`, `secret_assignment`	`PASSWORD`, `DB_PASSWORD`, `SECRET`	4	`mask`
`private-key`	`rsa_private_key`, `private_key_generic`, `openssh_private_key`	`RSA_PRIVATE_KEY`, `PRIVATE_KEY`, `SSH_PRIVATE_KEY`	3	`mask`
`webhook-secret`	`webhook_secret`, `stripe_webhook`	`WEBHOOK_SECRET`, `STRIPE_WEBHOOK_SECRET`	2	`mask`

HAP / toxicity labels (13)

The 13 toxicity labels the HAP guard reports, with the per-label thresholds this release ships. log_only is 0.00 for every label — no label has that tier tuned above the floor, so nothing is recorded on the log-only tier alone.

Label	Default action	Block	Flag	Log-only
`child_exploitation`	`reject`	0.53	0.47	—
`crime`	`reject`	0.84	0.66	—
`cyber_crimes`	`reject`	0.47	0.36	—
`dangerous_advice`	`reject`	0.85	0.70	—
`defamation`	`reject`	0.69	0.54	—
`hate`	`reject`	0.84	0.61	—
`intellectual_property`	`flag`	0.43	0.35	—
`privacy`	`flag`	0.60	0.48	—
`self_harm`	`reject`	0.56	0.48	—
`sexual_content`	`flag`	0.64	0.48	—
`sexual_crime`	`reject`	0.49	0.35	—
`violence`	`reject`	0.70	0.55	—
`weapons`	`reject`	0.58	0.47	—

The label list and the toxicity service's thresholds.json name exactly the same 13 labels.

Attack-guard labels (4)

The 4 labels of ATTACK_TYPES: prompt_injection and jailbreak from the 2-label ONNX attack model, sql_injection and xss from the deterministic libinjection scan. Default actions come from the seeded "Jailbreak & Prompt Injection" and "Injection Scan" filter groups.

Label	Default action
`prompt_injection`	`flag`
`jailbreak`	`reject`
`sql_injection`	`reject`
`xss`	`reject`

ATTACK_TYPES and the seeded filter rows name exactly the same labels.

Warning

The attack-guard service's thresholds.json keys its two rows label_0 / label_1 — positional, not named. The names (injection, jailbreak) live only in the model's own label_map.json, which arrives with the model rather than beside the threshold file. This page cannot assert which row is which label without that file; do not assume label_0 is injection in a doc.

Row	Block	Flag	Log-only
`label_0`	0.70	0.55	0.40
`label_1`	0.50	0.40	0.30

Native ML NER labels (cid-security-ml)

The 21 native labels the PII ONNX model emits. A filter is marked ML above when at least one of its entity types is one of these — the model contributes the detection, and the filter decides what happens to it.

Category	Entities
Contact	`EMAIL`, `PHONE`, `URL`
Financial	`CREDIT_CARD`, `IBAN`, `CRYPTO_ADDRESS`, `ACCOUNT_NUMBER`
Identity	`PERSON_NAME`, `SSN`, `TC_KIMLIK`, `ID_NUMBER`, `PASSPORT`, `LICENSE_PLATE`, `API_KEY`
Location	`LOCATION`, `STREET_ADDRESS`, `CITY`, `ZIPCODE`, `IP_ADDRESS`
Other	`ORGANIZATION`, `DATE_TIME`

Document and image analysis

Document analysis and image analysis have no entity-type set of their own. Both run the text they extract through the same detection pipeline as chat, so a detection on a PDF, a DOCX or an image reports exactly the PII and DLP entity types above — the same filters, the same actions. The image path additionally reports two detector-only sources with no entity-type catalogue of their own: mrz (passport MRZ parser) and identity_layout (identity-document layout extractor) — see the content detection API source table.

Entity and label types