# Redaction

> Secret redaction applied to everything that leaves the process, and its policy.

Source: https://docs.pyrula.io/reference/redaction/

Generated from the type stubs and docstrings. Do not edit by hand.

## Types

## `RedactionPolicy`

Configure additions and exemptions for the built-in redaction policy.

`extra_keys` are more secret field names, matched as dict keys and as
`name=value` in free text. `never_redact_keys` are field names never masked
by name (a false-positive escape hatch; a secret-shaped value inside such a
field is still masked). `extra_value_patterns` mask whatever they match in
any string.

`mask` is a deployment's own callback, run once on the whole payload inside
`redact_deep` - after the built-in redaction, so it only ever sees
already-masked data, and before any egress size cap. If it raises, the
payload is replaced by `MASK_FAILED`; raw data never ships because of a
bug in this callback.

```python
RedactionPolicy(*, extra_keys: tuple[str, ...] = (), never_redact_keys: tuple[str, ...] = (), extra_value_patterns: tuple[re.Pattern[str], ...] = (), mask: Optional[Callable[[Any], Any]] = None)
```

**Fields:**

- `extra_keys: tuple[str, ...] = ()`
- `never_redact_keys: tuple[str, ...] = ()`
- `extra_value_patterns: tuple[re.Pattern[str], ...] = ()`
- `mask: Optional[Callable[[Any], Any]] = None`

## Constants

- `REDACTED = '[REDACTED]'`

## Functions

### `redact`

```python
redact(value: Any) -> Any
```

Recursively replace secret-shaped values. Never mutates the input.

Masks keys only. Use `redact_text` for secrets embedded in free text.

### `redact_text`

```python
redact_text(text: str) -> str
```

Mask secret-shaped substrings in free text (exception messages).

Deliberately narrow: inline URL credentials, `key=value` pairs whose key is
secret-shaped, and secrets with a recognisable shape of their own. A
hygiene pass, not a guarantee - a bare secret with no surrounding shape
still gets through, which is why detail is also capped.

### `redaction_policy`

```python
redaction_policy() -> RedactionPolicy
```

The policy every egress path applies now.

The one passed to `set_redaction_policy`, or else the default: the built-in
rules plus the names in `PYRULA_REDACT_KEYS`, read on each call.

### `reset_redaction_policy`

```python
reset_redaction_policy() -> None
```

Drop a policy set in code, returning to the one `PYRULA_REDACT_KEYS` gives.

### `set_redaction_policy`

```python
set_redaction_policy(policy: RedactionPolicy) -> None
```

Install *policy* for the whole process, like `logging` configuration.

It replaces the default read from `PYRULA_REDACT_KEYS` rather than adding
to it; build from `redaction_policy()` to keep those keys.