Docs / API reference

PII registry API

Declare, update, and query resources in the registry, review what the discovery crawler has found, and read the coverage score. See the PII registry guide for the underlying model.

Read the PII registry guide
GET/pii-registry/resourcesAuthenticated

Lists registry resources. Returns metadata only — never raw PII.

NameInTypeRequiredDescription
systemquerystringNoFilter by system, e.g. bigquery.
ownerConnectorquerystringNoFilter by owning connector.
scanEnabledquerybooleanNoFilter to resources with ghost-data scanning enabled.
GET/pii-registry/resources/:resourceIdAuthenticated

Returns one resource's declaration plus its current policy evaluation.

NameInTypeRequiredDescription
resourceIdpathstringYesURL-encode this if it contains a colon or slash, e.g. bigquery:project.dataset.table.
GET/pii-registry/policyAuthenticated

Aggregate policy status across the registry, with per-resource issues.

POST/pii-registry/resourcesWrite token + x-tenant-id header

Declares a new resource.

Request
{
  "resourceId": "bigquery:acme-corp.analytics.users",
  "system": "bigquery",
  "resourceLayer": "STAGING",
  "userIdColumn": "user_id",
  "piiFields": [
    { "name": "email", "classification": "DIRECT_IDENTIFIER", "handling": "ENCRYPT" }
  ],
  "deletionStrategy": "CRYPTO_SHRED"
}
  • 401 if the write token doesn't match; 503 if writes are disabled (no write token configured server-side — the safe default).
PUT/pii-registry/resourcesWrite token + x-tenant-id header

Updates an existing declaration.

DELETE/pii-registry/resources/:idWrite token + x-tenant-id header

Removes a declaration.

  • Writes a deprecated marker rather than hard-deleting — the audit history for this resource is preserved.
GET/pii-registry/discoveryAuthenticated

Lists undeclared or drifted tables the discovery crawler has found for this tenant.

GET/pii-registry/coverageAuthenticated

Returns the coverage score: counts of protected, partial, and exposed resources.

Response 200
{
  "score": 0.82,
  "counts": { "protected": 41, "partial": 6, "exposed": 3, "total": 50 }
}
POST/pii-registry/resources/:resourceId/mark-syncedAuthenticated

Advances a resource's incremental-sync watermark.

  • A transactional compare-and-swap, safe to call from overlapping sync runs without regressing the watermark.
Keep reading