Hi Community,
We are looking for guidance on implementing a two-phase PII suppression approach for outbound read APIs used by downstream integrations, without breaking existing consumers.
Requirement summary
- Phase 1: For read API responses, return null/blank values for PII fields using a business rule, scripted REST logic, or equivalent response filtering.
- Phase 2: Update the API schema/payload to remove those PII fields entirely from the response.
- Scope: All outbound REST and SOAP read APIs used by integrations.
- Field source: Suppression should apply to Tier 1 PII fields identified from the enterprise PII registry.
- Out of scope: Write APIs should not be impacted.
Currently, Our Outbound Integration is completely from flow designers and parsing the value through actions in Json format.
How to achieve this implementation in developer point of view ?
