---
title: "Get PII Masking Report"
method: GET
path: "/v2/jobs/{job_id}/pii"
tags: ["jobs"]
---

# Get PII Masking Report

`GET /v2/jobs/{job_id}/pii`

Get the PII masking report for a job that ran with `mask_pii: true`. Returns a signed download link (valid for up to 300 seconds) and an entity count for each report object; the masked values themselves are only in the downloaded objects. Reports are kept for 90 days after the job ran, then expire automatically (410). Requires a key with the `index` permission.

## Path parameters

- `job_id` string, required

## Response `200`

Successful Response

- PiiReportResponseV2
  - `job_id` string, required
  - `state` string, required — Always `retained` on a 200.
  - `entity_count` integer, required — Entities across all files.
  - `files` PiiReportFileV2[], required
    - `file_id` string, required
    - `entity_count` integer, required — Entities recorded for this file.
    - `truncated` boolean, required — `true` when an object hit the 5000-entity cap.
    - `objects` PiiReportObjectV2[], required
      - `key_suffix` string, required — `doc.json` for the document, or `chunk-{n}.json` for one text chunk.
      - `url` string, required — Signed download URL, valid for up to 300 seconds.
      - `expires_at` string, required — When `url` stops working (RFC3339).
  - `incomplete` boolean — `true` while the job is still running or reported failed files, so objects may still be missing.
  - `truncated_objects` boolean — `true` when only the first 500 of the job's report objects are listed.
  - `expires_in_seconds` integer, required — Lifetime of every `url` in the response (up to 300).

## Other responses

- `401` — Missing or invalid API key
- `403` — `missing_permission`: the key lacks the `index` permission
- `404` — Job not found, or it belongs to another organization
- `409` — `not_masked`: the job did not run with `mask_pii`. `predates_feature`: the job was indexed before reports were kept. `report_unavailable`: no report objects exist yet
- `410` — `deleted`: the report was deleted (`deleted_at` is included). `expired`: 90 days passed since the job ran and the report was removed automatically
- `503` — `report_signer_unconfigured`, `registry_unavailable`, `report_store_unavailable`, or `audit_unavailable`. Retry

---

[API](https://skmtc.dev/runcaptain/apis/api-reference.md) · [All operations](https://skmtc.dev/runcaptain/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/runcaptain/api-reference/revisions/fe4649e3f4aa/schema)