---
title: "Mark fields sensitive"
method: POST
path: "/api/v1/cdp/sensitive-fields"
tags: ["CDP Sensitive fields"]
---

# Mark fields sensitive

`POST /api/v1/cdp/sensitive-fields`

## Request

- Base URL: `https://www.useboom.ai`
- URL: `https://www.useboom.ai/api/v1/cdp/sensitive-fields`
- Auth: HTTP bearer

Mark fields sensitive (or, over the REST API only, visible again). A sensitive value is hidden from AI agents and from teammates without access; it stays stored and keeps working in segments and messages. Applies every change or none: an unknown field fails the whole call. Keys must already exist in the attribute catalog. Over MCP only `isSensitive: true` is accepted — making a field visible again is refused with `sensitive_unmark_forbidden`; use Settings › Sensitive data or the REST API.

## Request body

- object
  - `changes` union[], required: The fields to change, as an array. Each item names one field by `scope`: `built_in` with `field`, `people` with `key`, or `custom_object` with `type` and `key`.
    - union
      - object
        - `scope` 'built_in', required
        - `field` 'EMAIL' | 'PHONE_NUMBER' | 'FIRST_NAME' | 'LAST_NAME', required: A contact field every person has. `externalId` cannot be hidden.
        - `isSensitive` boolean, required
      - object
        - `scope` 'people', required
        - `key` string, required: The People attribute key.
        - `isSensitive` boolean, required
      - object
        - `scope` 'custom_object', required
        - `type` string, required: The custom object type name.
        - `key` string, required: The attribute key in that type's catalog.
        - `isSensitive` boolean, required

## Response `200`

Success

- object
  - `applied` object[], required
    - `scope` 'built_in' | 'people' | 'custom_object', required
    - `field` 'EMAIL' | 'PHONE_NUMBER' | 'FIRST_NAME' | 'LAST_NAME': A contact field every person has. `externalId` cannot be hidden.
    - `type` string
    - `key` string
    - `isSensitive` boolean, required
    - `changed` boolean, required: False when the field already had this value.

## Other responses

- `400`: Validation failed or the request cannot proceed.
- `401`: Missing, malformed, or revoked API key.
- `404`: The resource does not exist in this organization.
- `409`: Conflicts with the current state (duplicates, wrong lifecycle state).
- `422`: The request is well-formed but semantically invalid.
- `429`: Rate limit exceeded — retry after `Retry-After`.
- `500`: Internal server error.
- `503`: Transient error — retry with a narrower request.

## Changes

- **2026-11-03** `7c7a773b12ce`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/useboom/apis/boom-api/changes/api/v1/cdp/sensitive-fields/post.md)

---

[API](https://skmtc.dev/useboom/apis/boom-api.md) - [All operations](https://skmtc.dev/useboom/apis/boom-api/llms.txt) - [OpenAPI document](https://skmtc.dev/useboom/apis/boom-api/revisions/d596d92ed092?raw)