PII Rehydration

What You’ll Learn

Creating a sandbox with rehydrate_response=True (transparent mode)
Creating a sandbox with rehydrate_response=False (strict mode)
The five-step flow: send, redact, process, restore, receive
When to use each mode

How Rehydration Works

When rehydrate_response=True, the edge proxy maintains a per-request token mapping:

Send — Code in the sandbox sends an HTTP request containing PII (e.g., john@example.com)
Redact — Proxy replaces PII with a token: [REDACTED_EMAIL_1] and stores the mapping
Process — The external API receives the sanitized request and responds (possibly echoing the token)
Restore — Proxy scans the response, finds [REDACTED_EMAIL_1], and restores john@example.com
Receive — Sandbox code receives the response with the original PII value — completely transparent

With rehydrate_response=False, step 4 is skipped and redaction tokens remain in the response.

PII scanning via the guardrails service is rolling out. This example demonstrates the SDK API for configuring PII rehydration — the policy is accepted and stored today.

Prerequisites

export DECLAW_API_KEY="your-api-key"
export DECLAW_DOMAIN="your-declaw-instance.example.com:8080"

This example is available in Python. TypeScript version coming soon.

Code Walkthrough

Rehydration enabled — sandbox code sees the original PII in responses:

from declaw import Sandbox, SecurityPolicy, PIIConfig

policy = SecurityPolicy(
    pii=PIIConfig(
        enabled=True,
        types=["email", "phone"],
        action="redact",
        rehydrate_response=True,
    )
)

sbx = Sandbox.create(template="base", timeout=300, security=policy)
try:
    print(f"Sandbox created: {sbx.sandbox_id}")
    # When guardrails service is active:
    # POST { "msg": "Contact john@example.com" }
    # -> proxy sends: { "msg": "Contact [REDACTED_EMAIL_1]" }
    # <- API replies: { "reply": "I will email [REDACTED_EMAIL_1]" }
    # -> proxy restores: { "reply": "I will email john@example.com" }
    # Sandbox code receives the restored version.
finally:
    sbx.kill()

Rehydration disabled — redaction tokens remain in responses (strict mode):

policy = SecurityPolicy(
    pii=PIIConfig(
        enabled=True,
        types=["email", "phone"],
        action="redact",
        rehydrate_response=False,
    )
)

sbx = Sandbox.create(template="base", timeout=300, security=policy)
try:
    print(f"Sandbox created: {sbx.sandbox_id}")
    # POST { "msg": "Contact john@example.com" }
    # -> proxy sends: { "msg": "Contact [REDACTED_EMAIL_1]" }
    # <- API replies: { "reply": "I will email [REDACTED_EMAIL_1]" }
    # -> proxy passes through unchanged
    # Sandbox code receives: { "reply": "I will email [REDACTED_EMAIL_1]" }
finally:
    sbx.kill()

Choosing a Mode

Mode	`rehydrate_response`	Use When
Transparent	`True`	Application must work as if PII was never redacted; best for most LLM workflows
Strict	`False`	Sandbox code must never see original PII in responses; maximum privacy isolation

PII Actions Streaming Rehydration

Getting Started

Built-in Templates

Commands

PTY

OpenAI Agents

Filesystem

Volumes

Network Policies

PII Protection

Security Features

LLM Providers

Framework Integrations

Agent-in-Sandbox

Real-World Patterns

Security Demos

PII Rehydration

What You’ll Learn

How Rehydration Works

Prerequisites

Code Walkthrough

Choosing a Mode

​What You’ll Learn

​How Rehydration Works

​Prerequisites

​Code Walkthrough

​Choosing a Mode

What You’ll Learn

How Rehydration Works

Prerequisites

Code Walkthrough

Choosing a Mode