Entity and label types
Every PII entity type, DLP secret type, toxicity label and attack label a CID222 detector can report, and where each is declared.
- Type: reference
Every entity type, secret/DLP category, toxicity label and attack label a CID222 detector can
report — where each one is declared, and which detector emits it. Regenerate with
make docs-generate.
There is no shared PiiEntityType (or DlpSecretType) enum in the gateway — both interfaces
type detectedEntity.type as a bare string, and the actual vocabulary is the seeded rows of
ai_input_filters. This page, and the SCREAMING_SNAKE token sets it feeds to docs-lint rule 2,
are built from that seed rather than from a TypeScript type, because that seed is what actually
ships to a fresh database.
PII entity types (24)
One row per seeded filter in the "PII & Sensitive Data Protection" group
(database/seeds/seed-data/input-filters.json). Detector is regex when the filter carries
compiled patterns, ML when at least one of its entity types is also a native NER label — see
native ML NER labels below — and both when it is either.
| Entity type(s) | Filter | Detector | Regex patterns | Default action |
|---|---|---|---|---|
IBAN, ACCOUNT_NUMBER | bank-account | regex, ML | 5 | mask |
| — | card-expiry-cvv | regex | 2 | mask |
CREDIT_CARD | credit-card | regex, ML | 3 | mask |
CRYPTO_ADDRESS | crypto-address | ML | 0 | mask |
DATE_TIME | date-time | ML | 0 | flag |
EMAIL | email | regex, ML | 1 | mask |
ID_DOCUMENT_NO | id-document-no | regex | 2 | mask |
IP_ADDRESS | ip-address | regex, ML | 2 | mask |
LICENSE_PLATE | license-plate | regex, ML | 1 | mask |
LOCATION, STREET_ADDRESS, CITY, ZIPCODE | location | regex, ML | 1 | flag |
TC_KIMLIK, ID_NUMBER | national-id | regex, ML | 5 | mask |
ORGANIZATION | organization | ML | 0 | flag |
PASSPORT | passport | regex, ML | 3 | mask |
PERSON_NAME | person-name | regex, ML | 1 | mask |
PHONE | phone | regex, ML | 7 | mask |
SSN | ssn | regex, ML | 1 | mask |
VKN, TAX_ID | tax-id | regex | 1 | mask |
URL | url | ML | 0 | flag |
Note
The ONNX NER model also emits API_KEY, which the seed does not attach to a
dedicated filter row above (folded into another filter's ml_entity_types, or covered
only by the model itself). It is still real — a
detection reports this type — so
it counts toward the PII entity type total.
DLP / secret types (28)
One row per seeded filter in the "Data Leakage Prevention (DLP)" group. Only api-key declares
an ml_entity_types label (API_KEY) — every other DLP filter is regex-only, so its type in an
API response is the pattern name, while value carries the bracketed placeholder shown here.
| Filter | Reported type | Placeholder(s) | Regex patterns | Default action |
|---|---|---|---|---|
api-key | API_KEY | OPENAI_API_KEY, AWS_ACCESS_KEY, AWS_SECRET_KEY, API_KEY, ANTHROPIC_API_KEY, GITHUB_TOKEN, SLACK_TOKEN, GOOGLE_API_KEY, CID_API_KEY | 10 | mask |
connection-string | postgres_connection, mysql_connection, mongodb_connection, redis_connection, url_credentials | POSTGRES_CONNECTION, MYSQL_CONNECTION, MONGODB_CONNECTION, REDIS_CONNECTION, CREDENTIALS | 5 | mask |
credential-pair | credential_pair_context | CREDENTIALS | 1 | mask |
cve-vulnerability | cve_id | CVE_ID | 1 | flag |
mac-address | mac_colon, mac_hyphen | MAC_ADDRESS | 2 | mask |
medical-record-number | mrn_labeled, mrn_format | MRN | 2 | mask |
oauth-token | jwt_token, bearer_token, google_refresh_token, refresh_token_assignment | JWT_TOKEN, BEARER_TOKEN, REFRESH_TOKEN | 4 | mask |
password | password_assignment, turkish_password_assignment, db_password, secret_assignment | PASSWORD, DB_PASSWORD, SECRET | 4 | mask |
private-key | rsa_private_key, private_key_generic, openssh_private_key | RSA_PRIVATE_KEY, PRIVATE_KEY, SSH_PRIVATE_KEY | 3 | mask |
webhook-secret | webhook_secret, stripe_webhook | WEBHOOK_SECRET, STRIPE_WEBHOOK_SECRET | 2 | mask |
HAP / toxicity labels (13)
The 13 labels of HAP_CATEGORIES (guardrails/constants/guardrails.constants.ts), with the
per-label thresholds baked into the cid-hap-guard-v2 image. log_only is 0.00 for every
label in the current file — no label has that tier tuned above the floor.
| Label | Default action | Block | Flag | Log-only |
|---|---|---|---|---|
child_exploitation | reject | 0.53 | 0.47 | — |
crime | reject | 0.84 | 0.66 | — |
cyber_crimes | reject | 0.47 | 0.36 | — |
dangerous_advice | reject | 0.85 | 0.70 | — |
defamation | reject | 0.69 | 0.54 | — |
hate | reject | 0.84 | 0.61 | — |
intellectual_property | flag | 0.43 | 0.35 | — |
privacy | flag | 0.60 | 0.48 | — |
self_harm | reject | 0.56 | 0.48 | — |
sexual_content | flag | 0.64 | 0.48 | — |
sexual_crime | reject | 0.49 | 0.35 | — |
violence | reject | 0.70 | 0.55 | — |
weapons | reject | 0.58 | 0.47 | — |
HAP_CATEGORIES and cid-hap-guard-v2/thresholds.json name exactly the same 13 labels.
Attack-guard labels (4)
The 4 labels of ATTACK_TYPES: prompt_injection and jailbreak from the 2-label ONNX attack
model, sql_injection and xss from the deterministic libinjection scan. Default actions come
from the seeded "Jailbreak & Prompt Injection" and "Injection Scan" filter groups.
| Label | Default action |
|---|---|
prompt_injection | flag |
jailbreak | reject |
sql_injection | reject |
xss | reject |
ATTACK_TYPES and the seeded filter rows name exactly the same labels.
Warning
cid-attack-guard/thresholds.json keys its two rows label_0 / label_1 — positional, not
named. The names (injection, jailbreak) live only in the model's own label_map.json,
which is downloaded from HuggingFace at image build time and is not committed to this repo.
This page cannot assert which row is which label without that file; do not assume label_0 is
injection in a doc.
| Row | Block | Flag | Log-only |
|---|---|---|---|
label_0 | 0.70 | 0.55 | 0.40 |
label_1 | 0.50 | 0.40 | 0.30 |
Native ML NER labels (cid-security-ml)
The 21 native labels the PII ONNX model emits, from
cid-security-ml/README.md — the model's own label_map.json is downloaded from HuggingFace at
build time and is not committed, so this README table is the only static listing in the repo.
| Category | Entities |
|---|---|
| Contact | EMAIL, PHONE, URL |
| Financial | CREDIT_CARD, IBAN, CRYPTO_ADDRESS, ACCOUNT_NUMBER |
| Identity | PERSON_NAME, SSN, TC_KIMLIK, ID_NUMBER, PASSPORT, LICENSE_PLATE, API_KEY |
| Location | LOCATION, STREET_ADDRESS, CITY, ZIPCODE, IP_ADDRESS |
| Other | ORGANIZATION, DATE_TIME |
Document and image analysis
Neither document-analysis/ nor image-analysis/ declares its own entity-type set. Both route
through the same ContentDetectionService used by the chat pipeline
(document-analysis/services/document-analysis-orchestrator.service.ts,
image-analysis/services/image-analysis-orchestrator.service.ts), and their DTOs type type as
a bare string (DocumentDetectedEntity, PiiDetectionItem, SafetyDetectionItem) — so a
detection on a document or an image reports exactly the PII and DLP entity types above. The image
path additionally reports two detector-only sources with no entity-type catalogue of their own:
mrz (passport MRZ parser) and identity_layout (identity-document layout extractor) — see the
content detection API source table.