Privent icon

Privent

Privent DLP: session-scoped tokenization, detokenization, risk scoring, audit events and agent handoffs for AI agent workflows.

Actions6

Detokenize → Detokenize

AI-generated

Summary

Detokenize replaces token placeholders in specified fields or the entire item JSON with their original values using varied authentication methods, optionally enforcing strict output policies and auditing detokenization events.

Inputs

  • Authentication (required) — Choose the authentication mode: API Key for full backend integration, Tokenless for in-memory tokenization with visitor ID, or Local for regex-based local detokenization without backend calls.
  • Session ID (required) — Session identifier matching the upstream Tokenize node's session; auto-filled from upstream where applicable.
  • Trace ID — Correlation ID linking this detokenization event to the session trace; auto-generated if no upstream session.
  • Agent Name — Logical agent identifier recorded with the audit event.
  • Target Field (required) — Field to detokenize; '*' (default) scans and replaces tokens in all nested string fields or specify a single field name.
  • Strict Mode — When true, detokenization is blocked unless the Destination URL matches the Trusted Sinks list, leaving tokens in place and logging an audit event.
  • Destination URL — URL of downstream system to validate against the Trusted Sinks list when strict mode is enabled.
  • Trusted Sinks — Comma-separated list of allowed URL prefixes for detokenized data egress when strict mode is active.
  • Target Agent Name (Trust Map) — Optional external agent name to log detokenization as an agent interaction edge instead of a sink event; applicable only with API Key or Tokenless auth.

Output shape

a single item object with specified fields detokenized, preserving structure

Detokenization applies deeply to all nested strings when targetField is '*', or only to the specified field if set. In strict mode, detokenization is conditional on sinkUrl matching the trusted sinks. Audit events are generated for detokenization operations. Errors in detokenization result in workflow node errors.

Examples

Example 1: Using API Key authentication, detokenize all tokens in the entire input JSON with auditing and risk scoring backed by Privent API.

Authentication set to API Key, providing a valid sessionId and traceId from the upstream Privent Session node, targetField as '*', and strict mode disabled.

Example 2: Local authentication mode detokenizes locally within n8n using regex detection without any backend interaction, suitable when no API key is available and data must not leave the instance.

Authentication set to Local, leaving sessionId empty to inherit from upstream local Tokenize, targetField set to a single field like 'body' to detokenize only specific content.

Example 3: Enable strict mode to prevent detokenization unless the data is being sent to approved external endpoints, avoiding accidental PII leakage.

Strict mode enabled with destination URL set to the downstream node's endpoint and trusted sinks configured with approved URL prefixes.

Links

Discussion