# Sentinel402 PII & Secrets Compliance Audit

> Sentinel402 PII & Secrets Compliance Audit is a paid API for AI agents from pii-guardrail.chronokey.workers.dev, paid per call via x402, $0.03/call, status unknown (last checked 2026-10-12).

Scans text or JSON payloads for PII and secrets against PCI-DSS, GDPR, HIPAA, and secrets hygiene frameworks, returning a risk score, per-framework verdicts, and a redacted sanitized copy.

## Facts

- Endpoint: POST https://pii-guardrail.chronokey.workers.dev/v1/audit?utm_source=zero.xyz
- Price: $0.03/call
- Payment: x402
- Status: unknown
- Last checked: 2026-10-12
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/sentinel402-pii-secrets-compliance-audit-7afafd85
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_UQV9B7q0p_WU0rz7K0MY_

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability sentinel402-pii-secrets-compliance-audit-7afafd85 -d '<json body>'
```

Example prompt: Before you send that user record to the third-party analytics service, scan it for PII and secrets — check it against PCI-DSS, GDPR, HIPAA, and secrets hygiene — and give me the redacted version if anything triggers.

## When to prefer this

Choose this endpoint when you need a multi-framework compliance audit (PCI-DSS, GDPR, HIPAA, and secrets) in a single call with a sanitized output ready to forward. It is specifically designed for AI agent pipelines that need a guardrail before sending data to external services, logging systems, or third-party APIs. Prefer it over generic regex-based scrubbers when you need structured per-framework verdicts and severity ratings, or when you need a redacted payload rather than just a detection report.

## Known failure modes

- Text exceeds 32,000 character limit — request rejected
- Both 'text' and 'payload' provided simultaneously — mutually exclusive fields
- Invalid framework enum value — request rejected with validation error
- Payment via x402 not settled — endpoint returns 402 Payment Required
- Malformed JSON in payload field — parse error returned
- Network timeout from Cloudflare Worker — transient 5xx error

## How this service works

Paid tools for AI agents over x402: a PII and secret guardrail that scans outbound payloads, live citable data (crypto, weather, GitHub, sports, FX), and an RCP/1 retrieval server backed by that live data.

## Output

Returns a JSON object with: overall pass/fail verdict, a 0–100 risk score, a human-readable summary, a sanitized copy with sensitive values replaced by labeled tokens, and a per-framework breakdown (pci-dss, gdpr, hipaa, secrets) listing each triggered rule, its count, label, and severity (critical/high/medium/low). Also includes engine version, character count, and x402 payment settlement metadata.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "text": {
   "type": "string",
   "description": "Text to audit. Mutually exclusive with payload. Max 32000 chars."
  },
  "payload": {
   "description": "Any JSON to audit instead of raw text."
  },
  "frameworks": {
   "type": "array",
   "items": {
    "enum": [
     "pci-dss",
     "gdpr",
     "hipaa",
     "secrets"
    ],
    "type": "string"
   },
   "description": "Restrict the report (default: all four)."
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "ok": true,
  "risk": 100,
  "x402": {
   "network": "eip155:8453",
   "settled": true,
   "facilitator": "https://facilitator.payai.network",
   "transaction": "0xdef456"
  },
  "audit": "sentinel402-compliance-audit/1",
  "overall": "fail",
  "summary": "FAIL — 3/4 framework profile(s) triggered (pci-dss, gdpr, hipaa, secrets); worst severity critical. Do not forward this payload as-is; use the sanitized copy.",
  "sanitized": "Patient [SSN:#f1a2b3] paid with card [CREDIT_CARD:************4242]; aws key [AWS_ACCESS_KEY:#c4d5e6].",
  "truncated": false,
  "frameworks": [
   {
    "id": "pci-dss",
    "name": "PCI DSS 4.x (card data)",
    "verdict": "fail",
    "triggered": [
     {
      "rule": "CREDIT_CARD",
      "count": 1,
      "label": "Credit / debit card number (PAN)",
      "severity": "critical"
     }
    ],
    "findingsCount": 1
   },
   {
    "id": "gdpr",
    "name": "GDPR / UK GDPR (personal data)",
    "verdict": "fail",
    "triggered": [
     {
      "rule": "SSN",
      "count": 1,
      "label": "US Social Security number",
      "severity": "critical"
     }
    ],
    "findingsCount": 1
   },
   {
    "id": "hipaa",
    "name": "HIPAA Safe Harbor (US health data)",
    "verdict": "fail",
    "triggered": [
     {
      "rule": "SSN",
      "count": 1,
      "label": "US Social Security number",
      "severity": "critical"
     }
    ],
    "findingsCount": 1
   },
   {
    "id": "secrets",
    "name": "Secrets hygiene (SOC 2 CC6-style)",
    "verdict": "fail",
    "triggered": [
     {
      "rule": "AWS_ACCESS_KEY",
      "count": 1,
      "label": "AWS access key id",
      "severity": "critical"
     }
    ],
    "findingsCount": 1
   }
  ],
  "scannedChars": 97,
  "engineVersion": "1.1.0",
  "otherFindings": []
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/sentinel402-pii-secrets-compliance-audit-7afafd85/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from pii-guardrail.chronokey.workers.dev](https://www.zero.xyz/host/pii-guardrail.chronokey.workers.dev/llms.txt)