pii shape audit derived

{
  "input": {
    "body": {
      "logs": "{\"event\":\"signup\",\"user\":{\"email\":\"ada@example.test\",\"ip\":\"203.0.113.9\"},\"order_ref\":\"ORD-100045\"}\n{\"event\":\"payment\",\"card\":\"4111111111111111\",\"amount_cents\":1250,\"customer\":{\"dob\":\"1979-03-12\"}}\n{\"event\":\"payout\",\"iban\":\"GB82WEST12345698765432\",\"phone\":\"+61 2 9876 5432\"}\n{\"event\":\"signup\",\"user\":{\"email\":\"grace@example.test\",\"ip\":\"198.51.100.4\"},\"order_ref\":\"ORD-100046\"}\n",
      "allow_fields": [
        "user.ip"
      ]
    },
    "type": "http",
    "method": "POST",
    "bodyType": "json"
  },
  "output": {
    "type": "json",
    "example": {
      "clean": false,
      "fields": [
        {
          "field": "user.email",
          "lines": 2,
          "shape": "EMAIL_ADDRESS",
          "distinct_values": 2
        },
        {
          "field": "card",
          "lines": 1,
          "shape": "PAYMENT_CARD_NUMBER",
          "distinct_values": 1
        },
        {
          "field": "customer.dob",
          "lines": 1,
          "shape": "DATE_OF_BIRTH_SHAPED",
          "distinct_values": 1
        }
      ],
      "limits": {
        "maxLines": 20000,
        "maxSpans": 10000,
        "maxFields": 500,
        "maxSamples": 20000,
        "maxFindings": 500,
        "maxJsonBytes": 2097152
      },
      "passed": false,
      "complete": false,
      "findings": [
        {
          "code": "EMAIL_ADDRESS",
          "field": "user.email",
          "shape": "EMAIL_ADDRESS",
          "detail": "user.email holds a local part, an at sign and a dotted domain on 2 of 4 line(s), with 2 distinct value(s). No value is reported."
        },
        {
          "code": "PAYMENT_CARD_NUMBER",
          "field": "card",
          "shape": "PAYMENT_CARD_NUMBER",
          "detail": "card holds a 12 to 19 digit run that passes the Luhn check, so it is a plausible card number rather than any digit run on 1 of 4 line(s), with 1 distinct value(s). No value is reported."
        },
        {
          "code": "DATE_OF_BIRTH_SHAPED",
          "field": "customer.dob",
          "shape": "DATE_OF_BIRTH_SHAPED",
          "detail": "customer.dob holds a complete date in a plausible birth range, in a field named for one on 1 of 4 line(s), with 1 distinct value(s). No value is reported."
        }
      ],
      "line_count": 4,
      "request_id": "example-request",
      "service_id": "pii_shape_audit",
      "assumptions": [
        "No value is ever returned. A match is reported as its field, its class, how many lines carry it and how many distinct values there are, because a response that echoed personal data would be the proble...",
        "A card number is checked by the Luhn algorithm and an account number by its own mod-97 checksum, so a match is a plausible real value rather than any run of digits. That is what keeps an order number ...",
        "A date of birth is only a date until a field name says otherwise, so that class needs the field name as well as the value. The classes looked for are published in every response."
      ],
      "limitations": [
        "The lines supplied. clean means no recognised shape was found, which is not a statement that the logs hold no personal data: a name, an address, a free-text note or an encoded value is not found here.",
        "Not a compliance determination. Whether a field is lawful to log, and under which basis, is outside this entirely."
      ],
      "match_count": 6,
      "observed_at": "2026-10-02T00:00:00.000Z",
      "not_examined": [
        "FIELD_ALLOWED: user.ip is in the allow list, so a match there was not reported."
      ],
      "finding_count": 5,
      "shape_classes": [
        {
          "code": "EMAIL_ADDRESS",
          "description": "a local part, an at sign and a dotted domain"
        },
        {
          "code": "PAYMENT_CARD_NUMBER",
          "description": "a 12 to 19 digit run that passes the Luhn check, so it is a plausible card number rather than any digit run"
        },
        {
          "code": "IBAN",
          "description": "an account number whose own mod-97 checksum verifies"
        }
      ],
      "service_version": "1.0.0",
      "findings_by_code": {
        "IBAN": 1,
        "EMAIL_ADDRESS": 1,
        "PAYMENT_CARD_NUMBER": 1,
        "PHONE_NUMBER_SHAPED": 1,
        "DATE_OF_BIRTH_SHAPED": 1
      },
      "unreadable_line_count": 0
    }
  }
}