FastPII is an AI Data Security Platform with an open-source SDK for European personal identifiers. It detects, validates, and transforms sensitive data in text using checksum validation for identifiers like rodné číslo, PESEL, Steuer-ID, and SIREN.

How do I install FastPII?

Install FastPII with pip: pip install fastpii. It requires Python 3.10 or newer and has zero core dependencies.

What countries does FastPII support?

FastPII supports 4 regions: Czech Republic (15 detectors), Poland (6 detectors), Germany (6 detectors), and France (6 detectors). This includes identifiers like rodné číslo, IČO, DIČ, PESEL, NIP, REGON, Steuer-ID, USt-IdNr, SIREN, SIRET, and INSEE/NIR.

Does FastPII have external dependencies?

No. FastPII has zero core dependencies. Optional integrations like FastAPI and LangChain are available through pip extras: pip install fastpii[fastapi] or pip install fastpii[langchain].

How does FastPII validate identifiers?

FastPII uses country-specific checksum algorithms: Mod 11 for rodné číslo and IČO, Mod 10 for PESEL, ISO 7064 MOD 11,10 for Steuer-ID, Luhn for SIREN/SIRET, and Mod-97 for INSEE/NIR. This ensures only structurally valid identifiers are detected.

Set up the FastPII AI Gateway with a service token, workspace config, provider connections, and default policies.

Gateway Setup

Name: FastPII
Author: FastPII

This guide walks through the initial setup for the FastPII AI Gateway. You will create or obtain a service token, configure the gateway for a workspace, add at least one LLM provider, create a default policy, and verify that the gateway is healthy.

For the overall architecture, see Gateway Overview.

Prerequisites

Before you start, make sure you have:

A FastPII workspace ID
A valid Gateway Service Token for X-Service-Token authentication
Access to create or manage LLM providers in your workspace
A backend base URL, such as https://gateway.fastpii.com

Gateway endpoints use Service Token auth, not API key auth.

Environment variables used in examples

export FASTPII_BASE_URL="https://gateway.fastpii.com"
export FASTPII_SERVICE_TOKEN="your-gateway-service-token"
export FASTPII_WORKSPACE_ID="ws_prod_eu"

1. Get your service token

Gateway admin endpoints require the X-Service-Token header.

X-Service-Token: your-gateway-service-token

If you manage backend deployment directly, the FastPII backend validates this header against the configured service token values. In most deployments, your operator or platform admin will provide this token during workspace onboarding.

2. Check gateway health

Use the status endpoint to verify the gateway is reachable before applying configuration.

curl

curl -X GET "$FASTPII_BASE_URL/api/v1/gateway/status" \
  -H "X-Service-Token: $FASTPII_SERVICE_TOKEN"

Example response:

{
  "status": "ok",
  "service": "gateway",
  "providers_configured": 2
}

Python

import requests

base_url = "https://gateway.fastpii.com"
service_token = "your-gateway-service-token"

response = requests.get(
    f"{base_url}/api/v1/gateway/status",
    headers={"X-Service-Token": service_token},
    timeout=30,
)
response.raise_for_status()
print(response.json())

3. Read the current gateway config

Each workspace has a gateway configuration that controls providers, risk mapping, default actions, cache TTLs, audit settings, and region.

Get config

curl -X GET "$FASTPII_BASE_URL/api/v1/gateway/config?workspace_id=$FASTPII_WORKSPACE_ID" \
  -H "X-Service-Token: $FASTPII_SERVICE_TOKEN"

Example response:

{
  "workspace_id": "ws_prod_eu",
  "providers": {
    "primary": {
      "provider": "openai",
      "model": "gpt-4o-mini"
    }
  },
  "risk_levels": {
    "EMAIL": "MEDIUM",
    "PHONE": "MEDIUM",
    "CREDIT_CARD": "CRITICAL"
  },
  "default_action": "MASK",
  "rate_limits": {
    "requests_per_minute": 300,
    "burst": 50
  },
  "streaming": {
    "enabled": true,
    "buffer_tokens": 32
  },
  "auth": {
    "cache_ttl": 300
  },
  "audit": {
    "retention_days": 365,
    "level": "standard"
  },
  "region": "eu-central-1"
}

Python

import requests

base_url = "https://gateway.fastpii.com"
service_token = "your-gateway-service-token"
workspace_id = "ws_prod_eu"

response = requests.get(
    f"{base_url}/api/v1/gateway/config",
    params={"workspace_id": workspace_id},
    headers={"X-Service-Token": service_token},
    timeout=30,
)
response.raise_for_status()
config = response.json()
print(config)

4. Update the gateway config

Use PUT /api/v1/gateway/config to set the workspace defaults.

Supported request fields

The gateway accepts these GatewayConfigUpdateRequest fields:

Field	Type	Description
`providers`	`object`	Provider routing and model selection map
`risk_levels`	`object`	Entity-to-risk mapping
`default_action`	`string`	Default action, usually `MASK`
`rate_limits`	`object`	Request throttling configuration
`streaming`	`object`	Streaming behavior
`auth_cache_ttl`	`integer`	Auth cache TTL in seconds
`provider_config_cache_ttl`	`integer`	Provider config cache TTL in seconds
`policy_cache_ttl`	`integer`	Policy cache TTL in seconds
`audit_retention_days`	`integer`	Number of days to keep audit logs
`audit_level`	`string`	Audit verbosity level
`region`	`string \| null`	Optional region label for routing or residency

curl

curl -X PUT "$FASTPII_BASE_URL/api/v1/gateway/config?workspace_id=$FASTPII_WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -H "X-Service-Token: $FASTPII_SERVICE_TOKEN" \
  -d '{
    "providers": {
      "primary": {
        "provider": "openai",
        "model": "gpt-4o-mini"
      },
      "fallback": {
        "provider": "anthropic",
        "model": "claude-3-5-sonnet"
      }
    },
    "risk_levels": {
      "EMAIL": "MEDIUM",
      "PHONE": "MEDIUM",
      "ADDRESS": "HIGH",
      "CREDIT_CARD": "CRITICAL"
    },
    "default_action": "MASK",
    "rate_limits": {
      "requests_per_minute": 300,
      "burst": 50
    },
    "streaming": {
      "enabled": true,
      "buffer_tokens": 32,
      "fail_closed": true
    },
    "auth_cache_ttl": 300,
    "provider_config_cache_ttl": 600,
    "policy_cache_ttl": 300,
    "audit_retention_days": 365,
    "audit_level": "standard",
    "region": "eu-central-1"
  }'

Example response:

{
  "workspace_id": "ws_prod_eu",
  "providers": {
    "primary": {
      "provider": "openai",
      "model": "gpt-4o-mini"
    },
    "fallback": {
      "provider": "anthropic",
      "model": "claude-3-5-sonnet"
    }
  },
  "risk_levels": {
    "EMAIL": "MEDIUM",
    "PHONE": "MEDIUM",
    "ADDRESS": "HIGH",
    "CREDIT_CARD": "CRITICAL"
  },
  "default_action": "MASK",
  "rate_limits": {
    "requests_per_minute": 300,
    "burst": 50
  },
  "streaming": {
    "enabled": true,
    "buffer_tokens": 32,
    "fail_closed": true
  },
  "auth": {
    "cache_ttl": 300
  },
  "audit": {
    "retention_days": 365,
    "level": "standard"
  },
  "region": "eu-central-1"
}

Python

import requests

base_url = "https://gateway.fastpii.com"
service_token = "your-gateway-service-token"
workspace_id = "ws_prod_eu"

payload = {
    "providers": {
        "primary": {"provider": "openai", "model": "gpt-4o-mini"},
        "fallback": {"provider": "anthropic", "model": "claude-3-5-sonnet"},
    },
    "risk_levels": {
        "EMAIL": "MEDIUM",
        "PHONE": "MEDIUM",
        "ADDRESS": "HIGH",
        "CREDIT_CARD": "CRITICAL",
    },
    "default_action": "MASK",
    "rate_limits": {"requests_per_minute": 300, "burst": 50},
    "streaming": {"enabled": True, "buffer_tokens": 32, "fail_closed": True},
    "auth_cache_ttl": 300,
    "provider_config_cache_ttl": 600,
    "policy_cache_ttl": 300,
    "audit_retention_days": 365,
    "audit_level": "standard",
    "region": "eu-central-1",
}

response = requests.put(
    f"{base_url}/api/v1/gateway/config",
    params={"workspace_id": workspace_id},
    headers={
        "X-Service-Token": service_token,
        "Content-Type": "application/json",
    },
    json=payload,
    timeout=30,
)
response.raise_for_status()
print(response.json())

5. Add LLM providers

The Gateway depends on the workspace LLM provider catalog. Add your providers first, then reference them in the gateway config.

LLM provider endpoints are on the API service at https://api.fastpii.com/api/v1/llm-providers, not the Gateway service. They use user authentication (Bearer token), not Service Token.

Create a provider

curl -X POST "https://api.fastpii.com/api/v1/llm-providers" \
  -H "Authorization: Bearer <user-access-token>" \
  -H "Content-Type: application/json" \
  -d '{
    "provider_type": "openai",
    "display_name": "OpenAI Production",
    "credential_source": "env_placeholder",
    "env_placeholder": "${OPENAI_API_KEY}",
    "base_url": "https://api.openai.com/v1",
    "default_model": "gpt-4o-mini",
    "allowed_models": ["gpt-4o-mini", "gpt-4o"],
    "supports_streaming": true,
    "priority": 100,
    "is_platform_default": false
  }'

Example response:

{
  "id": "d24d2a59-f82d-4d73-b770-20489dbe8d64",
  "provider_type": "openai",
  "display_name": "OpenAI Production",
  "is_platform_default": false,
  "is_active": true,
  "credential_source": "env_placeholder",
  "key_prefix": null,
  "base_url": "https://api.openai.com/v1",
  "default_model": "gpt-4o-mini",
  "allowed_models": ["gpt-4o-mini", "gpt-4o"],
  "supports_streaming": true,
  "priority": 100,
  "validation_status": "unknown",
  "team_id": null,
  "tenant_id": null,
  "created_at": "2026-07-10T09:15:21.321000Z",
  "updated_at": "2026-07-10T09:15:21.321000Z"
}

Python

import requests

api_url = "https://api.fastpii.com"  # LLM providers are on the API service
user_access_token = "your-user-access-token"

payload = {
    "provider_type": "openai",
    "display_name": "OpenAI Production",
    "credential_source": "env_placeholder",
    "env_placeholder": "${OPENAI_API_KEY}",
    "base_url": "https://api.openai.com/v1",
    "default_model": "gpt-4o-mini",
    "allowed_models": ["gpt-4o-mini", "gpt-4o"],
    "supports_streaming": True,
    "priority": 100,
    "is_platform_default": False,
}

response = requests.post(
    f"{api_url}/api/v1/llm-providers",
    headers={
        "Authorization": f"Bearer {user_access_token}",
        "Content-Type": "application/json",
    },
    json=payload,
    timeout=30,
)
response.raise_for_status()
provider = response.json()
print(provider)

List gateway providers

After provider setup, confirm what the gateway can see for the workspace.

curl -X GET "$FASTPII_BASE_URL/api/v1/gateway/providers?workspace_id=$FASTPII_WORKSPACE_ID" \
  -H "X-Service-Token: $FASTPII_SERVICE_TOKEN"

import requests

response = requests.get(
    f"{base_url}/api/v1/gateway/providers",
    params={"workspace_id": workspace_id},
    headers={"X-Service-Token": service_token},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Example response:

{
  "providers": [
    {
      "provider": "openai",
      "model": "gpt-4o-mini",
      "streaming": true
    },
    {
      "provider": "anthropic",
      "model": "claude-3-5-sonnet",
      "streaming": true
    }
  ]
}

6. Set up a default policy

Most teams start with a default MASK policy so the gateway protects any matching traffic even before more specific rules are added.

curl -X POST "$FASTPII_BASE_URL/api/v1/gateway/policies?workspace_id=$FASTPII_WORKSPACE_ID" \
  -H "Content-Type: application/json" \
  -H "X-Service-Token: $FASTPII_SERVICE_TOKEN" \
  -d '{
    "name": "Default mask policy",
    "description": "Mask medium and high risk PII by default",
    "priority": 100,
    "action": "MASK",
    "conditions": [
      {
        "confidence_min": 0.7
      }
    ],
    "workspace_id": "ws_prod_eu",
    "is_default": true
  }'

For full policy management, including testing and priority behavior, see Policies.

7. Test your setup

At minimum, verify these three things:

GET /api/v1/gateway/status returns success.
GET /api/v1/gateway/config returns your workspace config.
GET /api/v1/gateway/policies shows at least one policy.

curl

curl -X GET "$FASTPII_BASE_URL/api/v1/gateway/policies?workspace_id=$FASTPII_WORKSPACE_ID&page=1&page_size=10" \
  -H "X-Service-Token: $FASTPII_SERVICE_TOKEN"

Example response:

{
  "policies": [
    {
      "id": "pol_01J9X7A72H0EKD8G0TYM5P7P4J",
      "name": "Default mask policy",
      "description": "Mask medium and high risk PII by default",
      "priority": 100,
      "action": "MASK",
      "conditions": [
        {
          "confidence_min": 0.7
        }
      ],
      "is_default": true,
      "workspace_id": "ws_prod_eu",
      "created_at": "2026-07-10T09:25:44.100000Z",
      "updated_at": "2026-07-10T09:25:44.100000Z"
    }
  ],
  "total": 1,
  "page": 1,
  "page_size": 10
}

Python

import requests

response = requests.get(
    f"{base_url}/api/v1/gateway/policies",
    params={
        "workspace_id": workspace_id,
        "page": 1,
        "page_size": 10,
    },
    headers={"X-Service-Token": service_token},
    timeout=30,
)
response.raise_for_status()
print(response.json())

Recommended first configuration

For a production starting point:

Set default_action to MASK
Enable streaming only after validating your policy behavior
Map high-sensitivity entities like credit cards and government IDs to CRITICAL
Keep audit_retention_days long enough for compliance review
Add a default policy before sending live traffic

Once setup is complete, continue to Policies to define enforcement rules and Audit to review events, exports, and dashboard metrics.

Gateway Setup

On this page