{
  "slug": "har-redact",
  "name": "gizza-ai/har-redact",
  "version": "0.1.0",
  "title": "HAR Redactor — mask cookies, tokens & auth headers in a HAR — gizza.ai",
  "description": "Replace HAR cookies, auth headers, query tokens, and bodies with a placeholder while keeping the capture valid and viewer-friendly.",
  "tags": [
    "har redact",
    "har sanitizer",
    "redact har file",
    "remove cookies from har",
    "har privacy",
    "sanitize har before sharing",
    "http archive",
    "mask auth headers har"
  ],
  "category": "network",
  "urls": {
    "page": "https://gizza.ai/tools/har-redact/",
    "markdown": "https://gizza.ai/tools/har-redact/index.md",
    "descriptor": "https://gizza.ai/tools/har-redact/tool.json",
    "deep_link_example": "https://gizza.ai/tools/har-redact/?har=%7B%22log%22%3A%7B%22entries%22%3A%5B%7B%22request%22%3A%7B%22method%22%3A%22POST%22%2C%22url%22%3A%22https%3A%2F%2Fexample.com%2Fapi%2Flogin%3Ftoken%3DSECRET123%22%2C%22headers%22%3A%5B%7B%22name%22%3A%22Authorization%22%2C%22value%22%3A%22Bearer%20eyJhbGc.payload.sig%22%7D%5D%2C%22cookies%22%3A%5B%7B%22name%22%3A%22sessionid%22%2C%22value%22%3A%22topsecretsession%22%7D%5D%7D%2C%22response%22%3A%7B%22status%22%3A200%2C%22content%22%3A%7B%22size%22%3A24%2C%22mimeType%22%3A%22application%2Fjson%22%2C%22text%22%3A%22%7B%5C%22session%5C%22%3A%5C%22privatetok%5C%22%7D%22%7D%7D%7D%5D%7D%7D&cookies=true&auth_headers=true&extra_headers=x-tenant-id%2Cx-trace&query_params=true&sensitive_params=account_id%2Ctenant&bodies=response&placeholder=%5BREDACTED%5D&output=har&pretty=true"
  },
  "cli": "gizza tool har-redact '{\"log\":{\"entries\":[{\"request\":{\"method\":\"POST\",\"url\":\"https://example.com/api/login?token=SECRET123\",\"headers\":[{\"name\":\"Authorization\",\"value\":\"Bearer eyJhbGc.payload.sig\"}],\"cookies\":[{\"name\":\"sessionid\",\"value\":\"topsecretsession\"}]},\"response\":{\"status\":200,\"content\":{\"size\":24,\"mimeType\":\"application/json\",\"text\":\"{\\\"session\\\":\\\"privatetok\\\"}\"}}}]}}'",
  "tool": {
    "description": "Replace the sensitive VALUES in a HAR (HTTP Archive) capture with a placeholder so it is safe to attach to a bug report, while the full structure stays intact for debugging. Redacts (each value substituted, the surrounding structure kept): cookie values (request/response cookies[] + Cookie/Set-Cookie headers), Authorization/Proxy-Authorization and common API-key/token header values, sensitive query-string parameter values (in queryString[] and the URL), and — per bodies=none/request/response/both (default response) — request postData and response content.text. Header/cookie/param names, URLs' paths, methods, status codes, timings, and sizes are untouched, so the capture still opens in any HAR viewer and the waterfall still renders (key order preserved). Extend the header list with extra_headers and the param list with sensitive_params (comma-separated). Set a custom placeholder (default [REDACTED]). Get the redacted HAR JSON (compact by default, pretty=true to indent) or a dry-run summary (output=summary) with per-category counts. Distinct from har-body-stripper, which DELETES bodies to shrink a file and leaves cookies/headers alone — this SUBSTITUTES values in place. Runs locally; max 10000 entries.",
    "parameters": {
      "additionalProperties": false,
      "properties": {
        "auth_headers": {
          "default": true,
          "description": "Redact the values of Authorization, Proxy-Authorization, and common API-key/token headers (x-api-key, api-key, x-auth-token, x-csrf-token, and similar). Header names are kept. Default true.",
          "type": "boolean"
        },
        "bodies": {
          "default": "response",
          "description": "Which message bodies to replace with the placeholder: 'response' (default) response content.text, 'request' request postData (text + form params), 'both', or 'none'. Bodies often echo the redacted secrets, so the default clears response text.",
          "enum": [
            "none",
            "request",
            "response",
            "both"
          ],
          "type": "string"
        },
        "cookies": {
          "default": true,
          "description": "Redact cookie values: the request/response cookies[].value arrays and the Cookie/Set-Cookie header values. Default true.",
          "type": "boolean"
        },
        "extra_headers": {
          "default": "",
          "description": "Comma-separated ADDITIONAL header names (case-insensitive, exact match) whose values to redact on top of the built-in auth/API-key list, e.g. x-tenant-id,x-trace. Empty (default) uses only the built-ins.",
          "type": "string"
        },
        "har": {
          "description": "The HAR (HTTP Archive) capture as JSON text — the { \"log\": { \"entries\": [ … ] } } object that browser DevTools export via Network tab → \"Save all as HAR\". Max 10000 entries.",
          "type": "string"
        },
        "output": {
          "default": "har",
          "description": "'har' (default) returns the redacted capture as JSON, ready to save as a .har file. 'summary' is a dry-run report instead: entries scanned and how many cookies, auth headers, query values, and body fields were redacted.",
          "enum": [
            "har",
            "summary"
          ],
          "type": "string"
        },
        "placeholder": {
          "default": "[REDACTED]",
          "description": "The text each redacted value is replaced with. Default [REDACTED]. Must not be empty; re-running with the same placeholder is a no-op (already-redacted values are left alone).",
          "type": "string"
        },
        "pretty": {
          "default": false,
          "description": "Pretty-print the output HAR with 2-space indentation. Default false = compact single-line JSON (DevTools exports are pretty-printed).",
          "type": "boolean"
        },
        "query_params": {
          "default": true,
          "description": "Redact the values of sensitive query-string parameters (token, password, code, client_secret, sig, and similar) in both request.queryString[] and the request.url query string; non-sensitive params and the URL path are kept. Default true.",
          "type": "boolean"
        },
        "sensitive_params": {
          "default": "",
          "description": "Comma-separated ADDITIONAL query/form parameter names (case-insensitive, exact match) to treat as sensitive, merged with the built-in list, e.g. account_id,tenant. Empty (default) uses only the built-ins.",
          "type": "string"
        }
      },
      "required": [
        "har"
      ],
      "type": "object"
    }
  }
}