> ## Documentation Index > Fetch the complete documentation index at: https://docs.useboom.ai/llms.txt > Use this file to discover all available pages before exploring further. # Mark fields sensitive > Mark fields sensitive (or, over the REST API only, visible again). A sensitive value is hidden from AI agents and from teammates without access; it stays stored and keeps working in segments and messages. Applies every change or none: an unknown field fails the whole call. Keys must already exist in the attribute catalog. Over MCP only `isSensitive: true` is accepted — making a field visible again is refused with `sensitive_unmark_forbidden`; use Settings › Sensitive data or the REST API. ## OpenAPI ````yaml /api-reference/openapi.json post /api/v1/cdp/sensitive-fields openapi: 3.1.0 info: title: Boom API version: 1.0.0 description: >- Boom's public REST API — one uniform surface over every platform capability. CDP: upsert people and custom objects, define object and relationship types, link and unlink relationships, and record behavioral events — one record per request or up to 1000 per request via the `/batch` endpoints. Segments: read (list, read, membership) and full authoring — discover the filterable catalog, validate a filter, create and update segments, preview match counts, and trigger evaluation. Initiatives: create and configure outreach initiatives, link WhatsApp templates, drive the lifecycle (launch, cancel, archive), and read collected-data summaries. Participants: enroll people into an active initiative, track their status, read conversation transcripts, and stop outreach. Journeys: read-only access to always-on message flows and their metrics. WhatsApp templates: list your WhatsApp numbers and list, read, and create message templates. The same capabilities are exposed as MCP tools with identical schemas. servers: - url: https://www.useboom.ai description: Production - url: https://dev.useboom.ai description: Development (sandbox — use a development organization API key) security: - bearerAuth: [] paths: /api/v1/cdp/sensitive-fields: post: tags: - CDP Sensitive fields summary: Mark fields sensitive description: >- Mark fields sensitive (or, over the REST API only, visible again). A sensitive value is hidden from AI agents and from teammates without access; it stays stored and keeps working in segments and messages. Applies every change or none: an unknown field fails the whole call. Keys must already exist in the attribute catalog. Over MCP only `isSensitive: true` is accepted — making a field visible again is refused with `sensitive_unmark_forbidden`; use Settings › Sensitive data or the REST API. operationId: cdp_sensitive_fields_set requestBody: required: true content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: changes: description: >- The fields to change, as an array. Each item names one field by `scope`: `built_in` with `field`, `people` with `key`, or `custom_object` with `type` and `key`. minItems: 1 maxItems: 100 type: array items: oneOf: - type: object properties: scope: type: string const: built_in field: type: string enum: - EMAIL - PHONE_NUMBER - FIRST_NAME - LAST_NAME description: >- A contact field every person has. `externalId` cannot be hidden. isSensitive: type: boolean required: - scope - field - isSensitive - type: object properties: scope: type: string const: people key: type: string minLength: 1 maxLength: 255 description: The People attribute key. isSensitive: type: boolean required: - scope - key - isSensitive - type: object properties: scope: type: string const: custom_object type: type: string minLength: 1 maxLength: 255 description: The custom object type name. key: type: string minLength: 1 maxLength: 255 description: The attribute key in that type's catalog. isSensitive: type: boolean required: - scope - type - key - isSensitive required: - changes responses: '200': description: Success content: application/json: schema: $schema: https://json-schema.org/draft/2020-12/schema type: object properties: applied: type: array items: type: object properties: scope: type: string enum: - built_in - people - custom_object field: type: string enum: - EMAIL - PHONE_NUMBER - FIRST_NAME - LAST_NAME description: >- A contact field every person has. `externalId` cannot be hidden. type: type: string key: type: string isSensitive: type: boolean changed: type: boolean description: False when the field already had this value. required: - scope - isSensitive - changed additionalProperties: false required: - applied additionalProperties: false '400': description: Validation failed or the request cannot proceed. content: application/json: schema: type: object properties: error: type: object properties: code: type: string description: Stable machine-readable error code (snake_case). message: type: string required: - code - message required: - error '401': description: Missing, malformed, or revoked API key. content: application/json: schema: type: object properties: error: type: object properties: code: type: string description: Stable machine-readable error code (snake_case). message: type: string required: - code - message required: - error '404': description: The resource does not exist in this organization. content: application/json: schema: type: object properties: error: type: object properties: code: type: string description: Stable machine-readable error code (snake_case). message: type: string required: - code - message required: - error '409': description: >- Conflicts with the current state (duplicates, wrong lifecycle state). content: application/json: schema: type: object properties: error: type: object properties: code: type: string description: Stable machine-readable error code (snake_case). message: type: string required: - code - message required: - error '422': description: The request is well-formed but semantically invalid. content: application/json: schema: type: object properties: error: type: object properties: code: type: string description: Stable machine-readable error code (snake_case). message: type: string required: - code - message required: - error '429': description: Rate limit exceeded — retry after `Retry-After`. content: application/json: schema: type: object properties: error: type: object properties: code: type: string description: Stable machine-readable error code (snake_case). message: type: string required: - code - message required: - error '500': description: Internal server error. content: application/json: schema: type: object properties: error: type: object properties: code: type: string description: Stable machine-readable error code (snake_case). message: type: string required: - code - message required: - error '503': description: Transient error — retry with a narrower request. content: application/json: schema: type: object properties: error: type: object properties: code: type: string description: Stable machine-readable error code (snake_case). message: type: string required: - code - message required: - error components: securitySchemes: bearerAuth: type: http scheme: bearer description: 'Organization API key, sent as `Authorization: Bearer boom_org_...`.' ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.