---
title: Reveal or discard sensitive data
description: Reveal the redacted sensitive values on a run, or delete them permanently.
editUrl: true
head: []
template: doc
sidebar:
  hidden: false
  attrs: {}
pagefind: true
draft: false
---

Values your integration marks as sensitive are redacted when you look at a run. Reveal them when you need to read what the agent actually handled, and discard them once a span's values shouldn't be kept any longer.

By the end you'll have read a span's sensitive values, and, if you choose to, deleted them for good while keeping the record that they were there.

## Before you start

- Your integration marks sensitive values with the [sensitive encoding](/api/sensitive-encoding). Prefactor doesn't detect sensitive data on its own; see [Sensitive data](/platform/sensitive-data).
- To discard values, your admin user has the **Full access** role. Revealing works for any role.

## Open the span

1. Go to **Agents** and select **View details** on the agent's card.

   The [Agent page](/web-app/agent) opens.

2. Select the **History** tab.

   Every run of the agent is listed, newest first.

3. Select **View** on the run's row.

   The [Agent instance page](/web-app/agent-instance) opens on the **Activity** tab. If the run's own input, result, or metadata hold sensitive values, the strip at the top has a **Show sensitive information for this instance** checkbox.

4. Select the span you want to read.

   The span detail panel opens. Each sensitive value in **Payload** and **Result payload** shows as a placeholder labelled with its data categories, and the top of the panel has a **Show sensitive information** checkbox and a **Discard sensitive** button.

## Reveal the values

5. Tick **Show sensitive information**.

   The placeholders are replaced by the real values. They stay visible as you step through the run's spans, and are hidden again when you switch tabs or leave the page. **Show sensitive information for this instance** in the strip at the top is the same switch. To read the run's own input, result, and metadata, select the **Details** tab and tick it there.

## Discard the values

6. With the values showing, select **Discard sensitive**.

   The **Discard sensitive data** dialog opens and explains what will be removed.

:::danger
Discarding permanently deletes this span's sensitive values. The span still shows that sensitive data of those categories was present, but nobody can view the values again, and there is no way to recover them.
:::

7. Select **Discard sensitive data** to confirm.

   The dialog closes, Prefactor shows **Sensitive data discarded for this span**, and the values are hidden again.

Discard works one span at a time in the web app. Repeat steps 4 to 7 for each span whose values you want gone.

## Verify

Tick **Show sensitive information** again on the same span. The placeholders stay in place of the values, and **Discard sensitive** stays disabled; hovering it shows **There is no sensitive information to discard**.

## If it didn't work

- **There's no Show sensitive information checkbox.** The span holds no marked values. If you expected some, check that your integration wraps them with the [sensitive encoding](/api/sensitive-encoding).
- **Discard sensitive is disabled.** Hover it for the reason. **Sensitive information is not currently being shown** means you need to tick **Show sensitive information** first. **There is no sensitive information to discard** means the values were already discarded.
- **Discarding fails with a permission error.** Your admin user is Read only. Ask someone with Full access to discard the values, or to change your role on the [Account › Admin users tab](/web-app/account/admin-users).
- **A judge's run shows the values unredacted.** Judges receive the real values, and a judge's run records what it was sent as ordinary content. See [Sensitive data](/platform/sensitive-data#instance-payloads).

## Other ways to do this

The API discards one span's values with [POST /api/v1/agent_spans/{agent_span_id}/discard_sensitive](/api/platform/operations/actionagentspandiscardsensitive). To discard the sensitive values in a run's input, result, and metadata, which the web app can't do, use [POST /api/v1/agent_instance/{agent_instance_id}/discard_sensitive](/api/platform/operations/actionagentinstancediscardsensitive).

## Related

- [Sensitive data](/platform/sensitive-data) — how Prefactor stores, redacts, and discards marked values.
- [Agent › Instance › Activity tab](/web-app/agent-instance/activity) — the span list and detail panel.
- [Agent › Instance › Details tab](/web-app/agent-instance/details) — the run's input, result, and metadata.
- [Investigate a run](/guides/investigate-a-run) — find a run and read what each step did.