Private Fields: Mask Sensitive Fulfillment Data

Note: Private Fields is available for some organizations and currently applies to fulfillments only. To turn it on for your organization, submit a request.

How Private Fields works

When a field is marked private:

• Users see a mask in place of the value, in the app and in API responses. For example, a serial number SN-00100 shows as **-*****. In the app, masked characters show as dots.
• Users with permission to reveal can show the real value on the fulfillment details page or through the API. Each reveal is recorded.
• Integrations (connectors, custom integrations, and the Automation Engine) still read and send the real value, so 3PLs, eCommerce channels, and other systems keep working.
• Event logs and source documents are masked too. Private values in API event payloads show as masks, and the original vendor payload (sourceDoc) shows as *****.

Before you start

• Who can manage private fields: users whose role can update the organization (for example, the Administrator role). Users with temporary access cannot change private fields.
• Who can grant reveal permission: users whose role can invite users. You cannot grant the permission to yourself; another administrator must do it.
• Which records: fulfillments only. Values copied from a fulfillment into an arrival or receipt stay masked there too.

Add private fields

1. In the left navigation pane, select Settings > Access & Security.
2. Select the Private Fields tab.
3. Under Add private field:
   1. In Entities, keep Fulfillments selected.
   2. In Property, search for the field you want to mask, for example trackingNumber or lineItems[].serialNumbers.
   3. If you chose a custom field property, enter the field's name in Custom field name, for example giftCardNumber. Names are not case-sensitive.
   4. In Masking type, select Full or Last 4 (see the table below).
   5. Select Add field.
4. Repeat for each field you want to mask, then select Save at the bottom of the page.
5. In the confirmation dialog, add a note if your organization requires one, and select Save changes.

The field now appears under Masked fields, grouped by entity, with its masking type and status (Active once applied).

Masking types

Spaces and common punctuation (such as -, ., /, #) are kept, so the mask has the same length and grouping as the value. Last 4 helps support teams confirm a value with a customer without exposing the full number.

Fields you can and cannot mask

You can mask most text fields on a fulfillment, for example:

• Tracking number (trackingNumber). Tracking URLs are masked with it automatically, because they contain the tracking number.
• Line item serial numbers (lineItems[].serialNumbers)
• Fulfillment custom fields (customFields[name=<name>].value)
• Line item custom fields (lineItems[].customFields[name=<name>].value)

You cannot mask fields that Pipe17 needs to identify and match records, such as a line's SKU, unique ID, or lot number, the fulfillment ID, order IDs, location ID, integration, and status. If you try, the save fails and the error names the field.

Limits: up to 32 private fields per entity, and each field can be added only once.

Change or remove private fields

1. Go to Settings > Access & Security > Private Fields.
2. Under Masked fields, change a field's masking type, or select the trash icon to remove it.
3. Select Save, then Save changes in the confirmation dialog.

When you remove a field or change it from Full to Last 4, the confirmation dialog lists the fields that will show more data, so you can check before saving.

Removing a field does not unmask values that are already stored as private. Those values stay masked for users, including in arrivals and receipts created from the fulfillment.

Let a user reveal private values

By default, no user can reveal masked values. To give a user permission:

1. Go to Settings > Users.
2. Select the user to edit, or select Invite user to add a new one.
3. Under Sensitive data, select Allow revealing sensitive data.
4. Save the user.

Keep in mind:

• You cannot grant this permission to yourself. Another user who can invite users must grant it. This makes sure every reveal permission is approved by a second person.
• API keys inherit the permission. API keys that the user created can reveal values too.
• Only active users can reveal. If you clear the checkbox, the user loses the permission on their next request.
• Bulk import: when you import users from a CSV file, use the Private Field Access column. Enter true to allow revealing, or false (or leave it blank) to keep values hidden. Select Import > Download template for a template with this column.
• Every change to this permission is recorded in the audit trail.

Reveal a private value

In the app

1. Open a fulfillment (Orders > Fulfillments, then select a fulfillment).
2. Masked values show as dots, for example in Shipment Information > Tracking number.
3. If you have permission, select the reveal (eye) icon next to the value. The real value appears, and the reveal is recorded.
4. Select the hide icon to mask the value again. Values are masked again when you leave or refresh the page.

If you don't see the reveal icon, you don't have permission to reveal. Ask an administrator to turn on Allow revealing sensitive data for you.

Through the API

Add the reveal parameter to a fulfillment request:

GET /fulfillments/{fulfillmentId}?reveal=lineItems[].serialNumbers
GET /fulfillments/{fulfillmentId}?reveal=all
GET /fulfillments?reveal=trackingNumber&status=pending

• reveal accepts all, or a comma-separated list of private field paths.
• It works only on GET /fulfillments and GET /fulfillments/{fulfillmentId}. On a list, every fulfillment on the page is revealed.
• The response includes a privateFields summary that lists which paths were revealed, which stayed masked, and which were ignored because they are not private.
• A caller without permission receives a 403 error.

Audit trail

Pipe17 records these actions in a private fields audit trail, kept for 7 years:

Audit entries never contain the private values themselves. Administrators can list entries through the API with GET /private_fields_audit, filtered by fulfillment, user, action, or date range.

If Pipe17 cannot record a reveal, the values stay masked and the response includes a warning.

What else to know

Existing fulfillments

Masking applies to fulfillments created before a field was made private too: users see the mask in reads, lists, searches, and event logs. However, searching or filtering by the real value still finds older fulfillments, because Pipe17 does not rewrite them.

Editing a fulfillment with masked values

When you save a fulfillment that shows masked values, you can leave the masks as they are. Pipe17 keeps the stored real value.

• To change a value, enter the new real value. It is stored as private.
• To clear a value, send an empty value.
• Don't type a made-up mask (for example ****1234). Pipe17 rejects masks that don't match the stored value.
• If someone else changes the fulfillment while you edit it, the save fails with a conflict. Reload the fulfillment and try again.

Arrivals and receipts

When a purchase order or transfer order fulfillment creates an arrival, private values are copied to the arrival, and then to its receipt, and stay masked. Values on arrivals and receipts cannot be revealed yet.

Integrations and automations see real values

Connectors, custom integrations, and the Automation Engine read the real values, and their reads are not recorded in the audit trail. To keep private data protected:

• Allow only trusted users to manage integrations and view integration API keys.
• Allow only users who may see private values to create or edit automation rules.

Troubleshooting

• The Private Fields tab is not shown in Access & Security
  Private Fields is available for some organizations. Submit a request to turn it on.
• "You do not have permission to change private field settings"
  Your role cannot update the organization, or you have temporary access. Ask an administrator to make the change.
• "Private fields are not enabled for this organization yet"
  Your organization is not enabled for Private Fields. You can still remove fields or change Last 4 to Full. Submit a request to turn it on.
• Saving the private fields list fails with an error that names a field
  The field cannot be private (for example, a SKU or an ID), or it is not a text field. Remove it and save again.
• The Allow revealing sensitive data checkbox is disabled
  Only users who can invite users can change it, and you cannot change it for yourself. Ask another administrator.
• There is no reveal icon next to a masked value
  You don't have the Allow revealing sensitive data permission, or the value is on an arrival or receipt, which can't be revealed yet.
• "Unable to reveal sensitive data. Try again."
  Pipe17 could not record the reveal, so the value stayed masked. Try again in a moment.
• Saving a fulfillment fails with "masked value does not match the stored value"
  A masked value in your update doesn't match the stored value. Leave the field unchanged, enter the real value, or reveal it first.
• Saving a fulfillment fails with "changed while it was being updated"
  Someone else changed the fulfillment while you were editing. Reload it and save again.

Need Help?

If you need additional assistance:

• Use Ask Pippen, our AI agent, located at the top of the platform page.
• Submit a support request with as much relevant detail as possible. Learn how to submit a request.

We're here to help you succeed with your operations.