Exclude PII from journey state

By default, the /journey/state/fetch response returns the customer’s personal data. It’s in context.subject, and in the subject of each module’s step result. For example, a step result can contain the address that an address verification module verified. If your system doesn’t need that data back, then set excludePii to true when you start the journey. The journey runs the same checks on the same data, but the state response leaves out the fields that hold the customer’s personal data. You still get the journey status, the result, and each module’s outcome and advice.

Set excludePii to the JSON boolean true. The API accepts any other value, including the string "true", without an error, and then returns the personal data as usual.

When to exclude PII

Exclude PII when your system acts on the journey result, but doesn’t need GBG Go to send back the customer’s details. For example:

Your backend reads only the result and the module outcomes to decide whether to approve the customer.
You already hold the customer’s details, because your own interface collected them.
You want to reduce the personal data that reaches logs, queues or other systems that store the state response.

Don’t exclude PII if your system reads customer data from the state response. For example, to show the verified address, or to read extracted document data from a step result.

Before you begin

Make sure you have:

Published API journey: A journey published with API delivery. You need its resource ID and version.
Access token: Obtained in Step 1: Authenticate.

Start a journey without PII in the state

To exclude PII, set excludePii to true in context.config when you start the journey.

curl --request POST \
  --url https://eu.platform.go.gbgplc.com/v2/captain/journey/start \
  --header 'Authorization: Bearer your_access_token' \
  --header 'Content-Type: application/json' \
  --data '{
    "resourceId": "f3d875bc2ebff66f557fb177646f4c80e453d8d064b92a53fd1079edded1ea91@2lhovl4z",
    "context": {
      "config": {
        "delivery": "api",
        "excludePii": true
      },
      "subject": {
        "identity": {
          "currentAddress": {
            "lines": ["12 Wellington Place"],
            "locality": "Leeds",
            "postalCode": "LS1 4AP",
            "country": "GB"
          },
          "emails": [
            { "type": "personal", "email": "jane.doe@example.com" }
          ]
        }
      }
    }
  }'

const response = await fetch('https://eu.platform.go.gbgplc.com/v2/captain/journey/start', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    resourceId: process.env.JOURNEY_RESOURCE_ID,
    context: {
      config: { delivery: 'api', excludePii: true },
      subject
    }
  })
});

const { instanceId } = await response.json();

import os
import requests

response = requests.post(
    'https://eu.platform.go.gbgplc.com/v2/captain/journey/start',
    headers={
        'Authorization': f'Bearer {access_token}',
        'Content-Type': 'application/json'
    },
    json={
        'resourceId': os.environ['JOURNEY_RESOURCE_ID'],
        'context': {
            'config': {'delivery': 'api', 'excludePii': True},
            'subject': subject
        }
    }
)

instance_id = response.json()['instanceId']

The start response is the same as for any other journey. Keep the instanceId for the calls that follow.

JSON

{
  "instanceId": "Pq_hhIX6-sHUy9FLSDzPLu",
  "status": "started",
  "message": "Journey Pq_hhIX6-sHUy9FLSDzPLu started successfully"
}

Request body fields

This field controls PII exclusion. For the other start request fields, see Step 2: Start a journey.

Field	Required	Description
`context.config.excludePii`	No	Set to `true` to leave personal data out of the journey state response. If you omit it, or set it to any value other than the boolean `true`, then the response includes personal data.

What the state response leaves out

When you fetch the journey state of a journey started with excludePii, the response leaves out these fields entirely. They aren’t returned as empty objects.

Field	What it contains by default
`context.subject`	The customer’s data, such as their name, address, emails and phone numbers. This includes data that the customer submitted through interactions.
`context.process.steps[].subject`, `context.process.steps[].result.subject` and `context.result.subject`	The data that a module returns about the customer. For example, the address that an address verification module matched, split into its parts.
`context.process.steps[].result.documents` and `context.result.documents`	The identity document data that a module extracted.
`context.process.steps[].result.note` and `context.result.note`	Free-form notes. These can contain names and reference numbers.

excludePii also removes subjectSources, subjects, results and result.raw at the same levels. The response leaves these fields out even without excludePii. The response still includes:

The journey status and context.result, apart from the fields in the table.
Each step’s outcome, advice and process details.
The journey details in context.process.journey.

excludePii removes only the fields in the table. Personal data inside the fields that the response keeps can still appear. For example, result.error can contain provider text with names and dates of birth, and result.advice or module-specific result fields can contain nested personal data.Don’t treat the response as free of personal data. Apply your own controls before you log or store it.

A synchronous start response leaves the same fields out of its state. excludePii works the same way for journeys with page delivery.

excludePii changes only what the API returns. The journey’s modules still receive the customer’s data, and they return the same outcomes and advice as they would without it.

Example responses

Both of these responses are from the same journey, started with the same address and email. The journey has run an address verification module, and it’s waiting for the customer to submit more data.

{
  "view": "full",
  "instanceId": "Pq_hhIX6-sHUy9FLSDzPLu",
  "status": "InProgress",
  "context": {
    "process": {
      "journey": {
        "id": "f3d875bc2ebff66f557fb177646f4c80e453d8d064b92a53fd1079edded1ea91",
        "version": "2lhovl4z",
        "name": "UK retail account opening",
        "startedAt": "2026-11-04T09:09:11.586Z"
      },
      "instance": {
        "id": "Pq_hhIX6-sHUy9FLSDzPLu",
        "instanceId": "Pq_hhIX6-sHUy9FLSDzPLu"
      },
      "steps": [
        {
          "nodeId": "mtv8y17k8t1mfn8x45k",
          "name": "Address Verification",
          "result": {
            "status": "complete",
            "outcome": "Partially Verified",
            "advice": {
              "addressVerified": true,
              "postalCodeVerified": true,
              "countryRecognized": true,
              "multipleMatches": false,
              "verificationLevel": "PREMISE",
              "matchScore": 88,
              "gbgAddressQualityLevel": "2",
              "geocoded": false,
              "serviceError": false
            }
          },
          "process": {
            "step": {
              "moduleId": "AddressVerification",
              "moduleName": "Address Verification",
              "variantId": "GlobalAddressVerify",
              "variantName": "Global",
              "startedAt": "2026-11-04T09:09:12.617Z",
              "endedAt": "2026-11-04T09:09:13.294Z",
              "durationMilliSec": 677
            }
          }
        }
      ]
    },
    "result": {
      "status": "inprogress"
    }
  },
  "result": {
    "status": "inprogress"
  }
}

{
  "view": "full",
  "instanceId": "Pq_hhIX6-sHUy9FLSDzPLu",
  "status": "InProgress",
  "context": {
    "process": {
      "journey": {
        "id": "f3d875bc2ebff66f557fb177646f4c80e453d8d064b92a53fd1079edded1ea91",
        "version": "2lhovl4z",
        "name": "UK retail account opening",
        "startedAt": "2026-11-04T09:08:12.325Z"
      },
      "instance": {
        "id": "Pq_hhIX6-sHUy9FLSDzPLu",
        "instanceId": "Pq_hhIX6-sHUy9FLSDzPLu"
      },
      "steps": [
        {
          "nodeId": "mtv8y17k8t1mfn8x45k",
          "name": "Address Verification",
          "result": {
            "status": "complete",
            "outcome": "Partially Verified",
            "advice": {
              "addressVerified": true,
              "postalCodeVerified": true,
              "countryRecognized": true,
              "multipleMatches": false,
              "verificationLevel": "PREMISE",
              "matchScore": 88,
              "gbgAddressQualityLevel": "2",
              "geocoded": false,
              "serviceError": false
            },
            "subject": {
              "identity": {
                "currentAddress": {
                  "addressString": "12 Wellington Place, Leeds, LS1 4AP",
                  "lines": ["12 Wellington Place", "Leeds", "LS1 4AP"],
                  "premise": "12",
                  "thoroughfare": "Wellington Place",
                  "locality": "Leeds",
                  "administrativeArea": "West Yorkshire",
                  "postalCode": "LS1 4AP",
                  "country": "GBR"
                }
              }
            }
          },
          "process": {
            "step": {
              "moduleId": "AddressVerification",
              "moduleName": "Address Verification",
              "variantId": "GlobalAddressVerify",
              "variantName": "Global",
              "startedAt": "2026-11-04T09:08:13.804Z",
              "endedAt": "2026-11-04T09:08:14.476Z",
              "durationMilliSec": 672
            }
          }
        }
      ]
    },
    "subject": {
      "identity": {
        "currentAddress": {
          "lines": ["12 Wellington Place"],
          "locality": "Leeds",
          "postalCode": "LS1 4AP",
          "country": "GB"
        },
        "emails": [
          { "type": "personal", "email": "jane.doe@example.com" }
        ]
      },
      "uid": ""
    },
    "result": {
      "status": "inprogress"
    }
  },
  "result": {
    "status": "inprogress"
  }
}

For a description of each field, see Step 5: Fetch journey state.

Handle a response without PII

With excludePii, the fields in the table are missing from the response, not empty. Read them as optional, so that your code doesn’t fail when they aren’t there.

const state = await response.json();

// Present only when the journey wasn't started with excludePii.
const identity = state.context.subject?.identity;

const outcomes = state.context.process.steps.map((step) => ({
  module: step.name,
  outcome: step.result?.outcome,
  advice: step.result?.advice
}));

state = response.json()

# Present only when the journey wasn't started with excludePii.
identity = state['context'].get('subject', {}).get('identity')

outcomes = [
    {
        'module': step.get('name'),
        'outcome': step.get('result', {}).get('outcome'),
        'advice': step.get('result', {}).get('advice'),
    }
    for step in state['context']['process']['steps']
]

Best practices

Check that your code sends excludePii as a boolean. A string value such as "true" doesn’t exclude PII, and the API doesn’t return an error.
After you turn on excludePii, fetch the state of a test journey and check that context.subject isn’t in the response.
If you need the customer’s details after the journey, then use the copy that your own system collected.

Get Started

Platform

API-first integration

Hosted journey

Resources

Exclude PII from journey state

When to exclude PII

Before you begin

Start a journey without PII in the state

Request body fields

What the state response leaves out

Example responses

Handle a response without PII

Best practices

​When to exclude PII

​Before you begin

​Start a journey without PII in the state

​Request body fields

​What the state response leaves out

​Example responses

​Handle a response without PII

​Best practices

When to exclude PII

Before you begin

Start a journey without PII in the state

Request body fields

What the state response leaves out

Example responses

Handle a response without PII

Best practices