> ## Documentation Index
> Fetch the complete documentation index at: https://docs.go.gbgplc.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Exclude PII from journey state

> Start a journey with excludePii so that the journey state response leaves out the customer's personal data.

By default, the [`/journey/state/fetch`](https://docs.go.gbgplc.com/docs/go-v2/api-reference/endpoint/fetch-journey-state) response returns the customer's personal data. It's in `context.subject`, and in the `subject` of each module's step result. For example, a step result can contain the address that an address verification module verified.

If your system doesn't need that data back, then set `excludePii` to `true` when you start the journey. The journey runs the same checks on the same data, but the state response leaves out the fields that hold the customer's personal data. You still get the journey status, the result, and each module's outcome and advice.

> [!WARNING]
>
> Set `excludePii` to the JSON boolean `true`. The API accepts any other value, including the string `"true"`, without an error, and then returns the personal data as usual.

## When to exclude PII

Exclude PII when your system acts on the journey result, but doesn't need GBG Go to send back the customer's details. For example:

* Your backend reads only the result and the module outcomes to decide whether to approve the customer.
* You already hold the customer's details, because your own interface collected them.
* You want to reduce the personal data that reaches logs, queues or other systems that store the state response.

Don't exclude PII if your system reads customer data from the state response. For example, to show the verified address, or to read extracted document data from a step result.

## Before you begin

Make sure you have:

* **Published API journey**: A journey published with API delivery. You need its resource ID and version.
* **Access token**: Obtained in [Step 1: Authenticate](https://docs.go.gbgplc.com/docs/go-v2/developer-integration/execute-customer-journeys/authenticate.md).

## Start a journey without PII in the state

To exclude PII, set `excludePii` to `true` in `context.config` when you start the journey.

```bash cURL theme={null}
curl --request POST \
  --url https://eu.platform.go.gbgplc.com/v2/captain/journey/start \
  --header 'Authorization: Bearer your_access_token' \
  --header 'Content-Type: application/json' \
  --data '{
    "resourceId": "f3d875bc2ebff66f557fb177646f4c80e453d8d064b92a53fd1079edded1ea91@2lhovl4z",
    "context": {
      "config": {
        "delivery": "api",
        "excludePii": true
      },
      "subject": {
        "identity": {
          "currentAddress": {
            "lines": ["12 Wellington Place"],
            "locality": "Leeds",
            "postalCode": "LS1 4AP",
            "country": "GB"
          },
          "emails": [
            { "type": "personal", "email": "jane.doe@example.com" }
          ]
        }
      }
    }
  }'
```

```javascript Node.js theme={null}
const response = await fetch('https://eu.platform.go.gbgplc.com/v2/captain/journey/start', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${accessToken}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    resourceId: process.env.JOURNEY_RESOURCE_ID,
    context: {
      config: { delivery: 'api', excludePii: true },
      subject
    }
  })
});

const { instanceId } = await response.json();
```

```python Python theme={null}
import os
import requests

response = requests.post(
    'https://eu.platform.go.gbgplc.com/v2/captain/journey/start',
    headers={
        'Authorization': f'Bearer {access_token}',
        'Content-Type': 'application/json'
    },
    json={
        'resourceId': os.environ['JOURNEY_RESOURCE_ID'],
        'context': {
            'config': {'delivery': 'api', 'excludePii': True},
            'subject': subject
        }
    }
)

instance_id = response.json()['instanceId']
```

The start response is the same as for any other journey. Keep the `instanceId` for the calls that follow.

```json JSON theme={null}
{
  "instanceId": "Pq_hhIX6-sHUy9FLSDzPLu",
  "status": "started",
  "message": "Journey Pq_hhIX6-sHUy9FLSDzPLu started successfully"
}
```

### Request body fields

This field controls PII exclusion. For the other start request fields, see [Step 2: Start a journey](https://docs.go.gbgplc.com/docs/go-v2/developer-integration/execute-customer-journeys/start-a-journey-step.md).

| Field | Required | Description |
| - | - | - |
| `context.config.excludePii` | No | Set to `true` to leave personal data out of the journey state response. If you omit it, or set it to any value other than the boolean `true`, then the response includes personal data. |

## What the state response leaves out

When you [fetch the journey state](https://docs.go.gbgplc.com/docs/go-v2/developer-integration/execute-customer-journeys/fetch-journey-state-step.md) of a journey started with `excludePii`, the response leaves out these fields entirely. They aren't returned as empty objects.

| Field | What it contains by default |
| - | - |
| `context.subject` | The customer's data, such as their name, address, emails and phone numbers. This includes data that the customer submitted through interactions. |
| `context.process.steps[].subject`, `context.process.steps[].result.subject` and `context.result.subject` | The data that a module returns about the customer. For example, the address that an address verification module matched, split into its parts. |
| `context.process.steps[].result.documents` and `context.result.documents` | The identity document data that a module extracted. |
| `context.process.steps[].result.note` and `context.result.note` | Free-form notes. These can contain names and reference numbers. |

`excludePii` also removes `subjectSources`, `subjects`, `results` and `result.raw` at the same levels. The response leaves these fields out even without `excludePii`.

The response still includes:

* The journey `status` and `context.result`, apart from the fields in the table.
* Each step's `outcome`, `advice` and `process` details.
* The journey details in `context.process.journey`.

> [!WARNING]
>
> `excludePii` removes only the fields in the table. Personal data inside the fields that the response keeps can still appear. For example, `result.error` can contain provider text with names and dates of birth, and `result.advice` or module-specific result fields can contain nested personal data.
>
> Don't treat the response as free of personal data. Apply your own controls before you log or store it.

A [synchronous start](https://docs.go.gbgplc.com/docs/go-v2/tutorials/run-journeys-synchronously.md) response leaves the same fields out of its `state`. `excludePii` works the same way for journeys with `page` delivery.

> [!NOTE]
>
> `excludePii` changes only what the API returns. The journey's modules still receive the customer's data, and they return the same outcomes and advice as they would without it.

### Example responses

Both of these responses are from the same journey, started with the same address and email. The journey has run an address verification module, and it's waiting for the customer to submit more data.

```json With excludePii expandable theme={null}
{
  "view": "full",
  "instanceId": "Pq_hhIX6-sHUy9FLSDzPLu",
  "status": "InProgress",
  "context": {
    "process": {
      "journey": {
        "id": "f3d875bc2ebff66f557fb177646f4c80e453d8d064b92a53fd1079edded1ea91",
        "version": "2lhovl4z",
        "name": "UK retail account opening",
        "startedAt": "2026-11-04T09:09:11.586Z"
      },
      "instance": {
        "id": "Pq_hhIX6-sHUy9FLSDzPLu",
        "instanceId": "Pq_hhIX6-sHUy9FLSDzPLu"
      },
      "steps": [
        {
          "nodeId": "mtv8y17k8t1mfn8x45k",
          "name": "Address Verification",
          "result": {
            "status": "complete",
            "outcome": "Partially Verified",
            "advice": {
              "addressVerified": true,
              "postalCodeVerified": true,
              "countryRecognized": true,
              "multipleMatches": false,
              "verificationLevel": "PREMISE",
              "matchScore": 88,
              "gbgAddressQualityLevel": "2",
              "geocoded": false,
              "serviceError": false
            }
          },
          "process": {
            "step": {
              "moduleId": "AddressVerification",
              "moduleName": "Address Verification",
              "variantId": "GlobalAddressVerify",
              "variantName": "Global",
              "startedAt": "2026-11-04T09:09:12.617Z",
              "endedAt": "2026-11-04T09:09:13.294Z",
              "durationMilliSec": 677
            }
          }
        }
      ]
    },
    "result": {
      "status": "inprogress"
    }
  },
  "result": {
    "status": "inprogress"
  }
}
```

```json Without excludePii expandable theme={null}
{
  "view": "full",
  "instanceId": "Pq_hhIX6-sHUy9FLSDzPLu",
  "status": "InProgress",
  "context": {
    "process": {
      "journey": {
        "id": "f3d875bc2ebff66f557fb177646f4c80e453d8d064b92a53fd1079edded1ea91",
        "version": "2lhovl4z",
        "name": "UK retail account opening",
        "startedAt": "2026-11-04T09:08:12.325Z"
      },
      "instance": {
        "id": "Pq_hhIX6-sHUy9FLSDzPLu",
        "instanceId": "Pq_hhIX6-sHUy9FLSDzPLu"
      },
      "steps": [
        {
          "nodeId": "mtv8y17k8t1mfn8x45k",
          "name": "Address Verification",
          "result": {
            "status": "complete",
            "outcome": "Partially Verified",
            "advice": {
              "addressVerified": true,
              "postalCodeVerified": true,
              "countryRecognized": true,
              "multipleMatches": false,
              "verificationLevel": "PREMISE",
              "matchScore": 88,
              "gbgAddressQualityLevel": "2",
              "geocoded": false,
              "serviceError": false
            },
            "subject": {
              "identity": {
                "currentAddress": {
                  "addressString": "12 Wellington Place, Leeds, LS1 4AP",
                  "lines": ["12 Wellington Place", "Leeds", "LS1 4AP"],
                  "premise": "12",
                  "thoroughfare": "Wellington Place",
                  "locality": "Leeds",
                  "administrativeArea": "West Yorkshire",
                  "postalCode": "LS1 4AP",
                  "country": "GBR"
                }
              }
            }
          },
          "process": {
            "step": {
              "moduleId": "AddressVerification",
              "moduleName": "Address Verification",
              "variantId": "GlobalAddressVerify",
              "variantName": "Global",
              "startedAt": "2026-11-04T09:08:13.804Z",
              "endedAt": "2026-11-04T09:08:14.476Z",
              "durationMilliSec": 672
            }
          }
        }
      ]
    },
    "subject": {
      "identity": {
        "currentAddress": {
          "lines": ["12 Wellington Place"],
          "locality": "Leeds",
          "postalCode": "LS1 4AP",
          "country": "GB"
        },
        "emails": [
          { "type": "personal", "email": "jane.doe@example.com" }
        ]
      },
      "uid": ""
    },
    "result": {
      "status": "inprogress"
    }
  },
  "result": {
    "status": "inprogress"
  }
}
```

For a description of each field, see [Step 5: Fetch journey state](https://docs.go.gbgplc.com/docs/go-v2/developer-integration/execute-customer-journeys/fetch-journey-state-step.md#response-fields).

## Handle a response without PII

With `excludePii`, the fields in the table are missing from the response, not empty. Read them as optional, so that your code doesn't fail when they aren't there.

```javascript Node.js theme={null}
const state = await response.json();

// Present only when the journey wasn't started with excludePii.
const identity = state.context.subject?.identity;

const outcomes = state.context.process.steps.map((step) => ({
  module: step.name,
  outcome: step.result?.outcome,
  advice: step.result?.advice
}));
```

```python Python theme={null}
state = response.json()

# Present only when the journey wasn't started with excludePii.
identity = state['context'].get('subject', {}).get('identity')

outcomes = [
    {
        'module': step.get('name'),
        'outcome': step.get('result', {}).get('outcome'),
        'advice': step.get('result', {}).get('advice'),
    }
    for step in state['context']['process']['steps']
]
```

## Best practices

* Check that your code sends `excludePii` as a boolean. A string value such as `"true"` doesn't exclude PII, and the API doesn't return an error.
* After you turn on `excludePii`, fetch the state of a test journey and check that `context.subject` isn't in the response.
* If you need the customer's details after the journey, then use the copy that your own system collected.