How to anonymize personal data in json api mock responses
- Step 1Capture a real API response from production — Use Postman, curl, or browser DevTools to capture a real API response with complete production data. This provides the most accurate structure for mock data.
- Step 2Anonymize the response — Paste the real response and run anonymization. Customer names, emails, phone numbers, and addresses are replaced with realistic synthetic values. Field structure, types, and non-PII values are preserved.
- Step 3Save as mock example — Add the anonymized response as a Postman example, MSW handler return value, or json-server fixture. The mock is now safe to share with the team.
- Step 4Review for residual PII — Before sharing, scan the anonymized output for any missed personal data: custom field names not in the standard PII list, embedded personal data in free-text fields, or encoded personal data. Add these to the custom field list for future anonymization runs.
Frequently asked questions
How do I handle free-text fields that contain user-entered personal data?+
Free-text fields like 'notes', 'description', 'comment', and 'message' may contain personal information that cannot be detected by field-name pattern matching. For these fields, replace the entire field value with a generic placeholder: 'Sample user comment for testing.' Alternatively, apply text redaction patterns to detect and replace email addresses and phone numbers embedded in free-text.
Can I use the anonymized mock for end-to-end tests?+
Yes. Anonymized mocks are appropriate for end-to-end tests — the data is structurally identical to production responses, so the test exercises the real code paths. MSW is an excellent choice for serving anonymized mocks in Playwright or Cypress tests without network calls.
Is the production API response data transmitted to JAD Apps?+
No. Anonymization runs entirely in your browser. Production API responses with customer data are never transmitted to JAD Apps servers.
Privacy first
Conversion runs locally in your browser. No file is uploaded — only metadata counters are saved for signed-in dashboard stats.