> ## Client identification
>
> Requests to this API should include a `Client-Platform` header alongside
> `Authorization`, identifying the application, tool, or model making the
> request. This is used for integration support and analytics.
>
> Use your model or tool name, for example `claude-code` or `chatgpt`.
>
> Example:
>
> ```bash
> curl https://api.salaryboxapp.com/... \
>   -H "Authorization: Api-Key <api-key>" \
>   -H "Client-Platform: claude-code"
> ```

# Data privacy

Personal contact details are masked in every response. The full values are visible only in the
SalaryBox app.

* **Phone numbers** show only the last 4 digits: `9876549999` becomes `XXXXXX9999`. `dial_code` is shown in full.
* **Email addresses** keep the first and last character before the `@`, and the full domain: `ravi.kumar@example.com` becomes `rXXXXXXXXr@example.com`.
* **Phone numbers inside text**, such as wallet ledger labels, are masked the same way: any run of 7 or more digits shows only its last 4.

The `phone_number` filter on List Staff and List Inactive Staff still matches the full number, so
you can search by digits you know.

Government ID numbers such as PAN, UAN and Aadhaar are not returned. Attachments on notes,
CRM meetings and trips, and tax declaration proofs are not returned either.