# POST /sensitive-fields/reveal

**Resource:** [Sensitive Fields](./sensitive-fields.md)  
**MCP tool:** `reveal_sensitive_field`  
**Scopes:** `sensitive-fields:read`  
**Write operation:** no

Read the real value of a field marked Sensitive, such as a tax file number. Everywhere else (get_contact, list and search results, exports, merge fields, automations, form submissions) a Sensitive field only ever returns its masked copy, e.g. "••••••782". Every call is logged with who asked and when. Requires the sensitive-fields:read permission ticked explicitly on the key: full (admin) access does not include it, and AI connectors never get it by default. Only call this when the person you are helping genuinely needs the number.

## Parameters

| Name | In | Type | Required | Description |
|------|----|------|----------|-------------|
| `record_type` | body | string | yes | What the value belongs to: "contact", "opportunity" or "account" for a custom field, or "form_submission" for a form answer. |
| `record_id` | body | string | yes | The contact, opportunity, account or form submission id. |
| `field` | body | string | yes | For a custom field, its id (the metadata key, e.g. "tax_file_number"). For a form answer, the form field id. |

## Request example

```bash
curl -X POST   "https://api.trustpager.com/functions/v1/api/v1/sensitive-fields/reveal"   -H "Authorization: Bearer YOUR_API_KEY"   -H "Content-Type: application/json"   -d '{"record_type":"...","record_id":"...","field":"..."}'
```

---
Base URL: `https://api.trustpager.com/functions/v1/api/v1` — Auth: `Authorization: Bearer YOUR_API_KEY`