Data Layer

The Org Data Layer is a tenant-wide configuration that applies to all events before per-integration Pipeline Transformations run. It defines PII handling rules, bot filtering, session settings, custom JavaScript enrichments, and event routing rules.

Data Layer Object

{
  "org_id": "org_xyz789",
  "config": {
    "pii_rules": {
      "enabled": true,
      "hash_fields": ["traits.email", "traits.phone"],
      "redact_fields": ["traits.ssn", "properties.credit_card"],
      "hash_algorithm": "sha256"
    },
    "bot_filtering": {
      "enabled": true,
      "block_known_bots": true,
      "block_empty_user_agent": true,
      "custom_patterns": [
        "internal-monitor/*",
        "health-check/*"
      ]
    },
    "session": {
      "timeout_minutes": 30,
      "max_duration_hours": 24,
      "track_session_start": true,
      "track_session_end": true
    },
    "custom_js": {
      "enabled": false,
      "code": "",
      "description": ""
    },
    "routing_rules": [
      {
        "condition": "event == 'Internal Test'",
        "action": "drop"
      },
      {
        "condition": "context.page.url contains '/staging'",
        "action": "drop"
      },
      {
        "condition": "properties.environment == 'production'",
        "action": "pass"
      }
    ]
  },
  "updated_at": "2026-02-20T14:00:00Z",
  "updated_by": "usr_abc123"
}

Configuration Sections

PII Rules

Controls how personally identifiable information is handled before events reach any integration.

Field	Type	Default	Description
`enabled`	boolean	`true`	Whether PII processing is active
`hash_fields`	string[]	`[]`	Field paths to hash with the configured algorithm
`redact_fields`	string[]	`[]`	Field paths to remove entirely from events
`hash_algorithm`	string	`"sha256"`	Hashing algorithm (`sha256`)

When a field is listed in hash_fields, its value is replaced with a SHA-256 hash before the event is delivered to any vendor. This allows vendors like Meta and Google to perform identity matching without receiving raw PII.

When a field is listed in redact_fields, it is completely removed from the event payload before delivery.

PII rules are applied at the Org Data Layer level, meaning they affect all integrations. If you need different PII handling per vendor, use per-integration Transformations with delete rules.

Bot Filtering

Filters out non-human traffic before events enter the processing pipeline.

Field	Type	Default	Description
`enabled`	boolean	`true`	Whether bot filtering is active
`block_known_bots`	boolean	`true`	Block traffic from known bot user agents (IAB list)
`block_empty_user_agent`	boolean	`true`	Block requests with missing or empty user agent
`custom_patterns`	string[]	`[]`	Additional user agent patterns to block (glob syntax)

Session Settings

Controls session tracking behaviour across all sources.

Field	Type	Default	Description
`timeout_minutes`	integer	`30`	Inactivity timeout before a new session starts
`max_duration_hours`	integer	`24`	Maximum session duration regardless of activity
`track_session_start`	boolean	`true`	Emit a `Session Started` event
`track_session_end`	boolean	`true`	Emit a `Session Ended` event

Custom JavaScript

Allows injecting custom enrichment logic that runs on every event at the Org Data Layer stage.

Field	Type	Default	Description
`enabled`	boolean	`false`	Whether custom JS enrichment is active
`code`	string	`""`	JavaScript code executed in a sandboxed V8 isolate
`description`	string	`""`	Human-readable description of what the code does

⚠️

Custom JavaScript runs in a sandboxed environment with no network access and a 50ms execution timeout. It receives the event object and must return the modified event. Errors are logged but do not block event processing.

Routing Rules

Routing rules evaluate conditions against events and determine whether they should continue through the pipeline or be dropped.

Field	Type	Description
`condition`	string	Expression evaluated against the event
`action`	string	`"pass"` to allow or `"drop"` to discard the event

Rules are evaluated in order. The first matching rule determines the outcome. If no rule matches, the event passes through by default.

Get Data Layer

`GET /v1/admin/data-layer`

Retrieve the current Org Data Layer configuration.

Request:

curl -X GET http://localhost:8084/v1/admin/data-layer \
  -H "Authorization: Bearer {access_token}"

Response: Full data layer object as shown above.

Required role: viewer or above.

Update Data Layer

`PUT /v1/admin/data-layer`

Update the Org Data Layer configuration. The entire config object is replaced.

Request:

{
  "config": {
    "pii_rules": {
      "enabled": true,
      "hash_fields": ["traits.email", "traits.phone", "traits.first_name", "traits.last_name"],
      "redact_fields": ["traits.ssn"],
      "hash_algorithm": "sha256"
    },
    "bot_filtering": {
      "enabled": true,
      "block_known_bots": true,
      "block_empty_user_agent": true,
      "custom_patterns": []
    },
    "session": {
      "timeout_minutes": 30,
      "max_duration_hours": 24,
      "track_session_start": true,
      "track_session_end": true
    },
    "custom_js": {
      "enabled": false,
      "code": "",
      "description": ""
    },
    "routing_rules": []
  }
}

Response: Updated data layer object.

Required role: admin or above.

⚠️

Changes to the Org Data Layer take effect immediately for all events across all sources in the organisation. Test changes carefully using the Transformations dry-run endpoint before applying them to production.

Transformations Users & RBAC