> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developer.fortresstech.io/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.fortresstech.io/_mcp/server.

# Sensitive values

[`GET /sensitive/applications/{applicationId}`](/api-reference/sensitive/get-application-sensitive-values)
returns the full values document validation needs: Social Security, passport and alien registration numbers
for every person on the application, and institution and account number for every bank account
`GET /assets` returns. [`GET /applications/{applicationId}/full`](/api-reference/applications/get-application-full)
returns the same values (and the SSA claim numbers) inline with `sensitive: read`, encrypted the same way. Other
routes return the last 4 characters at most.

## Encryption

Each value is a Base64 string, encrypted with the secret Fortress gives you:

* AES-256-GCM
* key: SHA-256 of the secret (32 bytes)
* a random 16-byte IV per value, so the same value never encrypts the same way twice
* Base64 of `[IV 16 bytes][AuthTag 16 bytes][ciphertext]`

Decrypt in Node.js:

```javascript
const crypto = require("crypto");

function decryptValue(encrypted, secret) {
  const data = Buffer.from(encrypted, "base64");
  const key = crypto.createHash("sha256").update(secret).digest();
  const decipher = crypto.createDecipheriv("aes-256-gcm", key, data.subarray(0, 16));
  decipher.setAuthTag(data.subarray(16, 32));
  return Buffer.concat([decipher.update(data.subarray(32)), decipher.final()]).toString("utf8");
}
```

`decipher.final()` throws when the secret is wrong or the value was changed: treat that as a failure, never
as an empty value.

## `null`

A value is `null` when Fortress has no usable value for it. Ask the applicant or a Fortress reviewer for it
as you would for a missing value. Minors never have a passport number.

## Access

* Your API key must be enabled for sensitive values, and Fortress must have given you your secret. Until
  both are done `/sensitive` answers `403`. On `/full`, a key granted `sensitive: read` that names no partner
  gets `200` with the sensitive fields absent; a partner with no secret gets `403 SENSITIVE_DATA_NOT_ENABLED`.
* The response is never cached (`Cache-Control: no-store`). Do not store decrypted values longer than the
  validation needs, and never log them.
* When your secret changes, Fortress tells you the cut-over time in advance. Values read after it decrypt
  only with the new secret; re-read any value that fails to decrypt around the cut-over.