---
title: "Sanitize JQL queries"
method: POST
path: "/rest/api/2/jql/sanitize"
tags: ["JQL"]
---

# Sanitize JQL queries

`POST /rest/api/2/jql/sanitize`

Sanitizes one or more JQL queries by converting readable details into IDs where a user doesn't have permission to view the entity.

For example, if the query contains the clause *project = 'Secret project'*, and a user does not have browse permission for the project "Secret project", the sanitized query replaces the clause with *project = 12345"* (where 12345 is the ID of the project). If a user has the required permission, the clause is not sanitized. If the account ID is null, sanitizing is performed for an anonymous user.

Note that sanitization doesn't make the queries GDPR-compliant, because it doesn't remove user identifiers (username or user key). If you need to make queries GDPR-compliant, use [Convert user identifiers to account IDs in JQL queries](https://developer.atlassian.com/cloud/jira/platform/rest/v3/api-group-jql/#api-rest-api-3-jql-sanitize-post).

Before sanitization each JQL query is parsed. The queries are returned in the same order that they were passed.

**[Permissions](#permissions) required:** *Administer Jira* [global permission](https://confluence.atlassian.com/x/x4dKLg).

## Request body

- JqlQueriesToSanitize — The list of JQL queries to sanitize for the given account IDs.
  - `queries` JqlQueryToSanitize[], required — The list of JQL queries to sanitize. Must contain unique values. Maximum of 20 queries.
    - `accountId` string, nullable — The account ID of the user, which uniquely identifies the user across all Atlassian products. For example, *5b10ac8d82e05b22cc7d4ef5*.
    - `query` string, required — The query to sanitize.

## Response `200`

Returned if the request is successful.

- SanitizedJqlQueries — The sanitized JQL queries for the given account IDs.
  - `queries` SanitizedJqlQuery[] — The list of sanitized JQL queries.
    - `accountId` string, nullable — The account ID of the user for whom sanitization was performed.
    - `errors` ErrorCollection — Error messages from an operation.
      - `errorMessages` string[] — The list of error messages produced by this operation. For example, "input parameter 'key' must be provided"
      - `errors` object — The list of errors by parameter returned by the operation. For example,"projectKey": "Project keys must start with an uppercase letter, followed by one or more uppercase alphanumeric characters."
      - `status` integer
    - `initialQuery` string — The initial query.
    - `sanitizedQuery` string, nullable — The sanitized query, if there were no errors.

## Other responses

- `400` — Returned if the request is invalid.
- `401` — Returned if the authentication credentials are incorrect or missing.
- `403` — Returned if the user does not have the necessary permission.

---

[API](https://skmtc.net/atlassian/apis/the-jira-cloud-platform-rest-api.md) · [All operations](https://skmtc.net/atlassian/apis/the-jira-cloud-platform-rest-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/atlassian/the-jira-cloud-platform-rest-api/versions/a26541c2f8bd/schema)