# Finance Sanitizer Mapping

Phase 5B keeps Finance integration allowlist-first. Unknown input fields are ignored. Sensitive fields are rejected by tests and never copied into `ModuleSnapshot`.

## Input endpoint mapping

### `/api/health`

- Used: status-like health signal
- Output: contributes to `SourceHealth.reachable` and safe `last_success_at` fallback
- Dropped: app labels, versions, raw mode strings unless needed for safe reachability

### `/api/provider/status`

- Real shape: list of provider status objects
- Used: status-like flags only (`ok`, `connected`, `ready`, `healthy`, `degraded`, `offline`, `error`, `unknown`)
- Output: `provider_connected` KPI as `Ja`, `Nein`, or `Unbekannt`
- Dropped: provider names, messages, any unknown values

### `/api/runtime/status`

- Used: boolean reachability/status flags only
- Output: `runtime_reachable` KPI and `SourceHealth.reachable`
- Dropped: database path, runtime path, local path, currency, raw write-mode details

### `/api/system/status`

- Used: availability context only
- Output: no direct field pass-through
- Dropped: URLs, process/runtime detail, nested metadata

### `/api/budget/import-status-audit`

- Real shape: nested audit object
- Used: safe count derived from `review_needed` keys and known count-like review fields
- Output: `review_items` KPI and `Review nötig` attention item
- Dropped: source names, account/category/transaction/candidate structures, file/import details, any unknown nested fields

## Output allowlist

The Finance `ModuleSnapshot` may contain only:

- `module_id=finance`
- `title=FinanceManager`
- `status`
- `sensitivity=sensitive`
- `display_policy=summary`
- safe timestamps
- safe `SourceHealth`
- max three KPIs
- read-only/link-only actions
- safe attention items

## Forbidden output classes

Never output:

- exact amounts or amount-like keys
- account names or account identifiers
- transactions or transaction text
- portfolio values
- budget sums/category amounts
- CSV/XLSX/PDF paths
- DB/runtime/local paths
- Drive URLs
- secrets/tokens/passwords/API keys
- raw error traces

## Error redaction

Live adapter exceptions are converted to offline/degraded snapshots. Error strings are passed through server-side redaction and path fragments are collapsed before entering `SourceHealth.last_error_redacted`.