# the ansible builtin uri module returns header authorization data as is in the response invocation. how to redact?

**URL:** <https://forum.ansible.com/t/the-ansible-builtin-uri-module-returns-header-authorization-data-as-is-in-the-response-invocation-how-to-redact/44569>\
**Category:** Get Help\
**Tags:** uri\
**Created:** [September 27, 2025, 9:58am UTC](https://forum.ansible.com/t/the-ansible-builtin-uri-module-returns-header-authorization-data-as-is-in-the-response-invocation-how-to-redact/44569 "2025-09-27T09:58:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Max\_Grand](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/max_grand/32/8247_2.png) [@Max\_Grand](https://forum.ansible.com/u/Max_Grand)\
**Post date:** [September 27, 2025, 9:58am UTC](https://forum.ansible.com/t/the-ansible-builtin-uri-module-returns-header-authorization-data-as-is-in-the-response-invocation-how-to-redact/44569/1 "2025-09-27T09:58:22Z")

</div>

When the ansible builtin uri module is given custom header with Authorization data, the REST API GET works and responds. But in the response date invocation object it shows the Authorization header that was provided as is without any masking or redact.  
Is there some configuration I can use before submitting the uri request ?

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [September 29, 2025, 12:45pm UTC](https://forum.ansible.com/t/the-ansible-builtin-uri-module-returns-header-authorization-data-as-is-in-the-response-invocation-how-to-redact/44569/2 "2025-09-29T12:45:38Z")

</div>

The invocation is a general part of debug output for tasks, and won’t be displayed if you use less verbosity than `-vvv`. The `no_log` keyword can also be used more generally to hide task details.

---

<div class="post-metadata">

**Author:** ![Max\_Grand](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/max_grand/32/8247_2.png) [@Max\_Grand](https://forum.ansible.com/u/Max_Grand)\
**Post date:** [September 30, 2025, 3:08pm UTC](https://forum.ansible.com/t/the-ansible-builtin-uri-module-returns-header-authorization-data-as-is-in-the-response-invocation-how-to-redact/44569/3 "2025-09-30T15:08:03Z")

</div>

I did not change the default verbosity 0 or -v, and I still notice the header and Authorization content in the response.  
otoh - no-log is an option; but it would be nice to see what happened with uri module particularly when API calls fail

---

<div class="post-metadata">

**Author:** ![shertel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/shertel/32/1241_2.png) [@shertel](https://forum.ansible.com/u/shertel)\
**Post date:** [October 1, 2025, 3:47pm UTC](https://forum.ansible.com/t/the-ansible-builtin-uri-module-returns-header-authorization-data-as-is-in-the-response-invocation-how-to-redact/44569/4 "2025-10-01T15:47:07Z")

</div>

If it’s not in the invocation, add Authorization to [unredirected\_headers](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/uri_module.html#parameter-unredirected_headers). The invocation is deleted based on verbosity [ansible/lib/ansible/plugins/callback/\_\_init\_\_.py at devel · ansible/ansible · GitHub](https://github.com/ansible/ansible/blob/devel/lib/ansible/plugins/callback/ __init__.py#L305-L307), so setting that option won’t prevent it from still showing up when using a lot of verbosity.