Current APIs expect a specific string to be exactly the format that the API is for (eg. the email function expects to receive exactly one email address).
We should have an API to which we can pass a big string, detect if any PII exist somewhere in it, and mask all of them.