Note-to-us: Whoever lands first, either this or my PII removal branch is going to need `API_WHITELIST` here.