The
hidden value is available only to a Trusted public client. Other callers can omit visibility or use its default value, visible. API keys, standard OAuth clients, legacy clients, and Trusted team clients cannot send or read hidden application text.Send hidden text
Setvisibility: "hidden" on individual text parts in task.create or task.sendMessage:
visibility defaults to visible, and plain string content remains visible. Every message must contain at least one non-empty visible text part or valid visible file or voice part. Hidden file and voice parts are not supported. Hidden text counts toward the message token limit.
The API returns InvalidArgument (HTTP 400) for all-hidden messages, unsupported visibility values, whitespace-only visible text, or hidden file and voice parts. A caller that is not a Trusted public client receives PermissionDenied (HTTP 403) when it attempts to send hidden text.
Read hidden text
Use a Bearer token from the same Trusted public client and setverbose=true on task.listMessages. Existing task access restrictions still apply.
user_message.content. Hidden text is returned separately in user_message.hidden_content:
hidden_content preserves the order among hidden text parts. It does not encode each hidden part’s position relative to visible text. Other callers and non-verbose requests omit the field.