Cleaning sensitive information returned from a REST API I am working with an API of coupons from sites like Groupon. There are 2 fields in the JSON response (url and imgUrl) that return a url which directs them to the actual coupon and a picture of the business, respectively. Problem is that they contain sensitive information (my API KEY).
Below is my service (using spring boot) which &quot;cleans&quot; the API key from the urls before servicing them to the client:
@Service
public class SanitationService {

public List&lt;Deal&gt; cleanApiKeys(List&lt;Deal&gt; deals) {
    List&lt;Deal&gt; cleanList = new ArrayList&lt;&gt;();
    deals.forEach(item -&gt; {
        //Catching &quot;dirty&quot; URLs containing API keys
        List&lt;String&gt; dirtyUrls = Arrays.asList(item.getUrl(), item.getImageUrl()); //maybe map?
        List&lt;String&gt; cleanUrls = cleanUrls(dirtyUrls);
        cleanList.add(cleanDeal(item ,cleanUrls));
    });
    return cleanList;
}
public Deal cleanDeal(Deal deal, List&lt;String&gt; cleanUrls) {
    deal.setUrl(cleanUrls.get(0));
    deal.setImageUrl(cleanUrls.get(1));
    return deal;
}
public List&lt;String&gt; cleanUrls(List&lt;String&gt; urls) {
    return urls.stream()
            .map(url -&gt; url =  url.split(&quot;\\?&quot;)[0])
            .collect(Collectors.toList());
}
//Helper method for other services to extract a list of Deal from the DealWrapper JSON
public List&lt;Deal&gt; dealUnwrap(List&lt;DealWrapper&gt; dealWrappers) {
    return dealWrappers.stream()
            .map(DealWrapper::getDeal)
            .collect(Collectors.toList());
}

}
Here is the code I use to test the service (still figuring out how to mock a list of Deal)
@SpringBootTest
class SanitationServiceTest {
@Autowired
private SanitationService service;

@Test
void cleanUrls() {
    List&lt;String&gt; dirtyUrls = Arrays.asList(&quot;https://api.discountapi.com/v2/deals/1988753/click?api_key=secret&quot;,
            &quot;https://api.discountapi.com/v2/deals/1988753/click?api_key=secret&quot;);
    assertTrue(service.cleanUrls(dirtyUrls).stream()
                .noneMatch(url -&gt; url.contains(&quot;api_key&quot;)));
}

}
What is the quality of my code? Is my testing headed in a good direction? Is my code readable and concise?
The solution is clear but seems too complicated for just sanitizing two URLs. Few suggestions:

The test only covers the method cleanUrls and only the expected case. There should be at least one test for each public method with the expected input, plus other tests for edge cases.
Limit the interface of SanitationService by setting internal methods to private. For example cleanDeal.
The name cleanUrls is too general. The result is removing the query parameters from the URLs so a better name might be stripUrlsParams.

My suggestion is to simplify cleanApiKeys like this:
public List&lt;Deal&gt; cleanApiKeys(List&lt;Deal&gt; deals) {
    deals.stream().forEach(deal -&gt; {
        deal.stripUrlsParams();
    });
    return deals;
}

The class Deal will &quot;deal&quot; with its URLs:
public class Deal{
    //...
    public void stripUrlsParams() {
        this.url = this.url == null ? null : url.split(&quot;\\?&quot;)[0];
        this.imageUrl = this.imageUrl == null ? null : imageUrl.split(&quot;\\?&quot;)[0];
    }
}

If for some reason you can't change Deal then add a private method in SanitationService.