the API key, that should be kept secret if you created one

you can look at the SDK end point to see what its returning

it will contain the flags, and any rules and targeting conditions

this usually is safe and has no PII - but you can taget to a list of emails, or other PII and that may be exposed. We recommend not doing that or using hashed attributes in those cases