Blame - docs/dyn/dlp_v2.projects.content.html - platform/external/python/google-api-python-client

2020-05-01 07:42:23 -0700

[diff] [blame]

78

<code><a href="#deidentify">deidentify(parent, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

79

<p class="firstline">De-identifies potentially sensitive info from a ContentItem.</p>

80

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

81

<code><a href="#inspect">inspect(parent, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

82

<p class="firstline">Finds potentially sensitive info in content.</p>

83

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

84

<code><a href="#reidentify">reidentify(parent, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

85

<p class="firstline">Re-identifies content that has been de-identified.</p>

86

<h3>Method Details</h3>

87

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

88

<code class="details" id="deidentify">deidentify(parent, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

89

<pre>De-identifies potentially sensitive info from a ContentItem.

90

This method has limits on input size and output size.

91

See https://cloud.google.com/dlp/docs/deidentify-sensitive-data to

92

learn more.

93

94

When no InfoTypes or CustomInfoTypes are specified in this request, the

95

system will automatically choose what detectors to run. By default this may

96

be all types, but may change over time as detectors are updated.

97

98

Args:

99

parent: string, The parent resource name, for example projects/my-project-id. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

100

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

101

The object takes the form of:

102

103

{ # Request to de-identify a list of items.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

104

"item": { # Container structure for the content to inspect. # The item to de-identify. Will be treated as text.

105

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

106

"data": "A String", # Content data to inspect or redact.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

107

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

108

},

109

"value": "A String", # String data to inspect or redact.

110

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

111

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

112

# learn more.

113

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

114

# learn more.

115

"rows": [ # Rows of the table.

116

{ # Values of the row.

117

"values": [ # Individual cells.

118

{ # Set of primitive values supported by the system.

119

# Note that for the purposes of inspection or transformation, the number

120

# of bytes considered to comprise a 'Value' is based on its representation

121

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

122

# 123456789, the number of bytes would be counted as 9, even though an

123

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

124

"timestampValue": "A String", # timestamp

125

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

126

# and time zone are either specified elsewhere or are not significant. The date

127

# is relative to the Proleptic Gregorian Calendar. This can represent:

128

#

129

# * A full date, with non-zero year, month and day values

130

# * A month and day value, with a zero year, e.g. an anniversary

131

# * A year on its own, with zero month and day values

132

# * A year and month value, with a zero day, e.g. a credit card expiration date

133

#

134

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

135

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

136

# a year.

137

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

138

# month and day.

139

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

140

# if specifying a year by itself or a year and month where the day is not

141

# significant.

142

},

143

"stringValue": "A String", # string

144

"integerValue": "A String", # integer

145

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

146

# or are specified elsewhere. An API may choose to allow leap seconds. Related

147

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

148

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

149

# to allow the value "24:00:00" for scenarios like business closing time.

150

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

151

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

152

# allow the value 60 if it allows leap-seconds.

153

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

154

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

155

"booleanValue": True or False, # boolean

156

"floatValue": 3.14, # float

157

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

],

"headers": [ # Headers of the table.

163

{ # General identifier of a data field in a storage service.

164

"name": "A String", # Name describing the field.

},

],

},

},

"inspectTemplateName": "A String", # Template to use. Any configuration directly specified in

170

# inspect_config will override those set in the template. Singular fields

171

# that are set in this request will replace their corresponding fields in the

172

# template. Repeated fields are appended. Singular sub-messages and groups

173

# are recursively merged.

174

"deidentifyTemplateName": "A String", # Template to use. Any configuration directly specified in

175

# deidentify_config will override those set in the template. Singular fields

176

# that are set in this request will replace their corresponding fields in the

177

# template. Repeated fields are appended. Singular sub-messages and groups

178

# are recursively merged.

179

"inspectConfig": { # Configuration description of the scanning process. # Configuration for the inspector.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

180

# Items specified here will override the template referenced by the

181

# inspect_template_name argument.

182

# When used with redactContent only info_types and min_likelihood are currently

183

# used.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

184

"minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is

185

# POSSIBLE.

186

# See https://cloud.google.com/dlp/docs/likelihood to learn more.

187

"contentOptions": [ # List of options defining data content to scan.

188

# If empty, text, images, and other content will be included.

189

"A String",

190

],

191

"infoTypes": [ # Restricts what info_types to look for. The values must correspond to

192

# InfoType values returned by ListInfoTypes or listed at

193

# https://cloud.google.com/dlp/docs/infotypes-reference.

194

#

195

# When no InfoTypes or CustomInfoTypes are specified in a request, the

196

# system may automatically choose what detectors to run. By default this may

197

# be all types, but may change over time as detectors are updated.

198

#

199

# If you need precise control and predictability as to what detectors are

200

# run you should specify specific InfoTypes listed in the reference,

201

# otherwise a default list will be used, which may change over time.

202

{ # Type of information detected by the API.

203

"name": "A String", # Name of the information type. Either a name of your choosing when

204

# creating a CustomInfoType, or one of the names listed

205

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

206

# a built-in type. InfoType names should conform to the pattern

207

# `[a-zA-Z0-9_]{1,64}`.

208

},

209

],

210

"excludeInfoTypes": True or False, # When true, excludes type information of the findings.

211

"customInfoTypes": [ # CustomInfoTypes provided by the user. See

212

# https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

213

{ # Custom information type provided by the user. Used to find domain-specific

214

# sensitive information configurable to the data in question.

215

"surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that

216

# support reversing.

217

# such as

218

# [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).

219

# These types of transformations are

220

# those that perform pseudonymization, thereby producing a "surrogate" as

221

# output. This should be used in conjunction with a field on the

222

# transformation such as `surrogate_info_type`. This CustomInfoType does

223

# not support the use of `detection_rules`.

224

},

225

"likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be

226

# altered by a detection rule if the finding meets the criteria specified by

227

# the rule. Defaults to `VERY_LIKELY` if not specified.

228

"infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in

229

# infoType, when the name matches one of existing infoTypes and that infoType

230

# is specified in `InspectContent.info_types` field. Specifying the latter

231

# adds findings to the one detected by the system. If built-in info type is

232

# not specified in `InspectContent.info_types` list then the name is treated

233

# as a custom info type.

234

"name": "A String", # Name of the information type. Either a name of your choosing when

235

# creating a CustomInfoType, or one of the names listed

236

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

237

# a built-in type. InfoType names should conform to the pattern

238

# `[a-zA-Z0-9_]{1,64}`.

239

},

240

"regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.

241

"groupIndexes": [ # The index of the submatch to extract as findings. When not

242

# specified, the entire match is returned. No more than 3 may be included.

243

42,

244

],

245

"pattern": "A String", # Pattern defining the regular expression. Its syntax

246

# (https://github.com/google/re2/wiki/Syntax) can be found under the

247

# google/re2 repository on GitHub.

248

},

249

"detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.

250

# Rules are applied in order that they are specified. Not supported for the

251

# `surrogate_type` CustomInfoType.

252

{ # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a

253

# `CustomInfoType` to alter behavior under certain circumstances, depending

254

# on the specific details of the rule. Not supported for the `surrogate_type`

255

# custom infoType.

256

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

257

# proximity of hotwords.

258

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

259

# part of a detection rule.

260

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

261

# levels. For example, if a finding would be `POSSIBLE` without the

262

# detection rule and `relative_likelihood` is 1, then it is upgraded to

263

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

264

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

265

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

266

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

267

# a final likelihood of `LIKELY`.

268

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

269

},

270

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

271

"groupIndexes": [ # The index of the submatch to extract as findings. When not

272

# specified, the entire match is returned. No more than 3 may be included.

273

42,

274

],

275

"pattern": "A String", # Pattern defining the regular expression. Its syntax

276

# (https://github.com/google/re2/wiki/Syntax) can be found under the

277

# google/re2 repository on GitHub.

278

},

279

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

280

# The total length of the window cannot exceed 1000 characters. Note that

281

# the finding itself will be included in the window, so that hotwords may

282

# be used to match substrings of the finding itself. For example, the

283

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

284

# adjusted upwards if the area code is known to be the local area code of

285

# a company office using the hotword regex "\(xxx\)", where "xxx"

286

# is the area code in question.

287

# rule.

288

"windowBefore": 42, # Number of characters before the finding to consider.

289

"windowAfter": 42, # Number of characters after the finding to consider.

},

},

},

],

"exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding

295

# to be returned. It still can be used for rules matching.

296

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.

297

# be used to match sensitive information specific to the data, such as a list

298

# of employee IDs or job titles.

299

#

300

# Dictionary words are case-insensitive and all characters other than letters

301

# and digits in the unicode [Basic Multilingual

302

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

303

# will be replaced with whitespace when scanning for matches, so the

304

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

305

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

306

# surrounding any match must be of a different type than the adjacent

307

# characters within the word, so letters must be next to non-letters and

308

# digits next to non-digits. For example, the dictionary word "jen" will

309

# match the first three letters of the text "jen123" but will return no

310

# matches for "jennifer".

311

#

312

# Dictionary words containing a large number of characters that are not

313

# letters or digits may result in unexpected findings because such characters

314

# are treated as whitespace. The

315

# [limits](https://cloud.google.com/dlp/limits) page contains details about

316

# the size limits of dictionaries. For dictionaries that do not fit within

317

# these constraints, consider using `LargeCustomDictionaryConfig` in the

318

# `StoredInfoType` API.

319

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

320

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

321

# at least one phrase and every phrase must contain at least 2 characters

322

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

327

# is accepted.

328

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

329

# Example: gs://[BUCKET_NAME]/dictionary.txt

330

},

331

},

332

"storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in

333

# `InspectDataSource`. Not currently supported in `InspectContent`.

334

"name": "A String", # Resource name of the requested `StoredInfoType`, for example

335

# `organizations/433245324/storedInfoTypes/432452342` or

336

# `projects/project-id/storedInfoTypes/432452342`.

337

"createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for

338

# inspection was created. Output-only field, populated by the system.

339

},

340

},

341

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

342

"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is

343

# included in the response; see Finding.quote.

344

"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig.

345

# Exclusion rules, contained in the set are executed in the end, other

346

# rules are executed in the order they are specified for each info type.

347

{ # Rule set for modifying a set of infoTypes to alter behavior under certain

348

# circumstances, depending on the specific details of the rules within the set.

349

"infoTypes": [ # List of infoTypes this rule set is applied to.

350

{ # Type of information detected by the API.

351

"name": "A String", # Name of the information type. Either a name of your choosing when

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

352

# creating a CustomInfoType, or one of the names listed

353

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

354

# a built-in type. InfoType names should conform to the pattern

355

# `[a-zA-Z0-9_]{1,64}`.

356

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

357

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

358

"rules": [ # Set of rules to be applied to infoTypes. The rules are applied in order.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

359

{ # A single inspection rule to be applied to infoTypes, specified in

360

# `InspectionRuleSet`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

361

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

362

# proximity of hotwords.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

363

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

364

# part of a detection rule.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

365

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

366

# levels. For example, if a finding would be `POSSIBLE` without the

367

# detection rule and `relative_likelihood` is 1, then it is upgraded to

368

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

369

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

370

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

371

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

372

# a final likelihood of `LIKELY`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

373

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

374

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

375

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

376

"groupIndexes": [ # The index of the submatch to extract as findings. When not

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

377

# specified, the entire match is returned. No more than 3 may be included.

378

42,

379

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

380

"pattern": "A String", # Pattern defining the regular expression. Its syntax

381

# (https://github.com/google/re2/wiki/Syntax) can be found under the

382

# google/re2 repository on GitHub.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

383

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

384

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

385

# The total length of the window cannot exceed 1000 characters. Note that

386

# the finding itself will be included in the window, so that hotwords may

387

# be used to match substrings of the finding itself. For example, the

388

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

389

# adjusted upwards if the area code is known to be the local area code of

390

# a company office using the hotword regex "\(xxx\)", where "xxx"

391

# is the area code in question.

392

# rule.

393

"windowBefore": 42, # Number of characters before the finding to consider.

394

"windowAfter": 42, # Number of characters after the finding to consider.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

395

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

396

},

397

"exclusionRule": { # The rule that specifies conditions when findings of infoTypes specified in # Exclusion rule.

398

# `InspectionRuleSet` are removed from results.

399

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # Dictionary which defines the rule.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

400

# be used to match sensitive information specific to the data, such as a list

401

# of employee IDs or job titles.

402

#

403

# Dictionary words are case-insensitive and all characters other than letters

404

# and digits in the unicode [Basic Multilingual

405

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

406

# will be replaced with whitespace when scanning for matches, so the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

407

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

408

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

409

# surrounding any match must be of a different type than the adjacent

410

# characters within the word, so letters must be next to non-letters and

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

411

# digits next to non-digits. For example, the dictionary word "jen" will

412

# match the first three letters of the text "jen123" but will return no

413

# matches for "jennifer".

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

414

#

415

# Dictionary words containing a large number of characters that are not

416

# letters or digits may result in unexpected findings because such characters

417

# are treated as whitespace. The

418

# [limits](https://cloud.google.com/dlp/limits) page contains details about

419

# the size limits of dictionaries. For dictionaries that do not fit within

420

# these constraints, consider using `LargeCustomDictionaryConfig` in the

421

# `StoredInfoType` API.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

422

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

423

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

424

# at least one phrase and every phrase must contain at least 2 characters

425

# that are letters or digits. [required]

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

426

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

427

],

428

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

429

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

430

# is accepted.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

431

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

432

# Example: gs://[BUCKET_NAME]/dictionary.txt

433

},

434

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

435

"regex": { # Message defining a custom regular expression. # Regular expression which defines the rule.

436

"groupIndexes": [ # The index of the submatch to extract as findings. When not

437

# specified, the entire match is returned. No more than 3 may be included.

438

42,

439

],

440

"pattern": "A String", # Pattern defining the regular expression. Its syntax

441

# (https://github.com/google/re2/wiki/Syntax) can be found under the

442

# google/re2 repository on GitHub.

443

},

444

"excludeInfoTypes": { # List of exclude infoTypes. # Set of infoTypes for which findings would affect this rule.

445

"infoTypes": [ # InfoType list in ExclusionRule rule drops a finding when it overlaps or

446

# contained within with a finding of an infoType from this list. For

447

# example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and

448

# `exclusion_rule` containing `exclude_info_types.info_types` with

449

# "EMAIL_ADDRESS" the phone number findings are dropped if they overlap

450

# with EMAIL_ADDRESS finding.

451

# That leads to "555-222-2222@example.org" to generate only a single

452

# finding, namely email address.

453

{ # Type of information detected by the API.

454

"name": "A String", # Name of the information type. Either a name of your choosing when

455

# creating a CustomInfoType, or one of the names listed

456

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

457

# a built-in type. InfoType names should conform to the pattern

458

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

"matchingType": "A String", # How the rule is applied, see MatchingType documentation for details.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

463

},

464

},

465

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

466

},

467

],

468

"limits": { # Configuration to control the number of findings returned. # Configuration to control the number of findings returned.

469

"maxFindingsPerItem": 42, # Max number of findings that will be returned for each item scanned.

470

# When set within `InspectJobConfig`,

471

# the maximum returned is 2000 regardless if this is set higher.

472

# When set within `InspectContentRequest`, this field is ignored.

473

"maxFindingsPerInfoType": [ # Configuration of findings limit given for specified infoTypes.

474

{ # Max findings configuration per infoType, per content item or long

475

# running DlpJob.

476

"maxFindings": 42, # Max findings limit for the given infoType.

477

"infoType": { # Type of information detected by the API. # Type of information the findings limit applies to. Only one limit per

478

# info_type should be provided. If InfoTypeLimit does not have an

479

# info_type, the DLP API applies the limit against all info_types that

480

# are found but not specified in another InfoTypeLimit.

481

"name": "A String", # Name of the information type. Either a name of your choosing when

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

482

# creating a CustomInfoType, or one of the names listed

483

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

484

# a built-in type. InfoType names should conform to the pattern

485

# `[a-zA-Z0-9_]{1,64}`.

486

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

487

},

488

],

489

"maxFindingsPerRequest": 42, # Max number of findings that will be returned per request/job.

490

# When set within `InspectContentRequest`, the maximum returned is 2000

491

# regardless if this is set higher.

492

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

493

},

494

"deidentifyConfig": { # The configuration that controls how the data will change. # Configuration for the de-identification of the content item.

495

# Items specified here will override the template referenced by the

496

# deidentify_template_name argument.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

497

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text

498

# transformation everywhere.

499

# apply various `PrimitiveTransformation`s to each finding, where the

500

# transformation is applied to only values that were identified as a specific

501

# info_type.

502

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

503

# for a given infoType.

504

{ # A transformation to apply to text that is identified as a specific

505

# info_type.

506

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

507

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

508

# portion of the value.

509

"partToExtract": "A String", # The part of the time to keep.

510

},

511

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

512

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

513

# to learn more.

514

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

515

# If set, must also set cryptoKey. If set, shift will be consistent for the

516

# given context.

517

"name": "A String", # Name describing the field.

518

},

519

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

520

# range (inclusive ends). Negative means shift to earlier in time. Must not

521

# be more than 365250 days (1000 years) each direction.

522

#

523

# For example, 3 means shift date to at most 3 days into the future.

524

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

525

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

526

# results in the same shift for the same context and crypto_key. If

527

# set, must also set context. Can only be applied to table items.

528

# a key encryption key (KEK) stored by KMS).

529

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

530

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

531

# unwrap the data crypto key.

532

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

533

# leaking the key. Choose another type of key if possible.

534

"key": "A String", # Required. A 128/192/256 bit key.

535

},

536

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

537

# It will be discarded after the request finishes.

538

"name": "A String", # Required. Name of the key.

539

# This is an arbitrary string used to differentiate different keys.

540

# A unique key is generated per name: two separate `TransientCryptoKey`

541

# protos share the same generated key if their names are the same.

542

# When the data crypto key is generated, this name is not used in any way

543

# (repeating the api call will result in a different key being generated).

544

},

545

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

546

# The wrapped key must be a 128/192/256 bit key.

547

# Authorization requires the following IAM permissions when sending a request

548

# to perform a crypto transformation using a kms-wrapped crypto key:

549

# dlp.kms.encrypt

550

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

551

"wrappedKey": "A String", # Required. The wrapped data crypto key.

},

},

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

556

},

557

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

558

# Uses SHA-256.

559

# The key size must be either 32 or 64 bytes.

560

# Outputs a base64 encoded representation of the hashed output

561

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

562

# Currently, only string and integer values can be hashed.

563

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

564

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

565

# a key encryption key (KEK) stored by KMS).

566

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

567

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

568

# unwrap the data crypto key.

569

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

570

# leaking the key. Choose another type of key if possible.

571

"key": "A String", # Required. A 128/192/256 bit key.

572

},

573

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

574

# It will be discarded after the request finishes.

575

"name": "A String", # Required. Name of the key.

576

# This is an arbitrary string used to differentiate different keys.

577

# A unique key is generated per name: two separate `TransientCryptoKey`

578

# protos share the same generated key if their names are the same.

579

# When the data crypto key is generated, this name is not used in any way

580

# (repeating the api call will result in a different key being generated).

581

},

582

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

583

# The wrapped key must be a 128/192/256 bit key.

584

# Authorization requires the following IAM permissions when sending a request

585

# to perform a crypto transformation using a kms-wrapped crypto key:

586

# dlp.kms.encrypt

587

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

588

"wrappedKey": "A String", # Required. The wrapped data crypto key.

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

593

# (FPE) with the FFX mode of operation; however when used in the

594

# `ReidentifyContent` API method, it serves the opposite function by reversing

595

# the surrogate back into the original identifier. The identifier must be

596

# encoded as ASCII. For a given crypto key and context, the same identifier

597

# will be replaced with the same surrogate. Identifiers must be at least two

598

# characters long. In the case that the identifier is the empty string, it will

599

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

600

# more.

601

#

602

# Note: We recommend using CryptoDeterministicConfig for all use cases which

603

# do not require preserving the input alphabet space and size, plus warrant

604

# referential integrity.

605

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

606

# This annotation will be applied to the surrogate by prefixing it with

607

# the name of the custom infoType followed by the number of

608

# characters comprising the surrogate. The following scheme defines the

609

# format: info_type_name(surrogate_character_count):surrogate

610

#

611

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

612

# the surrogate is 'abc', the full replacement value

613

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

614

#

615

# This annotation identifies the surrogate when inspecting content using the

616

# custom infoType

617

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

618

# This facilitates reversal of the surrogate when it occurs in free text.

619

#

620

# In order for inspection to work properly, the name of this infoType must

621

# not occur naturally anywhere in your data; otherwise, inspection may

622

# find a surrogate that does not correspond to an actual identifier.

623

# Therefore, choose your custom infoType name carefully after considering

624

# what your data looks like. One way to select a name that has a high chance

625

# of yielding reliable detection is to include one or more unicode characters

626

# that are highly improbable to exist in your data.

627

# For example, assuming your data is entered from a regular ASCII keyboard,

628

# the symbol with the hex code point 29DD might be used like so:

629

# ⧝MY_TOKEN_TYPE

630

"name": "A String", # Name of the information type. Either a name of your choosing when

631

# creating a CustomInfoType, or one of the names listed

632

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

633

# a built-in type. InfoType names should conform to the pattern

634

# `[a-zA-Z0-9_]{1,64}`.

635

},

636

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

637

# identifier in two different contexts won't be given the same surrogate. If

638

# the context is not set, a default tweak will be used.

639

#

640

# If the context is set but:

641

#

642

# 1. there is no record present when transforming a given value or

643

# 1. the field is not present when transforming a given value,

644

#

645

# a default tweak will be used.

646

#

647

# Note that case (1) is expected when an `InfoTypeTransformation` is

648

# applied to both structured and non-structured `ContentItem`s.

649

# Currently, the referenced field may be of value type integer or string.

650

#

651

# The tweak is constructed as a sequence of bytes in big endian byte order

652

# such that:

653

#

654

# - a 64 bit integer is encoded followed by a single byte of value 1

655

# - a string is encoded in UTF-8 format followed by a single byte of value 2

656

"name": "A String", # Name describing the field.

657

},

658

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

659

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

660

# a key encryption key (KEK) stored by KMS).

661

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

662

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

663

# unwrap the data crypto key.

664

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

665

# leaking the key. Choose another type of key if possible.

666

"key": "A String", # Required. A 128/192/256 bit key.

667

},

668

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

669

# It will be discarded after the request finishes.

670

"name": "A String", # Required. Name of the key.

671

# This is an arbitrary string used to differentiate different keys.

672

# A unique key is generated per name: two separate `TransientCryptoKey`

673

# protos share the same generated key if their names are the same.

674

# When the data crypto key is generated, this name is not used in any way

675

# (repeating the api call will result in a different key being generated).

676

},

677

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

678

# The wrapped key must be a 128/192/256 bit key.

679

# Authorization requires the following IAM permissions when sending a request

680

# to perform a crypto transformation using a kms-wrapped crypto key:

681

# dlp.kms.encrypt

682

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

683

"wrappedKey": "A String", # Required. The wrapped data crypto key.

684

},

685

},

686

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

687

# that the FFX mode natively supports. This happens before/after

688

# encryption/decryption.

689

# Each character listed must appear only once.

690

# Number of characters must be in the range [2, 95].

691

# This must be encoded as ASCII.

692

# The order of characters does not matter.

693

"commonAlphabet": "A String", # Common alphabets.

694

},

695

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

696

# input. Outputs a base64 encoded representation of the encrypted output.

697

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

698

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

699

# This annotation will be applied to the surrogate by prefixing it with

700

# the name of the custom info type followed by the number of

701

# characters comprising the surrogate. The following scheme defines the

702

# format: {info type name}({surrogate character count}):{surrogate}

703

#

704

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

705

# the surrogate is 'abc', the full replacement value

706

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

707

#

708

# This annotation identifies the surrogate when inspecting content using the

709

# custom info type 'Surrogate'. This facilitates reversal of the

710

# surrogate when it occurs in free text.

711

#

712

# Note: For record transformations where the entire cell in a table is being

713

# transformed, surrogates are not mandatory. Surrogates are used to denote

714

# the location of the token and are necessary for re-identification in free

715

# form text.

716

#

717

# In order for inspection to work properly, the name of this info type must

718

# not occur naturally anywhere in your data; otherwise, inspection may either

719

#

720

# - reverse a surrogate that does not correspond to an actual identifier

721

# - be unable to parse the surrogate and result in an error

722

#

723

# Therefore, choose your custom info type name carefully after considering

724

# what your data looks like. One way to select a name that has a high chance

725

# of yielding reliable detection is to include one or more unicode characters

726

# that are highly improbable to exist in your data.

727

# For example, assuming your data is entered from a regular ASCII keyboard,

728

# the symbol with the hex code point 29DD might be used like so:

729

# ⧝MY_TOKEN_TYPE.

730

"name": "A String", # Name of the information type. Either a name of your choosing when

731

# creating a CustomInfoType, or one of the names listed

732

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

733

# a built-in type. InfoType names should conform to the pattern

734

# `[a-zA-Z0-9_]{1,64}`.

735

},

736

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

737

# referential integrity such that the same identifier in two different

738

# contexts will be given a distinct surrogate. The context is appended to

739

# plaintext value being encrypted. On decryption the provided context is

740

# validated against the value used during encryption. If a context was

741

# provided during encryption, same context must be provided during decryption

742

# as well.

743

#

744

# If the context is not set, plaintext would be used as is for encryption.

745

# If the context is set but:

746

#

747

# 1. there is no record present when transforming a given value or

748

# 2. the field is not present when transforming a given value,

749

#

750

# plaintext would be used as is for encryption.

751

#

752

# Note that case (1) is expected when an `InfoTypeTransformation` is

753

# applied to both structured and non-structured `ContentItem`s.

754

"name": "A String", # Name describing the field.

755

},

756

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

757

# a key encryption key (KEK) stored by KMS).

758

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

759

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

760

# unwrap the data crypto key.

761

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

762

# leaking the key. Choose another type of key if possible.

763

"key": "A String", # Required. A 128/192/256 bit key.

764

},

765

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

766

# It will be discarded after the request finishes.

767

"name": "A String", # Required. Name of the key.

768

# This is an arbitrary string used to differentiate different keys.

769

# A unique key is generated per name: two separate `TransientCryptoKey`

770

# protos share the same generated key if their names are the same.

771

# When the data crypto key is generated, this name is not used in any way

772

# (repeating the api call will result in a different key being generated).

773

},

774

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

775

# The wrapped key must be a 128/192/256 bit key.

776

# Authorization requires the following IAM permissions when sending a request

777

# to perform a crypto transformation using a kms-wrapped crypto key:

778

# dlp.kms.encrypt

779

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

780

"wrappedKey": "A String", # Required. The wrapped data crypto key.

},

},

},

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

785

# replacement values are dynamically provided by the user for custom behavior,

786

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

787

# This can be used on

788

# data of type: number, long, string, timestamp.

789

# If the bound `Value` type differs from the type of data being transformed, we

790

# will first attempt converting the type of the data to be transformed to match

791

# the type of the bound before comparing.

792

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

793

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

794

{ # Bucket is represented as a range, along with replacement values.

795

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

796

# the default behavior will be to hyphenate the min-max range.

797

# Note that for the purposes of inspection or transformation, the number

798

# of bytes considered to comprise a 'Value' is based on its representation

799

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

800

# 123456789, the number of bytes would be counted as 9, even though an

801

# int64 only holds up to 8 bytes of data.

802

"timestampValue": "A String", # timestamp

803

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

804

# and time zone are either specified elsewhere or are not significant. The date

805

# is relative to the Proleptic Gregorian Calendar. This can represent:

806

#

807

# * A full date, with non-zero year, month and day values

808

# * A month and day value, with a zero year, e.g. an anniversary

809

# * A year on its own, with zero month and day values

810

# * A year and month value, with a zero day, e.g. a credit card expiration date

811

#

812

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

813

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

814

# a year.

815

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

816

# month and day.

817

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

818

# if specifying a year by itself or a year and month where the day is not

819

# significant.

820

},

821

"stringValue": "A String", # string

822

"integerValue": "A String", # integer

823

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

824

# or are specified elsewhere. An API may choose to allow leap seconds. Related

825

# types are google.type.Date and `google.protobuf.Timestamp`.

826

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

827

# to allow the value "24:00:00" for scenarios like business closing time.

828

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

829

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

830

# allow the value 60 if it allows leap-seconds.

831

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

832

},

833

"booleanValue": True or False, # boolean

834

"floatValue": 3.14, # float

835

"dayOfWeekValue": "A String", # day of week

836

},

837

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

838

# used.

839

# Note that for the purposes of inspection or transformation, the number

840

# of bytes considered to comprise a 'Value' is based on its representation

841

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

842

# 123456789, the number of bytes would be counted as 9, even though an

843

# int64 only holds up to 8 bytes of data.

844

"timestampValue": "A String", # timestamp

845

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

846

# and time zone are either specified elsewhere or are not significant. The date

847

# is relative to the Proleptic Gregorian Calendar. This can represent:

848

#

849

# * A full date, with non-zero year, month and day values

850

# * A month and day value, with a zero year, e.g. an anniversary

851

# * A year on its own, with zero month and day values

852

# * A year and month value, with a zero day, e.g. a credit card expiration date

853

#

854

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

855

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

856

# a year.

857

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

858

# month and day.

859

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

860

# if specifying a year by itself or a year and month where the day is not

861

# significant.

862

},

863

"stringValue": "A String", # string

864

"integerValue": "A String", # integer

865

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

866

# or are specified elsewhere. An API may choose to allow leap seconds. Related

867

# types are google.type.Date and `google.protobuf.Timestamp`.

868

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

869

# to allow the value "24:00:00" for scenarios like business closing time.

870

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

871

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

872

# allow the value 60 if it allows leap-seconds.

873

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

874

},

875

"booleanValue": True or False, # boolean

876

"floatValue": 3.14, # float

877

"dayOfWeekValue": "A String", # day of week

878

},

879

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

880

# Note that for the purposes of inspection or transformation, the number

881

# of bytes considered to comprise a 'Value' is based on its representation

882

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

883

# 123456789, the number of bytes would be counted as 9, even though an

884

# int64 only holds up to 8 bytes of data.

885

"timestampValue": "A String", # timestamp

886

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

887

# and time zone are either specified elsewhere or are not significant. The date

888

# is relative to the Proleptic Gregorian Calendar. This can represent:

889

#

890

# * A full date, with non-zero year, month and day values

891

# * A month and day value, with a zero year, e.g. an anniversary

892

# * A year on its own, with zero month and day values

893

# * A year and month value, with a zero day, e.g. a credit card expiration date

894

#

895

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

896

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

897

# a year.

898

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

899

# month and day.

900

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

901

# if specifying a year by itself or a year and month where the day is not

902

# significant.

903

},

904

"stringValue": "A String", # string

905

"integerValue": "A String", # integer

906

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

907

# or are specified elsewhere. An API may choose to allow leap seconds. Related

908

# types are google.type.Date and `google.protobuf.Timestamp`.

909

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

910

# to allow the value "24:00:00" for scenarios like business closing time.

911

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

912

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

913

# allow the value 60 if it allows leap-seconds.

914

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

915

},

916

"booleanValue": True or False, # boolean

917

"floatValue": 3.14, # float

918

"dayOfWeekValue": "A String", # day of week

},

},

],

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

924

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

925

# output would be 'My phone number is '.

926

},

927

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

928

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

929

# Note that for the purposes of inspection or transformation, the number

930

# of bytes considered to comprise a 'Value' is based on its representation

931

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

932

# 123456789, the number of bytes would be counted as 9, even though an

933

# int64 only holds up to 8 bytes of data.

934

"timestampValue": "A String", # timestamp

935

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

936

# and time zone are either specified elsewhere or are not significant. The date

937

# is relative to the Proleptic Gregorian Calendar. This can represent:

938

#

939

# * A full date, with non-zero year, month and day values

940

# * A month and day value, with a zero year, e.g. an anniversary

941

# * A year on its own, with zero month and day values

942

# * A year and month value, with a zero day, e.g. a credit card expiration date

943

#

944

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

945

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

946

# a year.

947

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

948

# month and day.

949

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

950

# if specifying a year by itself or a year and month where the day is not

951

# significant.

952

},

953

"stringValue": "A String", # string

954

"integerValue": "A String", # integer

955

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

956

# or are specified elsewhere. An API may choose to allow leap seconds. Related

957

# types are google.type.Date and `google.protobuf.Timestamp`.

958

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

959

# to allow the value "24:00:00" for scenarios like business closing time.

960

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

961

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

962

# allow the value 60 if it allows leap-seconds.

963

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

964

},

965

"booleanValue": True or False, # boolean

966

"floatValue": 3.14, # float

967

"dayOfWeekValue": "A String", # day of week

968

},

969

},

970

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

971

# Bucketing transformation can provide all of this functionality,

972

# but requires more configuration. This message is provided as a convenience to

973

# the user for simple bucketing strategies.

974

#

975

# The transformed value will be a hyphenated string of

976

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

977

# all values that are within this bucket will be replaced with "10-20".

978

#

979

# This can be used on data of type: double, long.

980

#

981

# If the bound Value type differs from the type of data

982

# being transformed, we will first attempt converting the type of the data to

983

# be transformed to match the type of the bound before comparing.

984

#

985

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

986

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

987

# grouped together into a single bucket; for example if `upper_bound` = 89,

988

# then all values greater than 89 are replaced with the value "89+".

989

# Note that for the purposes of inspection or transformation, the number

990

# of bytes considered to comprise a 'Value' is based on its representation

991

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

992

# 123456789, the number of bytes would be counted as 9, even though an

993

# int64 only holds up to 8 bytes of data.

994

"timestampValue": "A String", # timestamp

995

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

996

# and time zone are either specified elsewhere or are not significant. The date

997

# is relative to the Proleptic Gregorian Calendar. This can represent:

998

#

999

# * A full date, with non-zero year, month and day values

1000

# * A month and day value, with a zero year, e.g. an anniversary

1001

# * A year on its own, with zero month and day values

1002

# * A year and month value, with a zero day, e.g. a credit card expiration date

1003

#

1004

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1005

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1006

# a year.

1007

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1008

# month and day.

1009

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1010

# if specifying a year by itself or a year and month where the day is not

1011

# significant.

1012

},

1013

"stringValue": "A String", # string

1014

"integerValue": "A String", # integer

1015

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1016

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1017

# types are google.type.Date and `google.protobuf.Timestamp`.

1018

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1019

# to allow the value "24:00:00" for scenarios like business closing time.

1020

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1021

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1022

# allow the value 60 if it allows leap-seconds.

1023

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1024

},

1025

"booleanValue": True or False, # boolean

1026

"floatValue": 3.14, # float

1027

"dayOfWeekValue": "A String", # day of week

1028

},

1029

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

1030

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

1031

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

1032

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

1033

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

1034

# grouped together into a single bucket; for example if `lower_bound` = 10,

1035

# then all values less than 10 are replaced with the value "-10".

1036

# Note that for the purposes of inspection or transformation, the number

1037

# of bytes considered to comprise a 'Value' is based on its representation

1038

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1039

# 123456789, the number of bytes would be counted as 9, even though an

1040

# int64 only holds up to 8 bytes of data.

1041

"timestampValue": "A String", # timestamp

1042

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1043

# and time zone are either specified elsewhere or are not significant. The date

1044

# is relative to the Proleptic Gregorian Calendar. This can represent:

1045

#

1046

# * A full date, with non-zero year, month and day values

1047

# * A month and day value, with a zero year, e.g. an anniversary

1048

# * A year on its own, with zero month and day values

1049

# * A year and month value, with a zero day, e.g. a credit card expiration date

1050

#

1051

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1052

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1053

# a year.

1054

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1055

# month and day.

1056

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1057

# if specifying a year by itself or a year and month where the day is not

1058

# significant.

1059

},

1060

"stringValue": "A String", # string

1061

"integerValue": "A String", # integer

1062

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1063

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1064

# types are google.type.Date and `google.protobuf.Timestamp`.

1065

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1066

# to allow the value "24:00:00" for scenarios like business closing time.

1067

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1068

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1069

# allow the value 60 if it allows leap-seconds.

1070

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1071

},

1072

"booleanValue": True or False, # boolean

1073

"floatValue": 3.14, # float

1074

"dayOfWeekValue": "A String", # day of week

1075

},

1076

},

1077

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

1078

# fixed character. Masking can start from the beginning or end of the string.

1079

# This can be used on data of any type (numbers, longs, and so on) and when

1080

# de-identifying structured data we'll attempt to preserve the original data's

1081

# type. (This allows you to take a long like 123 and modify it to a string like

1082

# **3.

1083

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

1084

# characters. For example, if the input string is `555-555-5555` and you

1085

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

1086

# returns `***-**5-5555`.

1087

{ # Characters to skip when doing deidentification of a value. These will be left

1088

# alone and skipped.

1089

"charactersToSkip": "A String", # Characters to not transform when masking.

1090

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

1095

# masked. Skipped characters do not count towards this tally.

1096

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

1097

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

1098

# code or credit card number. This string must have a length of 1. If not

1099

# supplied, this value defaults to `*` for strings, and `0` for digits.

1100

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

1101

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

1102

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

1103

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

1104

# is `true`, then the string `12345` is masked as `12***`.

1105

},

1106

},

1107

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

1108

# this transformation to apply to all findings that correspond to

1109

# infoTypes that were requested in `InspectConfig`.

1110

{ # Type of information detected by the API.

1111

"name": "A String", # Name of the information type. Either a name of your choosing when

1112

# creating a CustomInfoType, or one of the names listed

1113

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1114

# a built-in type. InfoType names should conform to the pattern

1115

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1121

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default

1122

# mode is `TransformationErrorHandling.ThrowError`.

1123

# transformation error occurs when the requested transformation is incompatible

1124

# with the data. For example, trying to de-identify an IP address using a

1125

# `DateShift` transformation would result in a transformation error, since date

1126

# info cannot be extracted from an IP address.

1127

# Information about any incompatible transformations, and how they were

1128

# handled, is returned in the response as part of the

1129

# `TransformationOverviews`.

1130

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

1131

},

1132

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would # Ignore errors

1133

# cause an error. For example, if a `DateShift` transformation were applied

1134

# an an IP address, this mode would leave the IP address unchanged in the

1135

# response.

1136

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1137

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1138

"recordTransformations": { # A type of transformation that is applied over structured data such as a # Treat the dataset as structured. Transformations can be applied to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1139

# specific locations within structured datasets, such as transforming

1140

# a column within a table.

1141

# table.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1142

"fieldTransformations": [ # Transform the record by applying various field transformations.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1143

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1144

"fields": [ # Required. Input field(s) to apply the transformation to.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1145

{ # General identifier of a data field in a storage service.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1146

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1147

},

1148

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1149

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1150

# transform content that matches an `InfoType`.

1151

# apply various `PrimitiveTransformation`s to each finding, where the

1152

# transformation is applied to only values that were identified as a specific

1153

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1154

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1155

# for a given infoType.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1156

{ # A transformation to apply to text that is identified as a specific

1157

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1158

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

1159

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

1160

# portion of the value.

1161

"partToExtract": "A String", # The part of the time to keep.

1162

},

1163

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

1164

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

1165

# to learn more.

1166

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

1167

# If set, must also set cryptoKey. If set, shift will be consistent for the

1168

# given context.

1169

"name": "A String", # Name describing the field.

1170

},

1171

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

1172

# range (inclusive ends). Negative means shift to earlier in time. Must not

1173

# be more than 365250 days (1000 years) each direction.

1174

#

1175

# For example, 3 means shift date to at most 3 days into the future.

1176

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1177

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

1178

# results in the same shift for the same context and crypto_key. If

1179

# set, must also set context. Can only be applied to table items.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1180

# a key encryption key (KEK) stored by KMS).

1181

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1182

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1183

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1184

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1185

# leaking the key. Choose another type of key if possible.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1186

"key": "A String", # Required. A 128/192/256 bit key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1187

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1188

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1189

# It will be discarded after the request finishes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1190

"name": "A String", # Required. Name of the key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1191

# This is an arbitrary string used to differentiate different keys.

1192

# A unique key is generated per name: two separate `TransientCryptoKey`

1193

# protos share the same generated key if their names are the same.

1194

# When the data crypto key is generated, this name is not used in any way

1195

# (repeating the api call will result in a different key being generated).

1196

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1197

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1198

# The wrapped key must be a 128/192/256 bit key.

1199

# Authorization requires the following IAM permissions when sending a request

1200

# to perform a crypto transformation using a kms-wrapped crypto key:

1201

# dlp.kms.encrypt

1202

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1203

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1204

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1205

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1206

},

1207

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1208

},

1209

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

1210

# Uses SHA-256.

1211

# The key size must be either 32 or 64 bytes.

1212

# Outputs a base64 encoded representation of the hashed output

1213

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

1214

# Currently, only string and integer values can be hashed.

1215

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

1216

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

1217

# a key encryption key (KEK) stored by KMS).

1218

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1219

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1220

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1221

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1222

# leaking the key. Choose another type of key if possible.

1223

"key": "A String", # Required. A 128/192/256 bit key.

1224

},

1225

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1226

# It will be discarded after the request finishes.

1227

"name": "A String", # Required. Name of the key.

1228

# This is an arbitrary string used to differentiate different keys.

1229

# A unique key is generated per name: two separate `TransientCryptoKey`

1230

# protos share the same generated key if their names are the same.

1231

# When the data crypto key is generated, this name is not used in any way

1232

# (repeating the api call will result in a different key being generated).

1233

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1234

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1235

# The wrapped key must be a 128/192/256 bit key.

1236

# Authorization requires the following IAM permissions when sending a request

1237

# to perform a crypto transformation using a kms-wrapped crypto key:

1238

# dlp.kms.encrypt

1239

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1240

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1241

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1242

},

1243

},

1244

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

1245

# (FPE) with the FFX mode of operation; however when used in the

1246

# `ReidentifyContent` API method, it serves the opposite function by reversing

1247

# the surrogate back into the original identifier. The identifier must be

1248

# encoded as ASCII. For a given crypto key and context, the same identifier

1249

# will be replaced with the same surrogate. Identifiers must be at least two

1250

# characters long. In the case that the identifier is the empty string, it will

1251

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

1252

# more.

1253

#

1254

# Note: We recommend using CryptoDeterministicConfig for all use cases which

1255

# do not require preserving the input alphabet space and size, plus warrant

1256

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1257

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

1258

# This annotation will be applied to the surrogate by prefixing it with

1259

# the name of the custom infoType followed by the number of

1260

# characters comprising the surrogate. The following scheme defines the

1261

# format: info_type_name(surrogate_character_count):surrogate

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1262

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1263

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

1264

# the surrogate is 'abc', the full replacement value

1265

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1266

#

1267

# This annotation identifies the surrogate when inspecting content using the

1268

# custom infoType

1269

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

1270

# This facilitates reversal of the surrogate when it occurs in free text.

1271

#

1272

# In order for inspection to work properly, the name of this infoType must

1273

# not occur naturally anywhere in your data; otherwise, inspection may

1274

# find a surrogate that does not correspond to an actual identifier.

1275

# Therefore, choose your custom infoType name carefully after considering

1276

# what your data looks like. One way to select a name that has a high chance

1277

# of yielding reliable detection is to include one or more unicode characters

1278

# that are highly improbable to exist in your data.

1279

# For example, assuming your data is entered from a regular ASCII keyboard,

1280

# the symbol with the hex code point 29DD might be used like so:

1281

# ⧝MY_TOKEN_TYPE

1282

"name": "A String", # Name of the information type. Either a name of your choosing when

1283

# creating a CustomInfoType, or one of the names listed

1284

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1285

# a built-in type. InfoType names should conform to the pattern

1286

# `[a-zA-Z0-9_]{1,64}`.

1287

},

1288

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

1289

# identifier in two different contexts won't be given the same surrogate. If

1290

# the context is not set, a default tweak will be used.

1291

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1292

# If the context is set but:

1293

#

1294

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1295

# 1. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1296

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1297

# a default tweak will be used.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1298

#

1299

# Note that case (1) is expected when an `InfoTypeTransformation` is

1300

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1301

# Currently, the referenced field may be of value type integer or string.

1302

#

1303

# The tweak is constructed as a sequence of bytes in big endian byte order

1304

# such that:

1305

#

1306

# - a 64 bit integer is encoded followed by a single byte of value 1

1307

# - a string is encoded in UTF-8 format followed by a single byte of value 2

1308

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1309

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1310

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

1311

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

1312

# a key encryption key (KEK) stored by KMS).

1313

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1314

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1315

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1316

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1317

# leaking the key. Choose another type of key if possible.

1318

"key": "A String", # Required. A 128/192/256 bit key.

1319

},

1320

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1321

# It will be discarded after the request finishes.

1322

"name": "A String", # Required. Name of the key.

1323

# This is an arbitrary string used to differentiate different keys.

1324

# A unique key is generated per name: two separate `TransientCryptoKey`

1325

# protos share the same generated key if their names are the same.

1326

# When the data crypto key is generated, this name is not used in any way

1327

# (repeating the api call will result in a different key being generated).

1328

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1329

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1330

# The wrapped key must be a 128/192/256 bit key.

1331

# Authorization requires the following IAM permissions when sending a request

1332

# to perform a crypto transformation using a kms-wrapped crypto key:

1333

# dlp.kms.encrypt

1334

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1335

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1336

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1337

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1338

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

1339

# that the FFX mode natively supports. This happens before/after

1340

# encryption/decryption.

1341

# Each character listed must appear only once.

1342

# Number of characters must be in the range [2, 95].

1343

# This must be encoded as ASCII.

1344

# The order of characters does not matter.

1345

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1346

},

1347

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

1348

# input. Outputs a base64 encoded representation of the encrypted output.

1349

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

1350

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1351

# This annotation will be applied to the surrogate by prefixing it with

1352

# the name of the custom info type followed by the number of

1353

# characters comprising the surrogate. The following scheme defines the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1354

# format: {info type name}({surrogate character count}):{surrogate}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1355

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1356

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

1357

# the surrogate is 'abc', the full replacement value

1358

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1359

#

1360

# This annotation identifies the surrogate when inspecting content using the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1361

# custom info type 'Surrogate'. This facilitates reversal of the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1362

# surrogate when it occurs in free text.

1363

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1364

# Note: For record transformations where the entire cell in a table is being

1365

# transformed, surrogates are not mandatory. Surrogates are used to denote

1366

# the location of the token and are necessary for re-identification in free

1367

# form text.

1368

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1369

# In order for inspection to work properly, the name of this info type must

1370

# not occur naturally anywhere in your data; otherwise, inspection may either

1371

#

1372

# - reverse a surrogate that does not correspond to an actual identifier

1373

# - be unable to parse the surrogate and result in an error

1374

#

1375

# Therefore, choose your custom info type name carefully after considering

1376

# what your data looks like. One way to select a name that has a high chance

1377

# of yielding reliable detection is to include one or more unicode characters

1378

# that are highly improbable to exist in your data.

1379

# For example, assuming your data is entered from a regular ASCII keyboard,

1380

# the symbol with the hex code point 29DD might be used like so:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1381

# ⧝MY_TOKEN_TYPE.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1382

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1383

# creating a CustomInfoType, or one of the names listed

1384

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1385

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1386

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1387

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1388

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

1389

# referential integrity such that the same identifier in two different

1390

# contexts will be given a distinct surrogate. The context is appended to

1391

# plaintext value being encrypted. On decryption the provided context is

1392

# validated against the value used during encryption. If a context was

1393

# provided during encryption, same context must be provided during decryption

1394

# as well.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1395

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1396

# If the context is not set, plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1397

# If the context is set but:

1398

#

1399

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1400

# 2. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1401

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1402

# plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1403

#

1404

# Note that case (1) is expected when an `InfoTypeTransformation` is

1405

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1406

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1407

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1408

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

1409

# a key encryption key (KEK) stored by KMS).

1410

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1411

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1412

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1413

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1414

# leaking the key. Choose another type of key if possible.

1415

"key": "A String", # Required. A 128/192/256 bit key.

1416

},

1417

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1418

# It will be discarded after the request finishes.

1419

"name": "A String", # Required. Name of the key.

1420

# This is an arbitrary string used to differentiate different keys.

1421

# A unique key is generated per name: two separate `TransientCryptoKey`

1422

# protos share the same generated key if their names are the same.

1423

# When the data crypto key is generated, this name is not used in any way

1424

# (repeating the api call will result in a different key being generated).

1425

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1426

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1427

# The wrapped key must be a 128/192/256 bit key.

1428

# Authorization requires the following IAM permissions when sending a request

1429

# to perform a crypto transformation using a kms-wrapped crypto key:

1430

# dlp.kms.encrypt

1431

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1432

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1433

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1434

},

1435

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1436

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1437

# replacement values are dynamically provided by the user for custom behavior,

1438

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

1439

# This can be used on

1440

# data of type: number, long, string, timestamp.

1441

# If the bound `Value` type differs from the type of data being transformed, we

1442

# will first attempt converting the type of the data to be transformed to match

1443

# the type of the bound before comparing.

1444

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1445

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1446

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1447

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

1448

# the default behavior will be to hyphenate the min-max range.

1449

# Note that for the purposes of inspection or transformation, the number

1450

# of bytes considered to comprise a 'Value' is based on its representation

1451

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1452

# 123456789, the number of bytes would be counted as 9, even though an

1453

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1454

"timestampValue": "A String", # timestamp

1455

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1456

# and time zone are either specified elsewhere or are not significant. The date

1457

# is relative to the Proleptic Gregorian Calendar. This can represent:

1458

#

1459

# * A full date, with non-zero year, month and day values

1460

# * A month and day value, with a zero year, e.g. an anniversary

1461

# * A year on its own, with zero month and day values

1462

# * A year and month value, with a zero day, e.g. a credit card expiration date

1463

#

1464

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1465

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1466

# a year.

1467

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1468

# month and day.

1469

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1470

# if specifying a year by itself or a year and month where the day is not

1471

# significant.

1472

},

1473

"stringValue": "A String", # string

1474

"integerValue": "A String", # integer

1475

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1476

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1477

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1478

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1479

# to allow the value "24:00:00" for scenarios like business closing time.

1480

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1481

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1482

# allow the value 60 if it allows leap-seconds.

1483

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1484

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1485

"booleanValue": True or False, # boolean

1486

"floatValue": 3.14, # float

1487

"dayOfWeekValue": "A String", # day of week

1488

},

1489

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

1490

# used.

1491

# Note that for the purposes of inspection or transformation, the number

1492

# of bytes considered to comprise a 'Value' is based on its representation

1493

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1494

# 123456789, the number of bytes would be counted as 9, even though an

1495

# int64 only holds up to 8 bytes of data.

1496

"timestampValue": "A String", # timestamp

1497

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1498

# and time zone are either specified elsewhere or are not significant. The date

1499

# is relative to the Proleptic Gregorian Calendar. This can represent:

1500

#

1501

# * A full date, with non-zero year, month and day values

1502

# * A month and day value, with a zero year, e.g. an anniversary

1503

# * A year on its own, with zero month and day values

1504

# * A year and month value, with a zero day, e.g. a credit card expiration date

1505

#

1506

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1507

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1508

# a year.

1509

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1510

# month and day.

1511

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1512

# if specifying a year by itself or a year and month where the day is not

1513

# significant.

1514

},

1515

"stringValue": "A String", # string

1516

"integerValue": "A String", # integer

1517

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1518

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1519

# types are google.type.Date and `google.protobuf.Timestamp`.

1520

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1521

# to allow the value "24:00:00" for scenarios like business closing time.

1522

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1523

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1524

# allow the value 60 if it allows leap-seconds.

1525

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1526

},

1527

"booleanValue": True or False, # boolean

1528

"floatValue": 3.14, # float

1529

"dayOfWeekValue": "A String", # day of week

1530

},

1531

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

1532

# Note that for the purposes of inspection or transformation, the number

1533

# of bytes considered to comprise a 'Value' is based on its representation

1534

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1535

# 123456789, the number of bytes would be counted as 9, even though an

1536

# int64 only holds up to 8 bytes of data.

1537

"timestampValue": "A String", # timestamp

1538

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1539

# and time zone are either specified elsewhere or are not significant. The date

1540

# is relative to the Proleptic Gregorian Calendar. This can represent:

1541

#

1542

# * A full date, with non-zero year, month and day values

1543

# * A month and day value, with a zero year, e.g. an anniversary

1544

# * A year on its own, with zero month and day values

1545

# * A year and month value, with a zero day, e.g. a credit card expiration date

1546

#

1547

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1548

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1549

# a year.

1550

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1551

# month and day.

1552

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1553

# if specifying a year by itself or a year and month where the day is not

1554

# significant.

1555

},

1556

"stringValue": "A String", # string

1557

"integerValue": "A String", # integer

1558

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1559

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1560

# types are google.type.Date and `google.protobuf.Timestamp`.

1561

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1562

# to allow the value "24:00:00" for scenarios like business closing time.

1563

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1564

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1565

# allow the value 60 if it allows leap-seconds.

1566

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1567

},

1568

"booleanValue": True or False, # boolean

1569

"floatValue": 3.14, # float

1570

"dayOfWeekValue": "A String", # day of week

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1575

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

1576

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

1577

# output would be 'My phone number is '.

1578

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1579

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

1580

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1581

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1582

# of bytes considered to comprise a 'Value' is based on its representation

1583

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1584

# 123456789, the number of bytes would be counted as 9, even though an

1585

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1586

"timestampValue": "A String", # timestamp

1587

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1588

# and time zone are either specified elsewhere or are not significant. The date

1589

# is relative to the Proleptic Gregorian Calendar. This can represent:

1590

#

1591

# * A full date, with non-zero year, month and day values

1592

# * A month and day value, with a zero year, e.g. an anniversary

1593

# * A year on its own, with zero month and day values

1594

# * A year and month value, with a zero day, e.g. a credit card expiration date

1595

#

1596

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1597

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1598

# a year.

1599

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1600

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1601

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1602

# if specifying a year by itself or a year and month where the day is not

1603

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1604

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1605

"stringValue": "A String", # string

1606

"integerValue": "A String", # integer

1607

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1608

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1609

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1610

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1611

# to allow the value "24:00:00" for scenarios like business closing time.

1612

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1613

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1614

# allow the value 60 if it allows leap-seconds.

1615

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1616

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1617

"booleanValue": True or False, # boolean

1618

"floatValue": 3.14, # float

1619

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1620

},

1621

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1622

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

1623

# Bucketing transformation can provide all of this functionality,

1624

# but requires more configuration. This message is provided as a convenience to

1625

# the user for simple bucketing strategies.

1626

#

1627

# The transformed value will be a hyphenated string of

1628

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

1629

# all values that are within this bucket will be replaced with "10-20".

1630

#

1631

# This can be used on data of type: double, long.

1632

#

1633

# If the bound Value type differs from the type of data

1634

# being transformed, we will first attempt converting the type of the data to

1635

# be transformed to match the type of the bound before comparing.

1636

#

1637

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1638

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

1639

# grouped together into a single bucket; for example if `upper_bound` = 89,

1640

# then all values greater than 89 are replaced with the value "89+".

1641

# Note that for the purposes of inspection or transformation, the number

1642

# of bytes considered to comprise a 'Value' is based on its representation

1643

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1644

# 123456789, the number of bytes would be counted as 9, even though an

1645

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1646

"timestampValue": "A String", # timestamp

1647

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1648

# and time zone are either specified elsewhere or are not significant. The date

1649

# is relative to the Proleptic Gregorian Calendar. This can represent:

1650

#

1651

# * A full date, with non-zero year, month and day values

1652

# * A month and day value, with a zero year, e.g. an anniversary

1653

# * A year on its own, with zero month and day values

1654

# * A year and month value, with a zero day, e.g. a credit card expiration date

1655

#

1656

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1657

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1658

# a year.

1659

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1660

# month and day.

1661

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1662

# if specifying a year by itself or a year and month where the day is not

1663

# significant.

1664

},

1665

"stringValue": "A String", # string

1666

"integerValue": "A String", # integer

1667

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1668

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1669

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1670

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1671

# to allow the value "24:00:00" for scenarios like business closing time.

1672

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1673

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1674

# allow the value 60 if it allows leap-seconds.

1675

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1676

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1677

"booleanValue": True or False, # boolean

1678

"floatValue": 3.14, # float

1679

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1680

},

1681

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

1682

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

1683

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

1684

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1685

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

1686

# grouped together into a single bucket; for example if `lower_bound` = 10,

1687

# then all values less than 10 are replaced with the value "-10".

1688

# Note that for the purposes of inspection or transformation, the number

1689

# of bytes considered to comprise a 'Value' is based on its representation

1690

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1691

# 123456789, the number of bytes would be counted as 9, even though an

1692

# int64 only holds up to 8 bytes of data.

1693

"timestampValue": "A String", # timestamp

1694

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1695

# and time zone are either specified elsewhere or are not significant. The date

1696

# is relative to the Proleptic Gregorian Calendar. This can represent:

1697

#

1698

# * A full date, with non-zero year, month and day values

1699

# * A month and day value, with a zero year, e.g. an anniversary

1700

# * A year on its own, with zero month and day values

1701

# * A year and month value, with a zero day, e.g. a credit card expiration date

1702

#

1703

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1704

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1705

# a year.

1706

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1707

# month and day.

1708

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1709

# if specifying a year by itself or a year and month where the day is not

1710

# significant.

1711

},

1712

"stringValue": "A String", # string

1713

"integerValue": "A String", # integer

1714

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1715

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1716

# types are google.type.Date and `google.protobuf.Timestamp`.

1717

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1718

# to allow the value "24:00:00" for scenarios like business closing time.

1719

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1720

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1721

# allow the value 60 if it allows leap-seconds.

1722

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1723

},

1724

"booleanValue": True or False, # boolean

1725

"floatValue": 3.14, # float

1726

"dayOfWeekValue": "A String", # day of week

1727

},

1728

},

1729

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

1730

# fixed character. Masking can start from the beginning or end of the string.

1731

# This can be used on data of any type (numbers, longs, and so on) and when

1732

# de-identifying structured data we'll attempt to preserve the original data's

1733

# type. (This allows you to take a long like 123 and modify it to a string like

1734

# **3.

1735

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

1736

# characters. For example, if the input string is `555-555-5555` and you

1737

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

1738

# returns `***-**5-5555`.

1739

{ # Characters to skip when doing deidentification of a value. These will be left

1740

# alone and skipped.

1741

"charactersToSkip": "A String", # Characters to not transform when masking.

1742

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

1747

# masked. Skipped characters do not count towards this tally.

1748

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

1749

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

1750

# code or credit card number. This string must have a length of 1. If not

1751

# supplied, this value defaults to `*` for strings, and `0` for digits.

1752

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

1753

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

1754

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

1755

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

1756

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1757

},

1758

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1759

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

1760

# this transformation to apply to all findings that correspond to

1761

# infoTypes that were requested in `InspectConfig`.

1762

{ # Type of information detected by the API.

1763

"name": "A String", # Name of the information type. Either a name of your choosing when

1764

# creating a CustomInfoType, or one of the names listed

1765

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1766

# a built-in type. InfoType names should conform to the pattern

1767

# `[a-zA-Z0-9_]{1,64}`.

1768

},

1769

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1770

},

1771

],

1772

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1773

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

1774

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

1775

# portion of the value.

1776

"partToExtract": "A String", # The part of the time to keep.

1777

},

1778

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

1779

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

1780

# to learn more.

1781

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

1782

# If set, must also set cryptoKey. If set, shift will be consistent for the

1783

# given context.

1784

"name": "A String", # Name describing the field.

1785

},

1786

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

1787

# range (inclusive ends). Negative means shift to earlier in time. Must not

1788

# be more than 365250 days (1000 years) each direction.

1789

#

1790

# For example, 3 means shift date to at most 3 days into the future.

1791

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1792

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

1793

# results in the same shift for the same context and crypto_key. If

1794

# set, must also set context. Can only be applied to table items.

1795

# a key encryption key (KEK) stored by KMS).

1796

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1797

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1798

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1799

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1800

# leaking the key. Choose another type of key if possible.

1801

"key": "A String", # Required. A 128/192/256 bit key.

1802

},

1803

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1804

# It will be discarded after the request finishes.

1805

"name": "A String", # Required. Name of the key.

1806

# This is an arbitrary string used to differentiate different keys.

1807

# A unique key is generated per name: two separate `TransientCryptoKey`

1808

# protos share the same generated key if their names are the same.

1809

# When the data crypto key is generated, this name is not used in any way

1810

# (repeating the api call will result in a different key being generated).

1811

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1812

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1813

# The wrapped key must be a 128/192/256 bit key.

1814

# Authorization requires the following IAM permissions when sending a request

1815

# to perform a crypto transformation using a kms-wrapped crypto key:

1816

# dlp.kms.encrypt

1817

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1818

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1819

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1820

},

1821

},

1822

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1823

},

1824

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

1825

# Uses SHA-256.

1826

# The key size must be either 32 or 64 bytes.

1827

# Outputs a base64 encoded representation of the hashed output

1828

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

1829

# Currently, only string and integer values can be hashed.

1830

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

1831

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

1832

# a key encryption key (KEK) stored by KMS).

1833

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1834

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1835

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1836

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1837

# leaking the key. Choose another type of key if possible.

1838

"key": "A String", # Required. A 128/192/256 bit key.

1839

},

1840

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1841

# It will be discarded after the request finishes.

1842

"name": "A String", # Required. Name of the key.

1843

# This is an arbitrary string used to differentiate different keys.

1844

# A unique key is generated per name: two separate `TransientCryptoKey`

1845

# protos share the same generated key if their names are the same.

1846

# When the data crypto key is generated, this name is not used in any way

1847

# (repeating the api call will result in a different key being generated).

1848

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1849

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1850

# The wrapped key must be a 128/192/256 bit key.

1851

# Authorization requires the following IAM permissions when sending a request

1852

# to perform a crypto transformation using a kms-wrapped crypto key:

1853

# dlp.kms.encrypt

1854

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1855

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1856

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1857

},

1858

},

1859

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

1860

# (FPE) with the FFX mode of operation; however when used in the

1861

# `ReidentifyContent` API method, it serves the opposite function by reversing

1862

# the surrogate back into the original identifier. The identifier must be

1863

# encoded as ASCII. For a given crypto key and context, the same identifier

1864

# will be replaced with the same surrogate. Identifiers must be at least two

1865

# characters long. In the case that the identifier is the empty string, it will

1866

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

1867

# more.

1868

#

1869

# Note: We recommend using CryptoDeterministicConfig for all use cases which

1870

# do not require preserving the input alphabet space and size, plus warrant

1871

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1872

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

1873

# This annotation will be applied to the surrogate by prefixing it with

1874

# the name of the custom infoType followed by the number of

1875

# characters comprising the surrogate. The following scheme defines the

1876

# format: info_type_name(surrogate_character_count):surrogate

1877

#

1878

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

1879

# the surrogate is 'abc', the full replacement value

1880

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1881

#

1882

# This annotation identifies the surrogate when inspecting content using the

1883

# custom infoType

1884

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

1885

# This facilitates reversal of the surrogate when it occurs in free text.

1886

#

1887

# In order for inspection to work properly, the name of this infoType must

1888

# not occur naturally anywhere in your data; otherwise, inspection may

1889

# find a surrogate that does not correspond to an actual identifier.

1890

# Therefore, choose your custom infoType name carefully after considering

1891

# what your data looks like. One way to select a name that has a high chance

1892

# of yielding reliable detection is to include one or more unicode characters

1893

# that are highly improbable to exist in your data.

1894

# For example, assuming your data is entered from a regular ASCII keyboard,

1895

# the symbol with the hex code point 29DD might be used like so:

1896

# ⧝MY_TOKEN_TYPE

1897

"name": "A String", # Name of the information type. Either a name of your choosing when

1898

# creating a CustomInfoType, or one of the names listed

1899

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1900

# a built-in type. InfoType names should conform to the pattern

1901

# `[a-zA-Z0-9_]{1,64}`.

1902

},

1903

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

1904

# identifier in two different contexts won't be given the same surrogate. If

1905

# the context is not set, a default tweak will be used.

1906

#

1907

# If the context is set but:

1908

#

1909

# 1. there is no record present when transforming a given value or

1910

# 1. the field is not present when transforming a given value,

1911

#

1912

# a default tweak will be used.

1913

#

1914

# Note that case (1) is expected when an `InfoTypeTransformation` is

1915

# applied to both structured and non-structured `ContentItem`s.

1916

# Currently, the referenced field may be of value type integer or string.

1917

#

1918

# The tweak is constructed as a sequence of bytes in big endian byte order

1919

# such that:

1920

#

1921

# - a 64 bit integer is encoded followed by a single byte of value 1

1922

# - a string is encoded in UTF-8 format followed by a single byte of value 2

1923

"name": "A String", # Name describing the field.

1924

},

1925

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

1926

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

1927

# a key encryption key (KEK) stored by KMS).

1928

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1929

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1930

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1931

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1932

# leaking the key. Choose another type of key if possible.

1933

"key": "A String", # Required. A 128/192/256 bit key.

1934

},

1935

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1936

# It will be discarded after the request finishes.

1937

"name": "A String", # Required. Name of the key.

1938

# This is an arbitrary string used to differentiate different keys.

1939

# A unique key is generated per name: two separate `TransientCryptoKey`

1940

# protos share the same generated key if their names are the same.

1941

# When the data crypto key is generated, this name is not used in any way

1942

# (repeating the api call will result in a different key being generated).

1943

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1944

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1945

# The wrapped key must be a 128/192/256 bit key.

1946

# Authorization requires the following IAM permissions when sending a request

1947

# to perform a crypto transformation using a kms-wrapped crypto key:

1948

# dlp.kms.encrypt

1949

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1950

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1951

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1952

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

1953

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

1954

# that the FFX mode natively supports. This happens before/after

1955

# encryption/decryption.

1956

# Each character listed must appear only once.

1957

# Number of characters must be in the range [2, 95].

1958

# This must be encoded as ASCII.

1959

# The order of characters does not matter.

1960

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1961

},

1962

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

1963

# input. Outputs a base64 encoded representation of the encrypted output.

1964

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

1965

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

1966

# This annotation will be applied to the surrogate by prefixing it with

1967

# the name of the custom info type followed by the number of

1968

# characters comprising the surrogate. The following scheme defines the

1969

# format: {info type name}({surrogate character count}):{surrogate}

1970

#

1971

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

1972

# the surrogate is 'abc', the full replacement value

1973

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1974

#

1975

# This annotation identifies the surrogate when inspecting content using the

1976

# custom info type 'Surrogate'. This facilitates reversal of the

1977

# surrogate when it occurs in free text.

1978

#

1979

# Note: For record transformations where the entire cell in a table is being

1980

# transformed, surrogates are not mandatory. Surrogates are used to denote

1981

# the location of the token and are necessary for re-identification in free

1982

# form text.

1983

#

1984

# In order for inspection to work properly, the name of this info type must

1985

# not occur naturally anywhere in your data; otherwise, inspection may either

1986

#

1987

# - reverse a surrogate that does not correspond to an actual identifier

1988

# - be unable to parse the surrogate and result in an error

1989

#

1990

# Therefore, choose your custom info type name carefully after considering

1991

# what your data looks like. One way to select a name that has a high chance

1992

# of yielding reliable detection is to include one or more unicode characters

1993

# that are highly improbable to exist in your data.

1994

# For example, assuming your data is entered from a regular ASCII keyboard,

1995

# the symbol with the hex code point 29DD might be used like so:

1996

# ⧝MY_TOKEN_TYPE.

1997

"name": "A String", # Name of the information type. Either a name of your choosing when

1998

# creating a CustomInfoType, or one of the names listed

1999

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2000

# a built-in type. InfoType names should conform to the pattern

2001

# `[a-zA-Z0-9_]{1,64}`.

2002

},

2003

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

2004

# referential integrity such that the same identifier in two different

2005

# contexts will be given a distinct surrogate. The context is appended to

2006

# plaintext value being encrypted. On decryption the provided context is

2007

# validated against the value used during encryption. If a context was

2008

# provided during encryption, same context must be provided during decryption

2009

# as well.

2010

#

2011

# If the context is not set, plaintext would be used as is for encryption.

2012

# If the context is set but:

2013

#

2014

# 1. there is no record present when transforming a given value or

2015

# 2. the field is not present when transforming a given value,

2016

#

2017

# plaintext would be used as is for encryption.

2018

#

2019

# Note that case (1) is expected when an `InfoTypeTransformation` is

2020

# applied to both structured and non-structured `ContentItem`s.

2021

"name": "A String", # Name describing the field.

2022

},

2023

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

2024

# a key encryption key (KEK) stored by KMS).

2025

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2026

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2027

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2028

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2029

# leaking the key. Choose another type of key if possible.

2030

"key": "A String", # Required. A 128/192/256 bit key.

2031

},

2032

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2033

# It will be discarded after the request finishes.

2034

"name": "A String", # Required. Name of the key.

2035

# This is an arbitrary string used to differentiate different keys.

2036

# A unique key is generated per name: two separate `TransientCryptoKey`

2037

# protos share the same generated key if their names are the same.

2038

# When the data crypto key is generated, this name is not used in any way

2039

# (repeating the api call will result in a different key being generated).

2040

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2041

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2042

# The wrapped key must be a 128/192/256 bit key.

2043

# Authorization requires the following IAM permissions when sending a request

2044

# to perform a crypto transformation using a kms-wrapped crypto key:

2045

# dlp.kms.encrypt

2046

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2047

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2048

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2049

},

2050

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2051

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

2052

# replacement values are dynamically provided by the user for custom behavior,

2053

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

2054

# This can be used on

2055

# data of type: number, long, string, timestamp.

2056

# If the bound `Value` type differs from the type of data being transformed, we

2057

# will first attempt converting the type of the data to be transformed to match

2058

# the type of the bound before comparing.

2059

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

2060

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

2061

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2062

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

2063

# the default behavior will be to hyphenate the min-max range.

2064

# Note that for the purposes of inspection or transformation, the number

2065

# of bytes considered to comprise a 'Value' is based on its representation

2066

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2067

# 123456789, the number of bytes would be counted as 9, even though an

2068

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2069

"timestampValue": "A String", # timestamp

2070

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2071

# and time zone are either specified elsewhere or are not significant. The date

2072

# is relative to the Proleptic Gregorian Calendar. This can represent:

2073

#

2074

# * A full date, with non-zero year, month and day values

2075

# * A month and day value, with a zero year, e.g. an anniversary

2076

# * A year on its own, with zero month and day values

2077

# * A year and month value, with a zero day, e.g. a credit card expiration date

2078

#

2079

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2080

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2081

# a year.

2082

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2083

# month and day.

2084

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2085

# if specifying a year by itself or a year and month where the day is not

2086

# significant.

2087

},

2088

"stringValue": "A String", # string

2089

"integerValue": "A String", # integer

2090

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2091

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2092

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2093

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2094

# to allow the value "24:00:00" for scenarios like business closing time.

2095

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2096

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2097

# allow the value 60 if it allows leap-seconds.

2098

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2099

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2100

"booleanValue": True or False, # boolean

2101

"floatValue": 3.14, # float

2102

"dayOfWeekValue": "A String", # day of week

2103

},

2104

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

2105

# used.

2106

# Note that for the purposes of inspection or transformation, the number

2107

# of bytes considered to comprise a 'Value' is based on its representation

2108

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2109

# 123456789, the number of bytes would be counted as 9, even though an

2110

# int64 only holds up to 8 bytes of data.

2111

"timestampValue": "A String", # timestamp

2112

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2113

# and time zone are either specified elsewhere or are not significant. The date

2114

# is relative to the Proleptic Gregorian Calendar. This can represent:

2115

#

2116

# * A full date, with non-zero year, month and day values

2117

# * A month and day value, with a zero year, e.g. an anniversary

2118

# * A year on its own, with zero month and day values

2119

# * A year and month value, with a zero day, e.g. a credit card expiration date

2120

#

2121

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2122

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2123

# a year.

2124

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2125

# month and day.

2126

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2127

# if specifying a year by itself or a year and month where the day is not

2128

# significant.

2129

},

2130

"stringValue": "A String", # string

2131

"integerValue": "A String", # integer

2132

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2133

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2134

# types are google.type.Date and `google.protobuf.Timestamp`.

2135

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2136

# to allow the value "24:00:00" for scenarios like business closing time.

2137

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2138

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2139

# allow the value 60 if it allows leap-seconds.

2140

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2141

},

2142

"booleanValue": True or False, # boolean

2143

"floatValue": 3.14, # float

2144

"dayOfWeekValue": "A String", # day of week

2145

},

2146

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

2147

# Note that for the purposes of inspection or transformation, the number

2148

# of bytes considered to comprise a 'Value' is based on its representation

2149

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2150

# 123456789, the number of bytes would be counted as 9, even though an

2151

# int64 only holds up to 8 bytes of data.

2152

"timestampValue": "A String", # timestamp

2153

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2154

# and time zone are either specified elsewhere or are not significant. The date

2155

# is relative to the Proleptic Gregorian Calendar. This can represent:

2156

#

2157

# * A full date, with non-zero year, month and day values

2158

# * A month and day value, with a zero year, e.g. an anniversary

2159

# * A year on its own, with zero month and day values

2160

# * A year and month value, with a zero day, e.g. a credit card expiration date

2161

#

2162

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2163

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2164

# a year.

2165

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2166

# month and day.

2167

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2168

# if specifying a year by itself or a year and month where the day is not

2169

# significant.

2170

},

2171

"stringValue": "A String", # string

2172

"integerValue": "A String", # integer

2173

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2174

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2175

# types are google.type.Date and `google.protobuf.Timestamp`.

2176

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2177

# to allow the value "24:00:00" for scenarios like business closing time.

2178

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2179

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2180

# allow the value 60 if it allows leap-seconds.

2181

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2182

},

2183

"booleanValue": True or False, # boolean

2184

"floatValue": 3.14, # float

2185

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2190

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

2191

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

2192

# output would be 'My phone number is '.

2193

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2194

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

2195

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

2196

# Note that for the purposes of inspection or transformation, the number

2197

# of bytes considered to comprise a 'Value' is based on its representation

2198

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2199

# 123456789, the number of bytes would be counted as 9, even though an

2200

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2201

"timestampValue": "A String", # timestamp

2202

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2203

# and time zone are either specified elsewhere or are not significant. The date

2204

# is relative to the Proleptic Gregorian Calendar. This can represent:

2205

#

2206

# * A full date, with non-zero year, month and day values

2207

# * A month and day value, with a zero year, e.g. an anniversary

2208

# * A year on its own, with zero month and day values

2209

# * A year and month value, with a zero day, e.g. a credit card expiration date

2210

#

2211

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2212

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2213

# a year.

2214

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2215

# month and day.

2216

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2217

# if specifying a year by itself or a year and month where the day is not

2218

# significant.

2219

},

2220

"stringValue": "A String", # string

2221

"integerValue": "A String", # integer

2222

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2223

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2224

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2225

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2226

# to allow the value "24:00:00" for scenarios like business closing time.

2227

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2228

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2229

# allow the value 60 if it allows leap-seconds.

2230

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2231

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2232

"booleanValue": True or False, # boolean

2233

"floatValue": 3.14, # float

2234

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2235

},

2236

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2237

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

2238

# Bucketing transformation can provide all of this functionality,

2239

# but requires more configuration. This message is provided as a convenience to

2240

# the user for simple bucketing strategies.

2241

#

2242

# The transformed value will be a hyphenated string of

2243

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

2244

# all values that are within this bucket will be replaced with "10-20".

2245

#

2246

# This can be used on data of type: double, long.

2247

#

2248

# If the bound Value type differs from the type of data

2249

# being transformed, we will first attempt converting the type of the data to

2250

# be transformed to match the type of the bound before comparing.

2251

#

2252

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2253

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

2254

# grouped together into a single bucket; for example if `upper_bound` = 89,

2255

# then all values greater than 89 are replaced with the value "89+".

2256

# Note that for the purposes of inspection or transformation, the number

2257

# of bytes considered to comprise a 'Value' is based on its representation

2258

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2259

# 123456789, the number of bytes would be counted as 9, even though an

2260

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2261

"timestampValue": "A String", # timestamp

2262

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2263

# and time zone are either specified elsewhere or are not significant. The date

2264

# is relative to the Proleptic Gregorian Calendar. This can represent:

2265

#

2266

# * A full date, with non-zero year, month and day values

2267

# * A month and day value, with a zero year, e.g. an anniversary

2268

# * A year on its own, with zero month and day values

2269

# * A year and month value, with a zero day, e.g. a credit card expiration date

2270

#

2271

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2272

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2273

# a year.

2274

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2275

# month and day.

2276

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2277

# if specifying a year by itself or a year and month where the day is not

2278

# significant.

2279

},

2280

"stringValue": "A String", # string

2281

"integerValue": "A String", # integer

2282

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2283

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2284

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2285

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2286

# to allow the value "24:00:00" for scenarios like business closing time.

2287

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2288

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2289

# allow the value 60 if it allows leap-seconds.

2290

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2291

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2292

"booleanValue": True or False, # boolean

2293

"floatValue": 3.14, # float

2294

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2295

},

2296

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

2297

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

2298

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

2299

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2300

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

2301

# grouped together into a single bucket; for example if `lower_bound` = 10,

2302

# then all values less than 10 are replaced with the value "-10".

2303

# Note that for the purposes of inspection or transformation, the number

2304

# of bytes considered to comprise a 'Value' is based on its representation

2305

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2306

# 123456789, the number of bytes would be counted as 9, even though an

2307

# int64 only holds up to 8 bytes of data.

2308

"timestampValue": "A String", # timestamp

2309

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2310

# and time zone are either specified elsewhere or are not significant. The date

2311

# is relative to the Proleptic Gregorian Calendar. This can represent:

2312

#

2313

# * A full date, with non-zero year, month and day values

2314

# * A month and day value, with a zero year, e.g. an anniversary

2315

# * A year on its own, with zero month and day values

2316

# * A year and month value, with a zero day, e.g. a credit card expiration date

2317

#

2318

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2319

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2320

# a year.

2321

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2322

# month and day.

2323

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2324

# if specifying a year by itself or a year and month where the day is not

2325

# significant.

2326

},

2327

"stringValue": "A String", # string

2328

"integerValue": "A String", # integer

2329

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2330

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2331

# types are google.type.Date and `google.protobuf.Timestamp`.

2332

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2333

# to allow the value "24:00:00" for scenarios like business closing time.

2334

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2335

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2336

# allow the value 60 if it allows leap-seconds.

2337

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2338

},

2339

"booleanValue": True or False, # boolean

2340

"floatValue": 3.14, # float

2341

"dayOfWeekValue": "A String", # day of week

2342

},

2343

},

2344

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

2345

# fixed character. Masking can start from the beginning or end of the string.

2346

# This can be used on data of any type (numbers, longs, and so on) and when

2347

# de-identifying structured data we'll attempt to preserve the original data's

2348

# type. (This allows you to take a long like 123 and modify it to a string like

2349

# **3.

2350

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

2351

# characters. For example, if the input string is `555-555-5555` and you

2352

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

2353

# returns `***-**5-5555`.

2354

{ # Characters to skip when doing deidentification of a value. These will be left

2355

# alone and skipped.

2356

"charactersToSkip": "A String", # Characters to not transform when masking.

2357

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

2362

# masked. Skipped characters do not count towards this tally.

2363

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

2364

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

2365

# code or credit card number. This string must have a length of 1. If not

2366

# supplied, this value defaults to `*` for strings, and `0` for digits.

2367

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

2368

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

2369

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

2370

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

2371

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2372

},

2373

},

2374

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

2375

# given `RecordCondition`. The conditions are allowed to reference fields

2376

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

2381

# column for the same record is within a specific range.

2382

# - Redact a field if the date of birth field is greater than 85.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2383

# a field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2384

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

2385

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

2386

# only supported value is `AND`.

2387

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

2388

"conditions": [ # A collection of conditions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2389

{ # The field type of `value` and `field` do not need to match to be

2390

# considered equal, but not all comparisons are possible.

2391

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

2392

# but all other comparisons are invalid with incompatible types.

2393

# A `value` of type:

2394

#

2395

# - `string` can be compared against all other types

2396

# - `boolean` can only be compared against other booleans

2397

# - `integer` can be compared against doubles or a string if the string value

2398

# can be parsed as an integer.

2399

# - `double` can be compared against integers or a string if the string can

2400

# be parsed as a double.

2401

# - `Timestamp` can be compared against strings in RFC 3339 date string

2402

# format.

2403

# - `TimeOfDay` can be compared against timestamps and strings in the format

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2404

# of 'HH:mm:ss'.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2405

#

2406

# If we fail to compare do to type mismatch, a warning will be given and

2407

# the condition will evaluate to false.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2408

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2409

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2410

# of bytes considered to comprise a 'Value' is based on its representation

2411

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2412

# 123456789, the number of bytes would be counted as 9, even though an

2413

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2414

"timestampValue": "A String", # timestamp

2415

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2416

# and time zone are either specified elsewhere or are not significant. The date

2417

# is relative to the Proleptic Gregorian Calendar. This can represent:

2418

#

2419

# * A full date, with non-zero year, month and day values

2420

# * A month and day value, with a zero year, e.g. an anniversary

2421

# * A year on its own, with zero month and day values

2422

# * A year and month value, with a zero day, e.g. a credit card expiration date

2423

#

2424

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2425

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2426

# a year.

2427

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2428

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2429

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2430

# if specifying a year by itself or a year and month where the day is not

2431

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2432

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2433

"stringValue": "A String", # string

2434

"integerValue": "A String", # integer

2435

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2436

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2437

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2438

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2439

# to allow the value "24:00:00" for scenarios like business closing time.

2440

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2441

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2442

# allow the value 60 if it allows leap-seconds.

2443

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2444

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2445

"booleanValue": True or False, # boolean

2446

"floatValue": 3.14, # float

2447

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2448

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2449

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

2450

"name": "A String", # Name describing the field.

2451

},

2452

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2453

},

2454

],

2455

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2456

},

2457

},

2458

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2459

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2460

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that

2461

# match any suppression rule are omitted from the output.

2462

{ # Configuration to suppress records whose suppression conditions evaluate to

2463

# true.

2464

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

2465

# evaluated to be suppressed from the transformed content.

2466

# a field.

2467

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

2468

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

2469

# only supported value is `AND`.

2470

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

2471

"conditions": [ # A collection of conditions.

2472

{ # The field type of `value` and `field` do not need to match to be

2473

# considered equal, but not all comparisons are possible.

2474

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

2475

# but all other comparisons are invalid with incompatible types.

2476

# A `value` of type:

2477

#

2478

# - `string` can be compared against all other types

2479

# - `boolean` can only be compared against other booleans

2480

# - `integer` can be compared against doubles or a string if the string value

2481

# can be parsed as an integer.

2482

# - `double` can be compared against integers or a string if the string can

2483

# be parsed as a double.

2484

# - `Timestamp` can be compared against strings in RFC 3339 date string

2485

# format.

2486

# - `TimeOfDay` can be compared against timestamps and strings in the format

2487

# of 'HH:mm:ss'.

2488

#

2489

# If we fail to compare do to type mismatch, a warning will be given and

2490

# the condition will evaluate to false.

2491

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

2492

# Note that for the purposes of inspection or transformation, the number

2493

# of bytes considered to comprise a 'Value' is based on its representation

2494

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2495

# 123456789, the number of bytes would be counted as 9, even though an

2496

# int64 only holds up to 8 bytes of data.

2497

"timestampValue": "A String", # timestamp

2498

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2499

# and time zone are either specified elsewhere or are not significant. The date

2500

# is relative to the Proleptic Gregorian Calendar. This can represent:

2501

#

2502

# * A full date, with non-zero year, month and day values

2503

# * A month and day value, with a zero year, e.g. an anniversary

2504

# * A year on its own, with zero month and day values

2505

# * A year and month value, with a zero day, e.g. a credit card expiration date

2506

#

2507

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2508

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2509

# a year.

2510

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2511

# month and day.

2512

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2513

# if specifying a year by itself or a year and month where the day is not

2514

# significant.

2515

},

2516

"stringValue": "A String", # string

2517

"integerValue": "A String", # integer

2518

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2519

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2520

# types are google.type.Date and `google.protobuf.Timestamp`.

2521

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2522

# to allow the value "24:00:00" for scenarios like business closing time.

2523

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2524

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2525

# allow the value 60 if it allows leap-seconds.

2526

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2527

},

2528

"booleanValue": True or False, # boolean

2529

"floatValue": 3.14, # float

2530

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2531

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2532

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

2533

"name": "A String", # Name describing the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2534

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2535

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2536

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2537

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2538

},

2539

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2540

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2541

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

],

},

},

"locationId": "A String", # The geographic location to process de-identification. Reserved for future

# extensions.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2556

2557

{ # Results of de-identifying a ContentItem.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2558

"overview": { # Overview of the modifications that occurred. # An overview of the changes that were made on the `item`.

2559

"transformationSummaries": [ # Transformations applied to the dataset.

2560

{ # Summary of a single transformation.

2561

# Only one of 'transformation', 'field_transformation', or 'record_suppress'

2562

# will be set.

2563

"fieldTransformations": [ # The field transformation that was applied.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2564

# If multiple field transformations are requested for a single field,

2565

# this list will contain all of them; otherwise, only one is supplied.

2566

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2567

"fields": [ # Required. Input field(s) to apply the transformation to.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2568

{ # General identifier of a data field in a storage service.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2569

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2570

},

2571

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2572

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2573

# transform content that matches an `InfoType`.

2574

# apply various `PrimitiveTransformation`s to each finding, where the

2575

# transformation is applied to only values that were identified as a specific

2576

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2577

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2578

# for a given infoType.

2579

{ # A transformation to apply to text that is identified as a specific

2580

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2581

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

2582

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

2583

# portion of the value.

2584

"partToExtract": "A String", # The part of the time to keep.

2585

},

2586

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

2587

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

2588

# to learn more.

2589

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

2590

# If set, must also set cryptoKey. If set, shift will be consistent for the

2591

# given context.

2592

"name": "A String", # Name describing the field.

2593

},

2594

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

2595

# range (inclusive ends). Negative means shift to earlier in time. Must not

2596

# be more than 365250 days (1000 years) each direction.

2597

#

2598

# For example, 3 means shift date to at most 3 days into the future.

2599

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

2600

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

2601

# results in the same shift for the same context and crypto_key. If

2602

# set, must also set context. Can only be applied to table items.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2603

# a key encryption key (KEK) stored by KMS).

2604

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2605

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2606

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2607

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2608

# leaking the key. Choose another type of key if possible.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2609

"key": "A String", # Required. A 128/192/256 bit key.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2610

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2611

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2612

# It will be discarded after the request finishes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2613

"name": "A String", # Required. Name of the key.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2614

# This is an arbitrary string used to differentiate different keys.

2615

# A unique key is generated per name: two separate `TransientCryptoKey`

2616

# protos share the same generated key if their names are the same.

2617

# When the data crypto key is generated, this name is not used in any way

2618

# (repeating the api call will result in a different key being generated).

2619

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2620

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2621

# The wrapped key must be a 128/192/256 bit key.

2622

# Authorization requires the following IAM permissions when sending a request

2623

# to perform a crypto transformation using a kms-wrapped crypto key:

2624

# dlp.kms.encrypt

2625

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2626

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2627

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2628

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2629

},

2630

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

2631

},

2632

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

2633

# Uses SHA-256.

2634

# The key size must be either 32 or 64 bytes.

2635

# Outputs a base64 encoded representation of the hashed output

2636

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

2637

# Currently, only string and integer values can be hashed.

2638

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

2639

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

2640

# a key encryption key (KEK) stored by KMS).

2641

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2642

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2643

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2644

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2645

# leaking the key. Choose another type of key if possible.

2646

"key": "A String", # Required. A 128/192/256 bit key.

2647

},

2648

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2649

# It will be discarded after the request finishes.

2650

"name": "A String", # Required. Name of the key.

2651

# This is an arbitrary string used to differentiate different keys.

2652

# A unique key is generated per name: two separate `TransientCryptoKey`

2653

# protos share the same generated key if their names are the same.

2654

# When the data crypto key is generated, this name is not used in any way

2655

# (repeating the api call will result in a different key being generated).

2656

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2657

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2658

# The wrapped key must be a 128/192/256 bit key.

2659

# Authorization requires the following IAM permissions when sending a request

2660

# to perform a crypto transformation using a kms-wrapped crypto key:

2661

# dlp.kms.encrypt

2662

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2663

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2664

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2665

},

2666

},

2667

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

2668

# (FPE) with the FFX mode of operation; however when used in the

2669

# `ReidentifyContent` API method, it serves the opposite function by reversing

2670

# the surrogate back into the original identifier. The identifier must be

2671

# encoded as ASCII. For a given crypto key and context, the same identifier

2672

# will be replaced with the same surrogate. Identifiers must be at least two

2673

# characters long. In the case that the identifier is the empty string, it will

2674

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

2675

# more.

2676

#

2677

# Note: We recommend using CryptoDeterministicConfig for all use cases which

2678

# do not require preserving the input alphabet space and size, plus warrant

2679

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2680

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

2681

# This annotation will be applied to the surrogate by prefixing it with

2682

# the name of the custom infoType followed by the number of

2683

# characters comprising the surrogate. The following scheme defines the

2684

# format: info_type_name(surrogate_character_count):surrogate

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2685

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2686

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

2687

# the surrogate is 'abc', the full replacement value

2688

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

2689

#

2690

# This annotation identifies the surrogate when inspecting content using the

2691

# custom infoType

2692

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

2693

# This facilitates reversal of the surrogate when it occurs in free text.

2694

#

2695

# In order for inspection to work properly, the name of this infoType must

2696

# not occur naturally anywhere in your data; otherwise, inspection may

2697

# find a surrogate that does not correspond to an actual identifier.

2698

# Therefore, choose your custom infoType name carefully after considering

2699

# what your data looks like. One way to select a name that has a high chance

2700

# of yielding reliable detection is to include one or more unicode characters

2701

# that are highly improbable to exist in your data.

2702

# For example, assuming your data is entered from a regular ASCII keyboard,

2703

# the symbol with the hex code point 29DD might be used like so:

2704

# ⧝MY_TOKEN_TYPE

2705

"name": "A String", # Name of the information type. Either a name of your choosing when

2706

# creating a CustomInfoType, or one of the names listed

2707

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2708

# a built-in type. InfoType names should conform to the pattern

2709

# `[a-zA-Z0-9_]{1,64}`.

2710

},

2711

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

2712

# identifier in two different contexts won't be given the same surrogate. If

2713

# the context is not set, a default tweak will be used.

2714

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2715

# If the context is set but:

2716

#

2717

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2718

# 1. the field is not present when transforming a given value,

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2719

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2720

# a default tweak will be used.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2721

#

2722

# Note that case (1) is expected when an `InfoTypeTransformation` is

2723

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2724

# Currently, the referenced field may be of value type integer or string.

2725

#

2726

# The tweak is constructed as a sequence of bytes in big endian byte order

2727

# such that:

2728

#

2729

# - a 64 bit integer is encoded followed by a single byte of value 1

2730

# - a string is encoded in UTF-8 format followed by a single byte of value 2

2731

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2732

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2733

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

2734

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

2735

# a key encryption key (KEK) stored by KMS).

2736

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2737

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2738

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2739

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2740

# leaking the key. Choose another type of key if possible.

2741

"key": "A String", # Required. A 128/192/256 bit key.

2742

},

2743

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2744

# It will be discarded after the request finishes.

2745

"name": "A String", # Required. Name of the key.

2746

# This is an arbitrary string used to differentiate different keys.

2747

# A unique key is generated per name: two separate `TransientCryptoKey`

2748

# protos share the same generated key if their names are the same.

2749

# When the data crypto key is generated, this name is not used in any way

2750

# (repeating the api call will result in a different key being generated).

2751

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2752

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2753

# The wrapped key must be a 128/192/256 bit key.

2754

# Authorization requires the following IAM permissions when sending a request

2755

# to perform a crypto transformation using a kms-wrapped crypto key:

2756

# dlp.kms.encrypt

2757

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2758

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2759

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2760

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2761

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

2762

# that the FFX mode natively supports. This happens before/after

2763

# encryption/decryption.

2764

# Each character listed must appear only once.

2765

# Number of characters must be in the range [2, 95].

2766

# This must be encoded as ASCII.

2767

# The order of characters does not matter.

2768

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2769

},

2770

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

2771

# input. Outputs a base64 encoded representation of the encrypted output.

2772

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

2773

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2774

# This annotation will be applied to the surrogate by prefixing it with

2775

# the name of the custom info type followed by the number of

2776

# characters comprising the surrogate. The following scheme defines the

2777

# format: {info type name}({surrogate character count}):{surrogate}

2778

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2779

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

2780

# the surrogate is 'abc', the full replacement value

2781

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2782

#

2783

# This annotation identifies the surrogate when inspecting content using the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2784

# custom info type 'Surrogate'. This facilitates reversal of the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2785

# surrogate when it occurs in free text.

2786

#

2787

# Note: For record transformations where the entire cell in a table is being

2788

# transformed, surrogates are not mandatory. Surrogates are used to denote

2789

# the location of the token and are necessary for re-identification in free

2790

# form text.

2791

#

2792

# In order for inspection to work properly, the name of this info type must

2793

# not occur naturally anywhere in your data; otherwise, inspection may either

2794

#

2795

# - reverse a surrogate that does not correspond to an actual identifier

2796

# - be unable to parse the surrogate and result in an error

2797

#

2798

# Therefore, choose your custom info type name carefully after considering

2799

# what your data looks like. One way to select a name that has a high chance

2800

# of yielding reliable detection is to include one or more unicode characters

2801

# that are highly improbable to exist in your data.

2802

# For example, assuming your data is entered from a regular ASCII keyboard,

2803

# the symbol with the hex code point 29DD might be used like so:

2804

# ⧝MY_TOKEN_TYPE.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2805

"name": "A String", # Name of the information type. Either a name of your choosing when

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2806

# creating a CustomInfoType, or one of the names listed

2807

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2808

# a built-in type. InfoType names should conform to the pattern

2809

# `[a-zA-Z0-9_]{1,64}`.

2810

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2811

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

2812

# referential integrity such that the same identifier in two different

2813

# contexts will be given a distinct surrogate. The context is appended to

2814

# plaintext value being encrypted. On decryption the provided context is

2815

# validated against the value used during encryption. If a context was

2816

# provided during encryption, same context must be provided during decryption

2817

# as well.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2818

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2819

# If the context is not set, plaintext would be used as is for encryption.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2820

# If the context is set but:

2821

#

2822

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2823

# 2. the field is not present when transforming a given value,

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2824

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2825

# plaintext would be used as is for encryption.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2826

#

2827

# Note that case (1) is expected when an `InfoTypeTransformation` is

2828

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2829

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2830

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2831

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

2832

# a key encryption key (KEK) stored by KMS).

2833

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2834

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2835

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2836

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2837

# leaking the key. Choose another type of key if possible.

2838

"key": "A String", # Required. A 128/192/256 bit key.

2839

},

2840

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2841

# It will be discarded after the request finishes.

2842

"name": "A String", # Required. Name of the key.

2843

# This is an arbitrary string used to differentiate different keys.

2844

# A unique key is generated per name: two separate `TransientCryptoKey`

2845

# protos share the same generated key if their names are the same.

2846

# When the data crypto key is generated, this name is not used in any way

2847

# (repeating the api call will result in a different key being generated).

2848

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2849

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2850

# The wrapped key must be a 128/192/256 bit key.

2851

# Authorization requires the following IAM permissions when sending a request

2852

# to perform a crypto transformation using a kms-wrapped crypto key:

2853

# dlp.kms.encrypt

2854

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2855

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2856

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2857

},

2858

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2859

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2860

# replacement values are dynamically provided by the user for custom behavior,

2861

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

2862

# This can be used on

2863

# data of type: number, long, string, timestamp.

2864

# If the bound `Value` type differs from the type of data being transformed, we

2865

# will first attempt converting the type of the data to be transformed to match

2866

# the type of the bound before comparing.

2867

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2868

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2869

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2870

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

2871

# the default behavior will be to hyphenate the min-max range.

2872

# Note that for the purposes of inspection or transformation, the number

2873

# of bytes considered to comprise a 'Value' is based on its representation

2874

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2875

# 123456789, the number of bytes would be counted as 9, even though an

2876

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2877

"timestampValue": "A String", # timestamp

2878

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2879

# and time zone are either specified elsewhere or are not significant. The date

2880

# is relative to the Proleptic Gregorian Calendar. This can represent:

2881

#

2882

# * A full date, with non-zero year, month and day values

2883

# * A month and day value, with a zero year, e.g. an anniversary

2884

# * A year on its own, with zero month and day values

2885

# * A year and month value, with a zero day, e.g. a credit card expiration date

2886

#

2887

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2888

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2889

# a year.

2890

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2891

# month and day.

2892

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2893

# if specifying a year by itself or a year and month where the day is not

2894

# significant.

2895

},

2896

"stringValue": "A String", # string

2897

"integerValue": "A String", # integer

2898

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2899

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2900

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2901

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2902

# to allow the value "24:00:00" for scenarios like business closing time.

2903

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2904

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2905

# allow the value 60 if it allows leap-seconds.

2906

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2907

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2908

"booleanValue": True or False, # boolean

2909

"floatValue": 3.14, # float

2910

"dayOfWeekValue": "A String", # day of week

2911

},

2912

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

2913

# used.

2914

# Note that for the purposes of inspection or transformation, the number

2915

# of bytes considered to comprise a 'Value' is based on its representation

2916

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2917

# 123456789, the number of bytes would be counted as 9, even though an

2918

# int64 only holds up to 8 bytes of data.

2919

"timestampValue": "A String", # timestamp

2920

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2921

# and time zone are either specified elsewhere or are not significant. The date

2922

# is relative to the Proleptic Gregorian Calendar. This can represent:

2923

#

2924

# * A full date, with non-zero year, month and day values

2925

# * A month and day value, with a zero year, e.g. an anniversary

2926

# * A year on its own, with zero month and day values

2927

# * A year and month value, with a zero day, e.g. a credit card expiration date

2928

#

2929

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2930

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2931

# a year.

2932

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2933

# month and day.

2934

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2935

# if specifying a year by itself or a year and month where the day is not

2936

# significant.

2937

},

2938

"stringValue": "A String", # string

2939

"integerValue": "A String", # integer

2940

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2941

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2942

# types are google.type.Date and `google.protobuf.Timestamp`.

2943

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2944

# to allow the value "24:00:00" for scenarios like business closing time.

2945

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2946

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2947

# allow the value 60 if it allows leap-seconds.

2948

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2949

},

2950

"booleanValue": True or False, # boolean

2951

"floatValue": 3.14, # float

2952

"dayOfWeekValue": "A String", # day of week

2953

},

2954

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

2955

# Note that for the purposes of inspection or transformation, the number

2956

# of bytes considered to comprise a 'Value' is based on its representation

2957

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2958

# 123456789, the number of bytes would be counted as 9, even though an

2959

# int64 only holds up to 8 bytes of data.

2960

"timestampValue": "A String", # timestamp

2961

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2962

# and time zone are either specified elsewhere or are not significant. The date

2963

# is relative to the Proleptic Gregorian Calendar. This can represent:

2964

#

2965

# * A full date, with non-zero year, month and day values

2966

# * A month and day value, with a zero year, e.g. an anniversary

2967

# * A year on its own, with zero month and day values

2968

# * A year and month value, with a zero day, e.g. a credit card expiration date

2969

#

2970

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2971

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2972

# a year.

2973

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2974

# month and day.

2975

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2976

# if specifying a year by itself or a year and month where the day is not

2977

# significant.

2978

},

2979

"stringValue": "A String", # string

2980

"integerValue": "A String", # integer

2981

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2982

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2983

# types are google.type.Date and `google.protobuf.Timestamp`.

2984

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2985

# to allow the value "24:00:00" for scenarios like business closing time.

2986

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2987

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2988

# allow the value 60 if it allows leap-seconds.

2989

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2990

},

2991

"booleanValue": True or False, # boolean

2992

"floatValue": 3.14, # float

2993

"dayOfWeekValue": "A String", # day of week

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

2998

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

2999

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

3000

# output would be 'My phone number is '.

3001

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3002

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3003

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3004

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3005

# of bytes considered to comprise a 'Value' is based on its representation

3006

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3007

# 123456789, the number of bytes would be counted as 9, even though an

3008

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3009

"timestampValue": "A String", # timestamp

3010

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3011

# and time zone are either specified elsewhere or are not significant. The date

3012

# is relative to the Proleptic Gregorian Calendar. This can represent:

3013

#

3014

# * A full date, with non-zero year, month and day values

3015

# * A month and day value, with a zero year, e.g. an anniversary

3016

# * A year on its own, with zero month and day values

3017

# * A year and month value, with a zero day, e.g. a credit card expiration date

3018

#

3019

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3020

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3021

# a year.

3022

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3023

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3024

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3025

# if specifying a year by itself or a year and month where the day is not

3026

# significant.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3027

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3028

"stringValue": "A String", # string

3029

"integerValue": "A String", # integer

3030

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3031

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3032

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3033

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3034

# to allow the value "24:00:00" for scenarios like business closing time.

3035

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3036

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3037

# allow the value 60 if it allows leap-seconds.

3038

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3039

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3040

"booleanValue": True or False, # boolean

3041

"floatValue": 3.14, # float

3042

"dayOfWeekValue": "A String", # day of week

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3043

},

3044

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3045

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

3046

# Bucketing transformation can provide all of this functionality,

3047

# but requires more configuration. This message is provided as a convenience to

3048

# the user for simple bucketing strategies.

3049

#

3050

# The transformed value will be a hyphenated string of

3051

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

3052

# all values that are within this bucket will be replaced with "10-20".

3053

#

3054

# This can be used on data of type: double, long.

3055

#

3056

# If the bound Value type differs from the type of data

3057

# being transformed, we will first attempt converting the type of the data to

3058

# be transformed to match the type of the bound before comparing.

3059

#

3060

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3061

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

3062

# grouped together into a single bucket; for example if `upper_bound` = 89,

3063

# then all values greater than 89 are replaced with the value "89+".

3064

# Note that for the purposes of inspection or transformation, the number

3065

# of bytes considered to comprise a 'Value' is based on its representation

3066

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3067

# 123456789, the number of bytes would be counted as 9, even though an

3068

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3069

"timestampValue": "A String", # timestamp

3070

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3071

# and time zone are either specified elsewhere or are not significant. The date

3072

# is relative to the Proleptic Gregorian Calendar. This can represent:

3073

#

3074

# * A full date, with non-zero year, month and day values

3075

# * A month and day value, with a zero year, e.g. an anniversary

3076

# * A year on its own, with zero month and day values

3077

# * A year and month value, with a zero day, e.g. a credit card expiration date

3078

#

3079

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3080

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3081

# a year.

3082

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3083

# month and day.

3084

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3085

# if specifying a year by itself or a year and month where the day is not

3086

# significant.

3087

},

3088

"stringValue": "A String", # string

3089

"integerValue": "A String", # integer

3090

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3091

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3092

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3093

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3094

# to allow the value "24:00:00" for scenarios like business closing time.

3095

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3096

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3097

# allow the value 60 if it allows leap-seconds.

3098

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3099

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3100

"booleanValue": True or False, # boolean

3101

"floatValue": 3.14, # float

3102

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3103

},

3104

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

3105

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

3106

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

3107

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3108

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

3109

# grouped together into a single bucket; for example if `lower_bound` = 10,

3110

# then all values less than 10 are replaced with the value "-10".

3111

# Note that for the purposes of inspection or transformation, the number

3112

# of bytes considered to comprise a 'Value' is based on its representation

3113

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3114

# 123456789, the number of bytes would be counted as 9, even though an

3115

# int64 only holds up to 8 bytes of data.

3116

"timestampValue": "A String", # timestamp

3117

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3118

# and time zone are either specified elsewhere or are not significant. The date

3119

# is relative to the Proleptic Gregorian Calendar. This can represent:

3120

#

3121

# * A full date, with non-zero year, month and day values

3122

# * A month and day value, with a zero year, e.g. an anniversary

3123

# * A year on its own, with zero month and day values

3124

# * A year and month value, with a zero day, e.g. a credit card expiration date

3125

#

3126

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3127

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3128

# a year.

3129

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3130

# month and day.

3131

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3132

# if specifying a year by itself or a year and month where the day is not

3133

# significant.

3134

},

3135

"stringValue": "A String", # string

3136

"integerValue": "A String", # integer

3137

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3138

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3139

# types are google.type.Date and `google.protobuf.Timestamp`.

3140

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3141

# to allow the value "24:00:00" for scenarios like business closing time.

3142

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3143

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3144

# allow the value 60 if it allows leap-seconds.

3145

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3146

},

3147

"booleanValue": True or False, # boolean

3148

"floatValue": 3.14, # float

3149

"dayOfWeekValue": "A String", # day of week

3150

},

3151

},

3152

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

3153

# fixed character. Masking can start from the beginning or end of the string.

3154

# This can be used on data of any type (numbers, longs, and so on) and when

3155

# de-identifying structured data we'll attempt to preserve the original data's

3156

# type. (This allows you to take a long like 123 and modify it to a string like

3157

# **3.

3158

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

3159

# characters. For example, if the input string is `555-555-5555` and you

3160

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

3161

# returns `***-**5-5555`.

3162

{ # Characters to skip when doing deidentification of a value. These will be left

3163

# alone and skipped.

3164

"charactersToSkip": "A String", # Characters to not transform when masking.

3165

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

3170

# masked. Skipped characters do not count towards this tally.

3171

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

3172

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

3173

# code or credit card number. This string must have a length of 1. If not

3174

# supplied, this value defaults to `*` for strings, and `0` for digits.

3175

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

3176

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

3177

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

3178

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

3179

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3180

},

3181

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3182

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

3183

# this transformation to apply to all findings that correspond to

3184

# infoTypes that were requested in `InspectConfig`.

3185

{ # Type of information detected by the API.

3186

"name": "A String", # Name of the information type. Either a name of your choosing when

3187

# creating a CustomInfoType, or one of the names listed

3188

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

3189

# a built-in type. InfoType names should conform to the pattern

3190

# `[a-zA-Z0-9_]{1,64}`.

3191

},

3192

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3193

},

3194

],

3195

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3196

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

3197

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

3198

# portion of the value.

3199

"partToExtract": "A String", # The part of the time to keep.

3200

},

3201

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

3202

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

3203

# to learn more.

3204

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

3205

# If set, must also set cryptoKey. If set, shift will be consistent for the

3206

# given context.

3207

"name": "A String", # Name describing the field.

3208

},

3209

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

3210

# range (inclusive ends). Negative means shift to earlier in time. Must not

3211

# be more than 365250 days (1000 years) each direction.

3212

#

3213

# For example, 3 means shift date to at most 3 days into the future.

3214

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3215

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

3216

# results in the same shift for the same context and crypto_key. If

3217

# set, must also set context. Can only be applied to table items.

3218

# a key encryption key (KEK) stored by KMS).

3219

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3220

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3221

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3222

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3223

# leaking the key. Choose another type of key if possible.

3224

"key": "A String", # Required. A 128/192/256 bit key.

3225

},

3226

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3227

# It will be discarded after the request finishes.

3228

"name": "A String", # Required. Name of the key.

3229

# This is an arbitrary string used to differentiate different keys.

3230

# A unique key is generated per name: two separate `TransientCryptoKey`

3231

# protos share the same generated key if their names are the same.

3232

# When the data crypto key is generated, this name is not used in any way

3233

# (repeating the api call will result in a different key being generated).

3234

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3235

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3236

# The wrapped key must be a 128/192/256 bit key.

3237

# Authorization requires the following IAM permissions when sending a request

3238

# to perform a crypto transformation using a kms-wrapped crypto key:

3239

# dlp.kms.encrypt

3240

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3241

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3242

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3243

},

3244

},

3245

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3246

},

3247

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

3248

# Uses SHA-256.

3249

# The key size must be either 32 or 64 bytes.

3250

# Outputs a base64 encoded representation of the hashed output

3251

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

3252

# Currently, only string and integer values can be hashed.

3253

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

3254

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

3255

# a key encryption key (KEK) stored by KMS).

3256

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3257

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3258

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3259

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3260

# leaking the key. Choose another type of key if possible.

3261

"key": "A String", # Required. A 128/192/256 bit key.

3262

},

3263

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3264

# It will be discarded after the request finishes.

3265

"name": "A String", # Required. Name of the key.

3266

# This is an arbitrary string used to differentiate different keys.

3267

# A unique key is generated per name: two separate `TransientCryptoKey`

3268

# protos share the same generated key if their names are the same.

3269

# When the data crypto key is generated, this name is not used in any way

3270

# (repeating the api call will result in a different key being generated).

3271

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3272

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3273

# The wrapped key must be a 128/192/256 bit key.

3274

# Authorization requires the following IAM permissions when sending a request

3275

# to perform a crypto transformation using a kms-wrapped crypto key:

3276

# dlp.kms.encrypt

3277

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3278

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3279

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3280

},

3281

},

3282

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

3283

# (FPE) with the FFX mode of operation; however when used in the

3284

# `ReidentifyContent` API method, it serves the opposite function by reversing

3285

# the surrogate back into the original identifier. The identifier must be

3286

# encoded as ASCII. For a given crypto key and context, the same identifier

3287

# will be replaced with the same surrogate. Identifiers must be at least two

3288

# characters long. In the case that the identifier is the empty string, it will

3289

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

3290

# more.

3291

#

3292

# Note: We recommend using CryptoDeterministicConfig for all use cases which

3293

# do not require preserving the input alphabet space and size, plus warrant

3294

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3295

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

3296

# This annotation will be applied to the surrogate by prefixing it with

3297

# the name of the custom infoType followed by the number of

3298

# characters comprising the surrogate. The following scheme defines the

3299

# format: info_type_name(surrogate_character_count):surrogate

3300

#

3301

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

3302

# the surrogate is 'abc', the full replacement value

3303

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

3304

#

3305

# This annotation identifies the surrogate when inspecting content using the

3306

# custom infoType

3307

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

3308

# This facilitates reversal of the surrogate when it occurs in free text.

3309

#

3310

# In order for inspection to work properly, the name of this infoType must

3311

# not occur naturally anywhere in your data; otherwise, inspection may

3312

# find a surrogate that does not correspond to an actual identifier.

3313

# Therefore, choose your custom infoType name carefully after considering

3314

# what your data looks like. One way to select a name that has a high chance

3315

# of yielding reliable detection is to include one or more unicode characters

3316

# that are highly improbable to exist in your data.

3317

# For example, assuming your data is entered from a regular ASCII keyboard,

3318

# the symbol with the hex code point 29DD might be used like so:

3319

# ⧝MY_TOKEN_TYPE

3320

"name": "A String", # Name of the information type. Either a name of your choosing when

3321

# creating a CustomInfoType, or one of the names listed

3322

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

3323

# a built-in type. InfoType names should conform to the pattern

3324

# `[a-zA-Z0-9_]{1,64}`.

3325

},

3326

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

3327

# identifier in two different contexts won't be given the same surrogate. If

3328

# the context is not set, a default tweak will be used.

3329

#

3330

# If the context is set but:

3331

#

3332

# 1. there is no record present when transforming a given value or

3333

# 1. the field is not present when transforming a given value,

3334

#

3335

# a default tweak will be used.

3336

#

3337

# Note that case (1) is expected when an `InfoTypeTransformation` is

3338

# applied to both structured and non-structured `ContentItem`s.

3339

# Currently, the referenced field may be of value type integer or string.

3340

#

3341

# The tweak is constructed as a sequence of bytes in big endian byte order

3342

# such that:

3343

#

3344

# - a 64 bit integer is encoded followed by a single byte of value 1

3345

# - a string is encoded in UTF-8 format followed by a single byte of value 2

3346

"name": "A String", # Name describing the field.

3347

},

3348

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

3349

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

3350

# a key encryption key (KEK) stored by KMS).

3351

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3352

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3353

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3354

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3355

# leaking the key. Choose another type of key if possible.

3356

"key": "A String", # Required. A 128/192/256 bit key.

3357

},

3358

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3359

# It will be discarded after the request finishes.

3360

"name": "A String", # Required. Name of the key.

3361

# This is an arbitrary string used to differentiate different keys.

3362

# A unique key is generated per name: two separate `TransientCryptoKey`

3363

# protos share the same generated key if their names are the same.

3364

# When the data crypto key is generated, this name is not used in any way

3365

# (repeating the api call will result in a different key being generated).

3366

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3367

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3368

# The wrapped key must be a 128/192/256 bit key.

3369

# Authorization requires the following IAM permissions when sending a request

3370

# to perform a crypto transformation using a kms-wrapped crypto key:

3371

# dlp.kms.encrypt

3372

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3373

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3374

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3375

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3376

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

3377

# that the FFX mode natively supports. This happens before/after

3378

# encryption/decryption.

3379

# Each character listed must appear only once.

3380

# Number of characters must be in the range [2, 95].

3381

# This must be encoded as ASCII.

3382

# The order of characters does not matter.

3383

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3384

},

3385

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

3386

# input. Outputs a base64 encoded representation of the encrypted output.

3387

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

3388

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

3389

# This annotation will be applied to the surrogate by prefixing it with

3390

# the name of the custom info type followed by the number of

3391

# characters comprising the surrogate. The following scheme defines the

3392

# format: {info type name}({surrogate character count}):{surrogate}

3393

#

3394

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

3395

# the surrogate is 'abc', the full replacement value

3396

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

3397

#

3398

# This annotation identifies the surrogate when inspecting content using the

3399

# custom info type 'Surrogate'. This facilitates reversal of the

3400

# surrogate when it occurs in free text.

3401

#

3402

# Note: For record transformations where the entire cell in a table is being

3403

# transformed, surrogates are not mandatory. Surrogates are used to denote

3404

# the location of the token and are necessary for re-identification in free

3405

# form text.

3406

#

3407

# In order for inspection to work properly, the name of this info type must

3408

# not occur naturally anywhere in your data; otherwise, inspection may either

3409

#

3410

# - reverse a surrogate that does not correspond to an actual identifier

3411

# - be unable to parse the surrogate and result in an error

3412

#

3413

# Therefore, choose your custom info type name carefully after considering

3414

# what your data looks like. One way to select a name that has a high chance

3415

# of yielding reliable detection is to include one or more unicode characters

3416

# that are highly improbable to exist in your data.

3417

# For example, assuming your data is entered from a regular ASCII keyboard,

3418

# the symbol with the hex code point 29DD might be used like so:

3419

# ⧝MY_TOKEN_TYPE.

3420

"name": "A String", # Name of the information type. Either a name of your choosing when

3421

# creating a CustomInfoType, or one of the names listed

3422

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

3423

# a built-in type. InfoType names should conform to the pattern

3424

# `[a-zA-Z0-9_]{1,64}`.

3425

},

3426

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

3427

# referential integrity such that the same identifier in two different

3428

# contexts will be given a distinct surrogate. The context is appended to

3429

# plaintext value being encrypted. On decryption the provided context is

3430

# validated against the value used during encryption. If a context was

3431

# provided during encryption, same context must be provided during decryption

3432

# as well.

3433

#

3434

# If the context is not set, plaintext would be used as is for encryption.

3435

# If the context is set but:

3436

#

3437

# 1. there is no record present when transforming a given value or

3438

# 2. the field is not present when transforming a given value,

3439

#

3440

# plaintext would be used as is for encryption.

3441

#

3442

# Note that case (1) is expected when an `InfoTypeTransformation` is

3443

# applied to both structured and non-structured `ContentItem`s.

3444

"name": "A String", # Name describing the field.

3445

},

3446

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

3447

# a key encryption key (KEK) stored by KMS).

3448

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3449

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3450

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3451

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3452

# leaking the key. Choose another type of key if possible.

3453

"key": "A String", # Required. A 128/192/256 bit key.

3454

},

3455

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3456

# It will be discarded after the request finishes.

3457

"name": "A String", # Required. Name of the key.

3458

# This is an arbitrary string used to differentiate different keys.

3459

# A unique key is generated per name: two separate `TransientCryptoKey`

3460

# protos share the same generated key if their names are the same.

3461

# When the data crypto key is generated, this name is not used in any way

3462

# (repeating the api call will result in a different key being generated).

3463

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3464

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3465

# The wrapped key must be a 128/192/256 bit key.

3466

# Authorization requires the following IAM permissions when sending a request

3467

# to perform a crypto transformation using a kms-wrapped crypto key:

3468

# dlp.kms.encrypt

3469

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3470

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3471

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3472

},

3473

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3474

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

3475

# replacement values are dynamically provided by the user for custom behavior,

3476

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

3477

# This can be used on

3478

# data of type: number, long, string, timestamp.

3479

# If the bound `Value` type differs from the type of data being transformed, we

3480

# will first attempt converting the type of the data to be transformed to match

3481

# the type of the bound before comparing.

3482

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

3483

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

3484

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3485

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

3486

# the default behavior will be to hyphenate the min-max range.

3487

# Note that for the purposes of inspection or transformation, the number

3488

# of bytes considered to comprise a 'Value' is based on its representation

3489

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3490

# 123456789, the number of bytes would be counted as 9, even though an

3491

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3492

"timestampValue": "A String", # timestamp

3493

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3494

# and time zone are either specified elsewhere or are not significant. The date

3495

# is relative to the Proleptic Gregorian Calendar. This can represent:

3496

#

3497

# * A full date, with non-zero year, month and day values

3498

# * A month and day value, with a zero year, e.g. an anniversary

3499

# * A year on its own, with zero month and day values

3500

# * A year and month value, with a zero day, e.g. a credit card expiration date

3501

#

3502

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3503

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3504

# a year.

3505

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3506

# month and day.

3507

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3508

# if specifying a year by itself or a year and month where the day is not

3509

# significant.

3510

},

3511

"stringValue": "A String", # string

3512

"integerValue": "A String", # integer

3513

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3514

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3515

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3516

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3517

# to allow the value "24:00:00" for scenarios like business closing time.

3518

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3519

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3520

# allow the value 60 if it allows leap-seconds.

3521

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3522

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3523

"booleanValue": True or False, # boolean

3524

"floatValue": 3.14, # float

3525

"dayOfWeekValue": "A String", # day of week

3526

},

3527

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

3528

# used.

3529

# Note that for the purposes of inspection or transformation, the number

3530

# of bytes considered to comprise a 'Value' is based on its representation

3531

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3532

# 123456789, the number of bytes would be counted as 9, even though an

3533

# int64 only holds up to 8 bytes of data.

3534

"timestampValue": "A String", # timestamp

3535

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3536

# and time zone are either specified elsewhere or are not significant. The date

3537

# is relative to the Proleptic Gregorian Calendar. This can represent:

3538

#

3539

# * A full date, with non-zero year, month and day values

3540

# * A month and day value, with a zero year, e.g. an anniversary

3541

# * A year on its own, with zero month and day values

3542

# * A year and month value, with a zero day, e.g. a credit card expiration date

3543

#

3544

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3545

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3546

# a year.

3547

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3548

# month and day.

3549

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3550

# if specifying a year by itself or a year and month where the day is not

3551

# significant.

3552

},

3553

"stringValue": "A String", # string

3554

"integerValue": "A String", # integer

3555

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3556

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3557

# types are google.type.Date and `google.protobuf.Timestamp`.

3558

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3559

# to allow the value "24:00:00" for scenarios like business closing time.

3560

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3561

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3562

# allow the value 60 if it allows leap-seconds.

3563

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3564

},

3565

"booleanValue": True or False, # boolean

3566

"floatValue": 3.14, # float

3567

"dayOfWeekValue": "A String", # day of week

3568

},

3569

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

3570

# Note that for the purposes of inspection or transformation, the number

3571

# of bytes considered to comprise a 'Value' is based on its representation

3572

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3573

# 123456789, the number of bytes would be counted as 9, even though an

3574

# int64 only holds up to 8 bytes of data.

3575

"timestampValue": "A String", # timestamp

3576

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3577

# and time zone are either specified elsewhere or are not significant. The date

3578

# is relative to the Proleptic Gregorian Calendar. This can represent:

3579

#

3580

# * A full date, with non-zero year, month and day values

3581

# * A month and day value, with a zero year, e.g. an anniversary

3582

# * A year on its own, with zero month and day values

3583

# * A year and month value, with a zero day, e.g. a credit card expiration date

3584

#

3585

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3586

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3587

# a year.

3588

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3589

# month and day.

3590

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3591

# if specifying a year by itself or a year and month where the day is not

3592

# significant.

3593

},

3594

"stringValue": "A String", # string

3595

"integerValue": "A String", # integer

3596

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3597

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3598

# types are google.type.Date and `google.protobuf.Timestamp`.

3599

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3600

# to allow the value "24:00:00" for scenarios like business closing time.

3601

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3602

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3603

# allow the value 60 if it allows leap-seconds.

3604

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3605

},

3606

"booleanValue": True or False, # boolean

3607

"floatValue": 3.14, # float

3608

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3613

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

3614

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

3615

# output would be 'My phone number is '.

3616

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3617

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3618

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

3619

# Note that for the purposes of inspection or transformation, the number

3620

# of bytes considered to comprise a 'Value' is based on its representation

3621

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3622

# 123456789, the number of bytes would be counted as 9, even though an

3623

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3624

"timestampValue": "A String", # timestamp

3625

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3626

# and time zone are either specified elsewhere or are not significant. The date

3627

# is relative to the Proleptic Gregorian Calendar. This can represent:

3628

#

3629

# * A full date, with non-zero year, month and day values

3630

# * A month and day value, with a zero year, e.g. an anniversary

3631

# * A year on its own, with zero month and day values

3632

# * A year and month value, with a zero day, e.g. a credit card expiration date

3633

#

3634

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3635

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3636

# a year.

3637

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3638

# month and day.

3639

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3640

# if specifying a year by itself or a year and month where the day is not

3641

# significant.

3642

},

3643

"stringValue": "A String", # string

3644

"integerValue": "A String", # integer

3645

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3646

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3647

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3648

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3649

# to allow the value "24:00:00" for scenarios like business closing time.

3650

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3651

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3652

# allow the value 60 if it allows leap-seconds.

3653

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3654

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3655

"booleanValue": True or False, # boolean

3656

"floatValue": 3.14, # float

3657

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3658

},

3659

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3660

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

3661

# Bucketing transformation can provide all of this functionality,

3662

# but requires more configuration. This message is provided as a convenience to

3663

# the user for simple bucketing strategies.

3664

#

3665

# The transformed value will be a hyphenated string of

3666

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

3667

# all values that are within this bucket will be replaced with "10-20".

3668

#

3669

# This can be used on data of type: double, long.

3670

#

3671

# If the bound Value type differs from the type of data

3672

# being transformed, we will first attempt converting the type of the data to

3673

# be transformed to match the type of the bound before comparing.

3674

#

3675

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3676

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

3677

# grouped together into a single bucket; for example if `upper_bound` = 89,

3678

# then all values greater than 89 are replaced with the value "89+".

3679

# Note that for the purposes of inspection or transformation, the number

3680

# of bytes considered to comprise a 'Value' is based on its representation

3681

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3682

# 123456789, the number of bytes would be counted as 9, even though an

3683

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3684

"timestampValue": "A String", # timestamp

3685

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3686

# and time zone are either specified elsewhere or are not significant. The date

3687

# is relative to the Proleptic Gregorian Calendar. This can represent:

3688

#

3689

# * A full date, with non-zero year, month and day values

3690

# * A month and day value, with a zero year, e.g. an anniversary

3691

# * A year on its own, with zero month and day values

3692

# * A year and month value, with a zero day, e.g. a credit card expiration date

3693

#

3694

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3695

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3696

# a year.

3697

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3698

# month and day.

3699

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3700

# if specifying a year by itself or a year and month where the day is not

3701

# significant.

3702

},

3703

"stringValue": "A String", # string

3704

"integerValue": "A String", # integer

3705

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3706

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3707

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3708

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3709

# to allow the value "24:00:00" for scenarios like business closing time.

3710

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3711

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3712

# allow the value 60 if it allows leap-seconds.

3713

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3714

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3715

"booleanValue": True or False, # boolean

3716

"floatValue": 3.14, # float

3717

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3718

},

3719

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

3720

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

3721

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

3722

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3723

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

3724

# grouped together into a single bucket; for example if `lower_bound` = 10,

3725

# then all values less than 10 are replaced with the value "-10".

3726

# Note that for the purposes of inspection or transformation, the number

3727

# of bytes considered to comprise a 'Value' is based on its representation

3728

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3729

# 123456789, the number of bytes would be counted as 9, even though an

3730

# int64 only holds up to 8 bytes of data.

3731

"timestampValue": "A String", # timestamp

3732

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3733

# and time zone are either specified elsewhere or are not significant. The date

3734

# is relative to the Proleptic Gregorian Calendar. This can represent:

3735

#

3736

# * A full date, with non-zero year, month and day values

3737

# * A month and day value, with a zero year, e.g. an anniversary

3738

# * A year on its own, with zero month and day values

3739

# * A year and month value, with a zero day, e.g. a credit card expiration date

3740

#

3741

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3742

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3743

# a year.

3744

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3745

# month and day.

3746

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3747

# if specifying a year by itself or a year and month where the day is not

3748

# significant.

3749

},

3750

"stringValue": "A String", # string

3751

"integerValue": "A String", # integer

3752

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3753

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3754

# types are google.type.Date and `google.protobuf.Timestamp`.

3755

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3756

# to allow the value "24:00:00" for scenarios like business closing time.

3757

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3758

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3759

# allow the value 60 if it allows leap-seconds.

3760

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3761

},

3762

"booleanValue": True or False, # boolean

3763

"floatValue": 3.14, # float

3764

"dayOfWeekValue": "A String", # day of week

3765

},

3766

},

3767

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

3768

# fixed character. Masking can start from the beginning or end of the string.

3769

# This can be used on data of any type (numbers, longs, and so on) and when

3770

# de-identifying structured data we'll attempt to preserve the original data's

3771

# type. (This allows you to take a long like 123 and modify it to a string like

3772

# **3.

3773

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

3774

# characters. For example, if the input string is `555-555-5555` and you

3775

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

3776

# returns `***-**5-5555`.

3777

{ # Characters to skip when doing deidentification of a value. These will be left

3778

# alone and skipped.

3779

"charactersToSkip": "A String", # Characters to not transform when masking.

3780

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

3785

# masked. Skipped characters do not count towards this tally.

3786

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

3787

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

3788

# code or credit card number. This string must have a length of 1. If not

3789

# supplied, this value defaults to `*` for strings, and `0` for digits.

3790

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

3791

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

3792

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

3793

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

3794

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3795

},

3796

},

3797

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

3798

# given `RecordCondition`. The conditions are allowed to reference fields

3799

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

3804

# column for the same record is within a specific range.

3805

# - Redact a field if the date of birth field is greater than 85.

3806

# a field.

3807

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

3808

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

3809

# only supported value is `AND`.

3810

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

3811

"conditions": [ # A collection of conditions.

3812

{ # The field type of `value` and `field` do not need to match to be

3813

# considered equal, but not all comparisons are possible.

3814

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

3815

# but all other comparisons are invalid with incompatible types.

3816

# A `value` of type:

3817

#

3818

# - `string` can be compared against all other types

3819

# - `boolean` can only be compared against other booleans

3820

# - `integer` can be compared against doubles or a string if the string value

3821

# can be parsed as an integer.

3822

# - `double` can be compared against integers or a string if the string can

3823

# be parsed as a double.

3824

# - `Timestamp` can be compared against strings in RFC 3339 date string

3825

# format.

3826

# - `TimeOfDay` can be compared against timestamps and strings in the format

3827

# of 'HH:mm:ss'.

3828

#

3829

# If we fail to compare do to type mismatch, a warning will be given and

3830

# the condition will evaluate to false.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3831

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

3832

# Note that for the purposes of inspection or transformation, the number

3833

# of bytes considered to comprise a 'Value' is based on its representation

3834

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3835

# 123456789, the number of bytes would be counted as 9, even though an

3836

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3837

"timestampValue": "A String", # timestamp

3838

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3839

# and time zone are either specified elsewhere or are not significant. The date

3840

# is relative to the Proleptic Gregorian Calendar. This can represent:

3841

#

3842

# * A full date, with non-zero year, month and day values

3843

# * A month and day value, with a zero year, e.g. an anniversary

3844

# * A year on its own, with zero month and day values

3845

# * A year and month value, with a zero day, e.g. a credit card expiration date

3846

#

3847

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3848

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3849

# a year.

3850

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3851

# month and day.

3852

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3853

# if specifying a year by itself or a year and month where the day is not

3854

# significant.

3855

},

3856

"stringValue": "A String", # string

3857

"integerValue": "A String", # integer

3858

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3859

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3860

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3861

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3862

# to allow the value "24:00:00" for scenarios like business closing time.

3863

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3864

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3865

# allow the value 60 if it allows leap-seconds.

3866

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3867

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3868

"booleanValue": True or False, # boolean

3869

"floatValue": 3.14, # float

3870

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3871

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3872

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

3873

"name": "A String", # Name describing the field.

3874

},

3875

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3881

},

3882

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3883

"transformation": { # A rule for transforming a value. # The specific transformation these stats apply to.

3884

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

3885

# portion of the value.

3886

"partToExtract": "A String", # The part of the time to keep.

3887

},

3888

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

3889

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

3890

# to learn more.

3891

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

3892

# If set, must also set cryptoKey. If set, shift will be consistent for the

3893

# given context.

3894

"name": "A String", # Name describing the field.

3895

},

3896

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

3897

# range (inclusive ends). Negative means shift to earlier in time. Must not

3898

# be more than 365250 days (1000 years) each direction.

3899

#

3900

# For example, 3 means shift date to at most 3 days into the future.

3901

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3902

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

3903

# results in the same shift for the same context and crypto_key. If

3904

# set, must also set context. Can only be applied to table items.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3905

# a key encryption key (KEK) stored by KMS).

3906

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3907

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3908

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3909

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3910

# leaking the key. Choose another type of key if possible.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3911

"key": "A String", # Required. A 128/192/256 bit key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3912

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3913

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3914

# It will be discarded after the request finishes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3915

"name": "A String", # Required. Name of the key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3916

# This is an arbitrary string used to differentiate different keys.

3917

# A unique key is generated per name: two separate `TransientCryptoKey`

3918

# protos share the same generated key if their names are the same.

3919

# When the data crypto key is generated, this name is not used in any way

3920

# (repeating the api call will result in a different key being generated).

3921

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3922

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3923

# The wrapped key must be a 128/192/256 bit key.

3924

# Authorization requires the following IAM permissions when sending a request

3925

# to perform a crypto transformation using a kms-wrapped crypto key:

3926

# dlp.kms.encrypt

3927

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3928

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3929

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3930

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3931

},

3932

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3933

},

3934

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

3935

# Uses SHA-256.

3936

# The key size must be either 32 or 64 bytes.

3937

# Outputs a base64 encoded representation of the hashed output

3938

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

3939

# Currently, only string and integer values can be hashed.

3940

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

3941

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

3942

# a key encryption key (KEK) stored by KMS).

3943

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3944

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3945

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3946

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3947

# leaking the key. Choose another type of key if possible.

3948

"key": "A String", # Required. A 128/192/256 bit key.

3949

},

3950

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3951

# It will be discarded after the request finishes.

3952

"name": "A String", # Required. Name of the key.

3953

# This is an arbitrary string used to differentiate different keys.

3954

# A unique key is generated per name: two separate `TransientCryptoKey`

3955

# protos share the same generated key if their names are the same.

3956

# When the data crypto key is generated, this name is not used in any way

3957

# (repeating the api call will result in a different key being generated).

3958

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

3959

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3960

# The wrapped key must be a 128/192/256 bit key.

3961

# Authorization requires the following IAM permissions when sending a request

3962

# to perform a crypto transformation using a kms-wrapped crypto key:

3963

# dlp.kms.encrypt

3964

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3965

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3966

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3967

},

3968

},

3969

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

3970

# (FPE) with the FFX mode of operation; however when used in the

3971

# `ReidentifyContent` API method, it serves the opposite function by reversing

3972

# the surrogate back into the original identifier. The identifier must be

3973

# encoded as ASCII. For a given crypto key and context, the same identifier

3974

# will be replaced with the same surrogate. Identifiers must be at least two

3975

# characters long. In the case that the identifier is the empty string, it will

3976

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

3977

# more.

3978

#

3979

# Note: We recommend using CryptoDeterministicConfig for all use cases which

3980

# do not require preserving the input alphabet space and size, plus warrant

3981

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3982

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

3983

# This annotation will be applied to the surrogate by prefixing it with

3984

# the name of the custom infoType followed by the number of

3985

# characters comprising the surrogate. The following scheme defines the

3986

# format: info_type_name(surrogate_character_count):surrogate

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3987

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3988

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

3989

# the surrogate is 'abc', the full replacement value

3990

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

3991

#

3992

# This annotation identifies the surrogate when inspecting content using the

3993

# custom infoType

3994

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

3995

# This facilitates reversal of the surrogate when it occurs in free text.

3996

#

3997

# In order for inspection to work properly, the name of this infoType must

3998

# not occur naturally anywhere in your data; otherwise, inspection may

3999

# find a surrogate that does not correspond to an actual identifier.

4000

# Therefore, choose your custom infoType name carefully after considering

4001

# what your data looks like. One way to select a name that has a high chance

4002

# of yielding reliable detection is to include one or more unicode characters

4003

# that are highly improbable to exist in your data.

4004

# For example, assuming your data is entered from a regular ASCII keyboard,

4005

# the symbol with the hex code point 29DD might be used like so:

4006

# ⧝MY_TOKEN_TYPE

4007

"name": "A String", # Name of the information type. Either a name of your choosing when

4008

# creating a CustomInfoType, or one of the names listed

4009

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4010

# a built-in type. InfoType names should conform to the pattern

4011

# `[a-zA-Z0-9_]{1,64}`.

4012

},

4013

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

4014

# identifier in two different contexts won't be given the same surrogate. If

4015

# the context is not set, a default tweak will be used.

4016

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4017

# If the context is set but:

4018

#

4019

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4020

# 1. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4021

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4022

# a default tweak will be used.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4023

#

4024

# Note that case (1) is expected when an `InfoTypeTransformation` is

4025

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4026

# Currently, the referenced field may be of value type integer or string.

4027

#

4028

# The tweak is constructed as a sequence of bytes in big endian byte order

4029

# such that:

4030

#

4031

# - a 64 bit integer is encoded followed by a single byte of value 1

4032

# - a string is encoded in UTF-8 format followed by a single byte of value 2

4033

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4034

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4035

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

4036

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

4037

# a key encryption key (KEK) stored by KMS).

4038

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

4039

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

4040

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4041

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

4042

# leaking the key. Choose another type of key if possible.

4043

"key": "A String", # Required. A 128/192/256 bit key.

4044

},

4045

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

4046

# It will be discarded after the request finishes.

4047

"name": "A String", # Required. Name of the key.

4048

# This is an arbitrary string used to differentiate different keys.

4049

# A unique key is generated per name: two separate `TransientCryptoKey`

4050

# protos share the same generated key if their names are the same.

4051

# When the data crypto key is generated, this name is not used in any way

4052

# (repeating the api call will result in a different key being generated).

4053

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4054

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

4055

# The wrapped key must be a 128/192/256 bit key.

4056

# Authorization requires the following IAM permissions when sending a request

4057

# to perform a crypto transformation using a kms-wrapped crypto key:

4058

# dlp.kms.encrypt

4059

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4060

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4061

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4062

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4063

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

4064

# that the FFX mode natively supports. This happens before/after

4065

# encryption/decryption.

4066

# Each character listed must appear only once.

4067

# Number of characters must be in the range [2, 95].

4068

# This must be encoded as ASCII.

4069

# The order of characters does not matter.

4070

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4071

},

4072

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

4073

# input. Outputs a base64 encoded representation of the encrypted output.

4074

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

4075

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4076

# This annotation will be applied to the surrogate by prefixing it with

4077

# the name of the custom info type followed by the number of

4078

# characters comprising the surrogate. The following scheme defines the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4079

# format: {info type name}({surrogate character count}):{surrogate}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4080

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4081

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

4082

# the surrogate is 'abc', the full replacement value

4083

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4084

#

4085

# This annotation identifies the surrogate when inspecting content using the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4086

# custom info type 'Surrogate'. This facilitates reversal of the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4087

# surrogate when it occurs in free text.

4088

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4089

# Note: For record transformations where the entire cell in a table is being

4090

# transformed, surrogates are not mandatory. Surrogates are used to denote

4091

# the location of the token and are necessary for re-identification in free

4092

# form text.

4093

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4094

# In order for inspection to work properly, the name of this info type must

4095

# not occur naturally anywhere in your data; otherwise, inspection may either

4096

#

4097

# - reverse a surrogate that does not correspond to an actual identifier

4098

# - be unable to parse the surrogate and result in an error

4099

#

4100

# Therefore, choose your custom info type name carefully after considering

4101

# what your data looks like. One way to select a name that has a high chance

4102

# of yielding reliable detection is to include one or more unicode characters

4103

# that are highly improbable to exist in your data.

4104

# For example, assuming your data is entered from a regular ASCII keyboard,

4105

# the symbol with the hex code point 29DD might be used like so:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4106

# ⧝MY_TOKEN_TYPE.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4107

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4108

# creating a CustomInfoType, or one of the names listed

4109

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4110

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4111

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4112

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4113

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

4114

# referential integrity such that the same identifier in two different

4115

# contexts will be given a distinct surrogate. The context is appended to

4116

# plaintext value being encrypted. On decryption the provided context is

4117

# validated against the value used during encryption. If a context was

4118

# provided during encryption, same context must be provided during decryption

4119

# as well.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4120

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4121

# If the context is not set, plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4122

# If the context is set but:

4123

#

4124

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4125

# 2. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4126

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4127

# plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4128

#

4129

# Note that case (1) is expected when an `InfoTypeTransformation` is

4130

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4131

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4132

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4133

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

4134

# a key encryption key (KEK) stored by KMS).

4135

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

4136

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

4137

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4138

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

4139

# leaking the key. Choose another type of key if possible.

4140

"key": "A String", # Required. A 128/192/256 bit key.

4141

},

4142

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

4143

# It will be discarded after the request finishes.

4144

"name": "A String", # Required. Name of the key.

4145

# This is an arbitrary string used to differentiate different keys.

4146

# A unique key is generated per name: two separate `TransientCryptoKey`

4147

# protos share the same generated key if their names are the same.

4148

# When the data crypto key is generated, this name is not used in any way

4149

# (repeating the api call will result in a different key being generated).

4150

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4151

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

4152

# The wrapped key must be a 128/192/256 bit key.

4153

# Authorization requires the following IAM permissions when sending a request

4154

# to perform a crypto transformation using a kms-wrapped crypto key:

4155

# dlp.kms.encrypt

4156

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4157

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4158

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4159

},

4160

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4161

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4162

# replacement values are dynamically provided by the user for custom behavior,

4163

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

4164

# This can be used on

4165

# data of type: number, long, string, timestamp.

4166

# If the bound `Value` type differs from the type of data being transformed, we

4167

# will first attempt converting the type of the data to be transformed to match

4168

# the type of the bound before comparing.

4169

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4170

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4171

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4172

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

4173

# the default behavior will be to hyphenate the min-max range.

4174

# Note that for the purposes of inspection or transformation, the number

4175

# of bytes considered to comprise a 'Value' is based on its representation

4176

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4177

# 123456789, the number of bytes would be counted as 9, even though an

4178

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4179

"timestampValue": "A String", # timestamp

4180

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4181

# and time zone are either specified elsewhere or are not significant. The date

4182

# is relative to the Proleptic Gregorian Calendar. This can represent:

4183

#

4184

# * A full date, with non-zero year, month and day values

4185

# * A month and day value, with a zero year, e.g. an anniversary

4186

# * A year on its own, with zero month and day values

4187

# * A year and month value, with a zero day, e.g. a credit card expiration date

4188

#

4189

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4190

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4191

# a year.

4192

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4193

# month and day.

4194

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4195

# if specifying a year by itself or a year and month where the day is not

4196

# significant.

4197

},

4198

"stringValue": "A String", # string

4199

"integerValue": "A String", # integer

4200

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4201

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4202

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4203

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4204

# to allow the value "24:00:00" for scenarios like business closing time.

4205

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4206

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4207

# allow the value 60 if it allows leap-seconds.

4208

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4209

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4210

"booleanValue": True or False, # boolean

4211

"floatValue": 3.14, # float

4212

"dayOfWeekValue": "A String", # day of week

4213

},

4214

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

4215

# used.

4216

# Note that for the purposes of inspection or transformation, the number

4217

# of bytes considered to comprise a 'Value' is based on its representation

4218

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4219

# 123456789, the number of bytes would be counted as 9, even though an

4220

# int64 only holds up to 8 bytes of data.

4221

"timestampValue": "A String", # timestamp

4222

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4223

# and time zone are either specified elsewhere or are not significant. The date

4224

# is relative to the Proleptic Gregorian Calendar. This can represent:

4225

#

4226

# * A full date, with non-zero year, month and day values

4227

# * A month and day value, with a zero year, e.g. an anniversary

4228

# * A year on its own, with zero month and day values

4229

# * A year and month value, with a zero day, e.g. a credit card expiration date

4230

#

4231

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4232

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4233

# a year.

4234

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4235

# month and day.

4236

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4237

# if specifying a year by itself or a year and month where the day is not

4238

# significant.

4239

},

4240

"stringValue": "A String", # string

4241

"integerValue": "A String", # integer

4242

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4243

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4244

# types are google.type.Date and `google.protobuf.Timestamp`.

4245

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4246

# to allow the value "24:00:00" for scenarios like business closing time.

4247

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4248

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4249

# allow the value 60 if it allows leap-seconds.

4250

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4251

},

4252

"booleanValue": True or False, # boolean

4253

"floatValue": 3.14, # float

4254

"dayOfWeekValue": "A String", # day of week

4255

},

4256

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

4257

# Note that for the purposes of inspection or transformation, the number

4258

# of bytes considered to comprise a 'Value' is based on its representation

4259

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4260

# 123456789, the number of bytes would be counted as 9, even though an

4261

# int64 only holds up to 8 bytes of data.

4262

"timestampValue": "A String", # timestamp

4263

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4264

# and time zone are either specified elsewhere or are not significant. The date

4265

# is relative to the Proleptic Gregorian Calendar. This can represent:

4266

#

4267

# * A full date, with non-zero year, month and day values

4268

# * A month and day value, with a zero year, e.g. an anniversary

4269

# * A year on its own, with zero month and day values

4270

# * A year and month value, with a zero day, e.g. a credit card expiration date

4271

#

4272

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4273

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4274

# a year.

4275

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4276

# month and day.

4277

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4278

# if specifying a year by itself or a year and month where the day is not

4279

# significant.

4280

},

4281

"stringValue": "A String", # string

4282

"integerValue": "A String", # integer

4283

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4284

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4285

# types are google.type.Date and `google.protobuf.Timestamp`.

4286

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4287

# to allow the value "24:00:00" for scenarios like business closing time.

4288

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4289

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4290

# allow the value 60 if it allows leap-seconds.

4291

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4292

},

4293

"booleanValue": True or False, # boolean

4294

"floatValue": 3.14, # float

4295

"dayOfWeekValue": "A String", # day of week

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4300

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

4301

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

4302

# output would be 'My phone number is '.

4303

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4304

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

4305

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4306

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4307

# of bytes considered to comprise a 'Value' is based on its representation

4308

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4309

# 123456789, the number of bytes would be counted as 9, even though an

4310

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4311

"timestampValue": "A String", # timestamp

4312

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4313

# and time zone are either specified elsewhere or are not significant. The date

4314

# is relative to the Proleptic Gregorian Calendar. This can represent:

4315

#

4316

# * A full date, with non-zero year, month and day values

4317

# * A month and day value, with a zero year, e.g. an anniversary

4318

# * A year on its own, with zero month and day values

4319

# * A year and month value, with a zero day, e.g. a credit card expiration date

4320

#

4321

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4322

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4323

# a year.

4324

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4325

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4326

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4327

# if specifying a year by itself or a year and month where the day is not

4328

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4329

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4330

"stringValue": "A String", # string

4331

"integerValue": "A String", # integer

4332

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4333

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4334

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4335

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4336

# to allow the value "24:00:00" for scenarios like business closing time.

4337

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4338

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4339

# allow the value 60 if it allows leap-seconds.

4340

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4341

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4342

"booleanValue": True or False, # boolean

4343

"floatValue": 3.14, # float

4344

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4345

},

4346

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4347

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

4348

# Bucketing transformation can provide all of this functionality,

4349

# but requires more configuration. This message is provided as a convenience to

4350

# the user for simple bucketing strategies.

4351

#

4352

# The transformed value will be a hyphenated string of

4353

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

4354

# all values that are within this bucket will be replaced with "10-20".

4355

#

4356

# This can be used on data of type: double, long.

4357

#

4358

# If the bound Value type differs from the type of data

4359

# being transformed, we will first attempt converting the type of the data to

4360

# be transformed to match the type of the bound before comparing.

4361

#

4362

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4363

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

4364

# grouped together into a single bucket; for example if `upper_bound` = 89,

4365

# then all values greater than 89 are replaced with the value "89+".

4366

# Note that for the purposes of inspection or transformation, the number

4367

# of bytes considered to comprise a 'Value' is based on its representation

4368

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4369

# 123456789, the number of bytes would be counted as 9, even though an

4370

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4371

"timestampValue": "A String", # timestamp

4372

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4373

# and time zone are either specified elsewhere or are not significant. The date

4374

# is relative to the Proleptic Gregorian Calendar. This can represent:

4375

#

4376

# * A full date, with non-zero year, month and day values

4377

# * A month and day value, with a zero year, e.g. an anniversary

4378

# * A year on its own, with zero month and day values

4379

# * A year and month value, with a zero day, e.g. a credit card expiration date

4380

#

4381

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4382

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4383

# a year.

4384

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4385

# month and day.

4386

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4387

# if specifying a year by itself or a year and month where the day is not

4388

# significant.

4389

},

4390

"stringValue": "A String", # string

4391

"integerValue": "A String", # integer

4392

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4393

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4394

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4395

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4396

# to allow the value "24:00:00" for scenarios like business closing time.

4397

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4398

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4399

# allow the value 60 if it allows leap-seconds.

4400

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4401

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4402

"booleanValue": True or False, # boolean

4403

"floatValue": 3.14, # float

4404

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4405

},

4406

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

4407

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

4408

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

4409

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4410

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

4411

# grouped together into a single bucket; for example if `lower_bound` = 10,

4412

# then all values less than 10 are replaced with the value "-10".

4413

# Note that for the purposes of inspection or transformation, the number

4414

# of bytes considered to comprise a 'Value' is based on its representation

4415

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4416

# 123456789, the number of bytes would be counted as 9, even though an

4417

# int64 only holds up to 8 bytes of data.

4418

"timestampValue": "A String", # timestamp

4419

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4420

# and time zone are either specified elsewhere or are not significant. The date

4421

# is relative to the Proleptic Gregorian Calendar. This can represent:

4422

#

4423

# * A full date, with non-zero year, month and day values

4424

# * A month and day value, with a zero year, e.g. an anniversary

4425

# * A year on its own, with zero month and day values

4426

# * A year and month value, with a zero day, e.g. a credit card expiration date

4427

#

4428

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4429

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4430

# a year.

4431

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4432

# month and day.

4433

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4434

# if specifying a year by itself or a year and month where the day is not

4435

# significant.

4436

},

4437

"stringValue": "A String", # string

4438

"integerValue": "A String", # integer

4439

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4440

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4441

# types are google.type.Date and `google.protobuf.Timestamp`.

4442

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4443

# to allow the value "24:00:00" for scenarios like business closing time.

4444

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4445

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4446

# allow the value 60 if it allows leap-seconds.

4447

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4448

},

4449

"booleanValue": True or False, # boolean

4450

"floatValue": 3.14, # float

4451

"dayOfWeekValue": "A String", # day of week

4452

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4453

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4454

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

4455

# fixed character. Masking can start from the beginning or end of the string.

4456

# This can be used on data of any type (numbers, longs, and so on) and when

4457

# de-identifying structured data we'll attempt to preserve the original data's

4458

# type. (This allows you to take a long like 123 and modify it to a string like

4459

# **3.

4460

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

4461

# characters. For example, if the input string is `555-555-5555` and you

4462

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

4463

# returns `***-**5-5555`.

4464

{ # Characters to skip when doing deidentification of a value. These will be left

4465

# alone and skipped.

4466

"charactersToSkip": "A String", # Characters to not transform when masking.

4467

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

4472

# masked. Skipped characters do not count towards this tally.

4473

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

4474

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

4475

# code or credit card number. This string must have a length of 1. If not

4476

# supplied, this value defaults to `*` for strings, and `0` for digits.

4477

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

4478

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

4479

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

4480

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

4481

# is `true`, then the string `12345` is masked as `12***`.

4482

},

4483

},

4484

"field": { # General identifier of a data field in a storage service. # Set if the transformation was limited to a specific FieldId.

4485

"name": "A String", # Name describing the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4486

},

4487

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

4488

"recordSuppress": { # Configuration to suppress records whose suppression conditions evaluate to # The specific suppression option these stats apply to.

4489

# true.

4490

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

4491

# evaluated to be suppressed from the transformed content.

4492

# a field.

4493

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

4494

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

4495

# only supported value is `AND`.

4496

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

4497

"conditions": [ # A collection of conditions.

4498

{ # The field type of `value` and `field` do not need to match to be

4499

# considered equal, but not all comparisons are possible.

4500

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

4501

# but all other comparisons are invalid with incompatible types.

4502

# A `value` of type:

4503

#

4504

# - `string` can be compared against all other types

4505

# - `boolean` can only be compared against other booleans

4506

# - `integer` can be compared against doubles or a string if the string value

4507

# can be parsed as an integer.

4508

# - `double` can be compared against integers or a string if the string can

4509

# be parsed as a double.

4510

# - `Timestamp` can be compared against strings in RFC 3339 date string

4511

# format.

4512

# - `TimeOfDay` can be compared against timestamps and strings in the format

4513

# of 'HH:mm:ss'.

4514

#

4515

# If we fail to compare do to type mismatch, a warning will be given and

4516

# the condition will evaluate to false.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4517

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

4518

# Note that for the purposes of inspection or transformation, the number

4519

# of bytes considered to comprise a 'Value' is based on its representation

4520

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4521

# 123456789, the number of bytes would be counted as 9, even though an

4522

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4523

"timestampValue": "A String", # timestamp

4524

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4525

# and time zone are either specified elsewhere or are not significant. The date

4526

# is relative to the Proleptic Gregorian Calendar. This can represent:

4527

#

4528

# * A full date, with non-zero year, month and day values

4529

# * A month and day value, with a zero year, e.g. an anniversary

4530

# * A year on its own, with zero month and day values

4531

# * A year and month value, with a zero day, e.g. a credit card expiration date

4532

#

4533

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4534

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4535

# a year.

4536

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4537

# month and day.

4538

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4539

# if specifying a year by itself or a year and month where the day is not

4540

# significant.

4541

},

4542

"stringValue": "A String", # string

4543

"integerValue": "A String", # integer

4544

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4545

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4546

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4547

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4548

# to allow the value "24:00:00" for scenarios like business closing time.

4549

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4550

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4551

# allow the value 60 if it allows leap-seconds.

4552

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4553

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4554

"booleanValue": True or False, # boolean

4555

"floatValue": 3.14, # float

4556

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4557

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4558

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

4559

"name": "A String", # Name describing the field.

4560

},

4561

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4562

},

4563

],

4564

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4565

},

4566

},

4567

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4568

"infoType": { # Type of information detected by the API. # Set if the transformation was limited to a specific InfoType.

4569

"name": "A String", # Name of the information type. Either a name of your choosing when

4570

# creating a CustomInfoType, or one of the names listed

4571

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4572

# a built-in type. InfoType names should conform to the pattern

4573

# `[a-zA-Z0-9_]{1,64}`.

4574

},

4575

"results": [ # Collection of all transformations that took place or had an error.

4576

{ # A collection that informs the user the number of times a particular

4577

# `TransformationResultCode` and error details occurred.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4578

"details": "A String", # A place for warnings or errors to show up if a transformation didn't

4579

# work as expected.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4580

"code": "A String", # Outcome of the transformation.

4581

"count": "A String", # Number of transformations counted by this result.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4582

},

4583

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4584

},

4585

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4586

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4587

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4588

"item": { # Container structure for the content to inspect. # The de-identified item.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4589

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4590

"data": "A String", # Content data to inspect or redact.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4591

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4592

},

4593

"value": "A String", # String data to inspect or redact.

4594

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4595

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

4596

# learn more.

4597

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

4598

# learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4599

"rows": [ # Rows of the table.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4600

{ # Values of the row.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4601

"values": [ # Individual cells.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4602

{ # Set of primitive values supported by the system.

4603

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4604

# of bytes considered to comprise a 'Value' is based on its representation

4605

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4606

# 123456789, the number of bytes would be counted as 9, even though an

4607

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4608

"timestampValue": "A String", # timestamp

4609

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4610

# and time zone are either specified elsewhere or are not significant. The date

4611

# is relative to the Proleptic Gregorian Calendar. This can represent:

4612

#

4613

# * A full date, with non-zero year, month and day values

4614

# * A month and day value, with a zero year, e.g. an anniversary

4615

# * A year on its own, with zero month and day values

4616

# * A year and month value, with a zero day, e.g. a credit card expiration date

4617

#

4618

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4619

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4620

# a year.

4621

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4622

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4623

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4624

# if specifying a year by itself or a year and month where the day is not

4625

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4626

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4627

"stringValue": "A String", # string

4628

"integerValue": "A String", # integer

4629

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4630

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4631

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4632

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4633

# to allow the value "24:00:00" for scenarios like business closing time.

4634

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4635

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4636

# allow the value 60 if it allows leap-seconds.

4637

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4638

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4639

"booleanValue": True or False, # boolean

4640

"floatValue": 3.14, # float

4641

"dayOfWeekValue": "A String", # day of week

},

],

},

],

"headers": [ # Headers of the table.

4647

{ # General identifier of a data field in a storage service.

4648

"name": "A String", # Name describing the field.

},

],

},

},

}</pre>

</div>

<code class="details" id="inspect">inspect(parent, body=None, x__xgafv=None)</code>

4658

<pre>Finds potentially sensitive info in content.

4659

This method has limits on input size, processing time, and output size.

4660

4661

When no InfoTypes or CustomInfoTypes are specified in this request, the

4662

system will automatically choose what detectors to run. By default this may

4663

be all types, but may change over time as detectors are updated.

4664

4665

For how to guides, see https://cloud.google.com/dlp/docs/inspecting-images

4666

and https://cloud.google.com/dlp/docs/inspecting-text,

4667

4668

Args:

4669

parent: string, The parent resource name, for example projects/my-project-id. (required)

4670

body: object, The request body.

4671

The object takes the form of:

4672

4673

{ # Request to search for potentially sensitive info in a ContentItem.

4674

"item": { # Container structure for the content to inspect. # The item to inspect.

4675

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

4676

"data": "A String", # Content data to inspect or redact.

4677

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

4678

},

4679

"value": "A String", # String data to inspect or redact.

4680

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

4681

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

4682

# learn more.

4683

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

4684

# learn more.

4685

"rows": [ # Rows of the table.

4686

{ # Values of the row.

4687

"values": [ # Individual cells.

4688

{ # Set of primitive values supported by the system.

4689

# Note that for the purposes of inspection or transformation, the number

4690

# of bytes considered to comprise a 'Value' is based on its representation

4691

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4692

# 123456789, the number of bytes would be counted as 9, even though an

4693

# int64 only holds up to 8 bytes of data.

4694

"timestampValue": "A String", # timestamp

4695

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4696

# and time zone are either specified elsewhere or are not significant. The date

4697

# is relative to the Proleptic Gregorian Calendar. This can represent:

4698

#

4699

# * A full date, with non-zero year, month and day values

4700

# * A month and day value, with a zero year, e.g. an anniversary

4701

# * A year on its own, with zero month and day values

4702

# * A year and month value, with a zero day, e.g. a credit card expiration date

4703

#

4704

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4705

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4706

# a year.

4707

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4708

# month and day.

4709

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4710

# if specifying a year by itself or a year and month where the day is not

4711

# significant.

4712

},

4713

"stringValue": "A String", # string

4714

"integerValue": "A String", # integer

4715

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4716

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4717

# types are google.type.Date and `google.protobuf.Timestamp`.

4718

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4719

# to allow the value "24:00:00" for scenarios like business closing time.

4720

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4721

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4722

# allow the value 60 if it allows leap-seconds.

4723

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4724

},

4725

"booleanValue": True or False, # boolean

4726

"floatValue": 3.14, # float

4727

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

],

},

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4732

"headers": [ # Headers of the table.

4733

{ # General identifier of a data field in a storage service.

4734

"name": "A String", # Name describing the field.

4735

},

4736

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4737

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4738

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4739

"inspectTemplateName": "A String", # Template to use. Any configuration directly specified in

4740

# inspect_config will override those set in the template. Singular fields

4741

# that are set in this request will replace their corresponding fields in the

4742

# template. Repeated fields are appended. Singular sub-messages and groups

4743

# are recursively merged.

4744

"inspectConfig": { # Configuration description of the scanning process. # Configuration for the inspector. What specified here will override

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4745

# the template referenced by the inspect_template_name argument.

4746

# When used with redactContent only info_types and min_likelihood are currently

4747

# used.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

4748

"minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is

4749

# POSSIBLE.

4750

# See https://cloud.google.com/dlp/docs/likelihood to learn more.

4751

"contentOptions": [ # List of options defining data content to scan.

4752

# If empty, text, images, and other content will be included.

4753

"A String",

4754

],

4755

"infoTypes": [ # Restricts what info_types to look for. The values must correspond to

4756

# InfoType values returned by ListInfoTypes or listed at

4757

# https://cloud.google.com/dlp/docs/infotypes-reference.

4758

#

4759

# When no InfoTypes or CustomInfoTypes are specified in a request, the

4760

# system may automatically choose what detectors to run. By default this may

4761

# be all types, but may change over time as detectors are updated.

4762

#

4763

# If you need precise control and predictability as to what detectors are

4764

# run you should specify specific InfoTypes listed in the reference,

4765

# otherwise a default list will be used, which may change over time.

4766

{ # Type of information detected by the API.

4767

"name": "A String", # Name of the information type. Either a name of your choosing when

4768

# creating a CustomInfoType, or one of the names listed

4769

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4770

# a built-in type. InfoType names should conform to the pattern

4771

# `[a-zA-Z0-9_]{1,64}`.

4772

},

4773

],

4774

"excludeInfoTypes": True or False, # When true, excludes type information of the findings.

4775

"customInfoTypes": [ # CustomInfoTypes provided by the user. See

4776

# https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

4777

{ # Custom information type provided by the user. Used to find domain-specific

4778

# sensitive information configurable to the data in question.

4779

"surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that

4780

# support reversing.

4781

# such as

4782

# [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).

4783

# These types of transformations are

4784

# those that perform pseudonymization, thereby producing a "surrogate" as

4785

# output. This should be used in conjunction with a field on the

4786

# transformation such as `surrogate_info_type`. This CustomInfoType does

4787

# not support the use of `detection_rules`.

4788

},

4789

"likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be

4790

# altered by a detection rule if the finding meets the criteria specified by

4791

# the rule. Defaults to `VERY_LIKELY` if not specified.

4792

"infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in

4793

# infoType, when the name matches one of existing infoTypes and that infoType

4794

# is specified in `InspectContent.info_types` field. Specifying the latter

4795

# adds findings to the one detected by the system. If built-in info type is

4796

# not specified in `InspectContent.info_types` list then the name is treated

4797

# as a custom info type.

4798

"name": "A String", # Name of the information type. Either a name of your choosing when

4799

# creating a CustomInfoType, or one of the names listed

4800

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4801

# a built-in type. InfoType names should conform to the pattern

4802

# `[a-zA-Z0-9_]{1,64}`.

4803

},

4804

"regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.

4805

"groupIndexes": [ # The index of the submatch to extract as findings. When not

4806

# specified, the entire match is returned. No more than 3 may be included.

4807

42,

4808

],

4809

"pattern": "A String", # Pattern defining the regular expression. Its syntax

4810

# (https://github.com/google/re2/wiki/Syntax) can be found under the

4811

# google/re2 repository on GitHub.

4812

},

4813

"detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.

4814

# Rules are applied in order that they are specified. Not supported for the

4815

# `surrogate_type` CustomInfoType.

4816

{ # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a

4817

# `CustomInfoType` to alter behavior under certain circumstances, depending

4818

# on the specific details of the rule. Not supported for the `surrogate_type`

4819

# custom infoType.

4820

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

4821

# proximity of hotwords.

4822

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

4823

# part of a detection rule.

4824

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

4825

# levels. For example, if a finding would be `POSSIBLE` without the

4826

# detection rule and `relative_likelihood` is 1, then it is upgraded to

4827

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

4828

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

4829

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

4830

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

4831

# a final likelihood of `LIKELY`.

4832

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

4833

},

4834

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

4835

"groupIndexes": [ # The index of the submatch to extract as findings. When not

4836

# specified, the entire match is returned. No more than 3 may be included.

4837

42,

4838

],

4839

"pattern": "A String", # Pattern defining the regular expression. Its syntax

4840

# (https://github.com/google/re2/wiki/Syntax) can be found under the

4841

# google/re2 repository on GitHub.

4842

},

4843

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

4844

# The total length of the window cannot exceed 1000 characters. Note that

4845

# the finding itself will be included in the window, so that hotwords may

4846

# be used to match substrings of the finding itself. For example, the

4847

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

4848

# adjusted upwards if the area code is known to be the local area code of

4849

# a company office using the hotword regex "\(xxx\)", where "xxx"

4850

# is the area code in question.

4851

# rule.

4852

"windowBefore": 42, # Number of characters before the finding to consider.

4853

"windowAfter": 42, # Number of characters after the finding to consider.

},

},

},

],

"exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding

4859

# to be returned. It still can be used for rules matching.

4860

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.

4861

# be used to match sensitive information specific to the data, such as a list

4862

# of employee IDs or job titles.

4863

#

4864

# Dictionary words are case-insensitive and all characters other than letters

4865

# and digits in the unicode [Basic Multilingual

4866

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

4867

# will be replaced with whitespace when scanning for matches, so the

4868

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

4869

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

4870

# surrounding any match must be of a different type than the adjacent

4871

# characters within the word, so letters must be next to non-letters and

4872

# digits next to non-digits. For example, the dictionary word "jen" will

4873

# match the first three letters of the text "jen123" but will return no

4874

# matches for "jennifer".

4875

#

4876

# Dictionary words containing a large number of characters that are not

4877

# letters or digits may result in unexpected findings because such characters

4878

# are treated as whitespace. The

4879

# [limits](https://cloud.google.com/dlp/limits) page contains details about

4880

# the size limits of dictionaries. For dictionaries that do not fit within

4881

# these constraints, consider using `LargeCustomDictionaryConfig` in the

4882

# `StoredInfoType` API.

4883

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

4884

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

4885

# at least one phrase and every phrase must contain at least 2 characters

4886

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

4891

# is accepted.

4892

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

4893

# Example: gs://[BUCKET_NAME]/dictionary.txt

4894

},

4895

},

4896

"storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in

4897

# `InspectDataSource`. Not currently supported in `InspectContent`.

4898

"name": "A String", # Resource name of the requested `StoredInfoType`, for example

4899

# `organizations/433245324/storedInfoTypes/432452342` or

4900

# `projects/project-id/storedInfoTypes/432452342`.

4901

"createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for

4902

# inspection was created. Output-only field, populated by the system.

4903

},

4904

},

4905

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4906

"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is

4907

# included in the response; see Finding.quote.

4908

"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig.

4909

# Exclusion rules, contained in the set are executed in the end, other

4910

# rules are executed in the order they are specified for each info type.

4911

{ # Rule set for modifying a set of infoTypes to alter behavior under certain

4912

# circumstances, depending on the specific details of the rules within the set.

4913

"infoTypes": [ # List of infoTypes this rule set is applied to.

4914

{ # Type of information detected by the API.

4915

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4916

# creating a CustomInfoType, or one of the names listed

4917

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4918

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4919

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4920

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4921

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4922

"rules": [ # Set of rules to be applied to infoTypes. The rules are applied in order.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4923

{ # A single inspection rule to be applied to infoTypes, specified in

4924

# `InspectionRuleSet`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4925

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4926

# proximity of hotwords.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4927

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4928

# part of a detection rule.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4929

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4930

# levels. For example, if a finding would be `POSSIBLE` without the

4931

# detection rule and `relative_likelihood` is 1, then it is upgraded to

4932

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

4933

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

4934

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

4935

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

4936

# a final likelihood of `LIKELY`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4937

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4938

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4939

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

4940

"groupIndexes": [ # The index of the submatch to extract as findings. When not

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4941

# specified, the entire match is returned. No more than 3 may be included.

4942

42,

4943

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4944

"pattern": "A String", # Pattern defining the regular expression. Its syntax

4945

# (https://github.com/google/re2/wiki/Syntax) can be found under the

4946

# google/re2 repository on GitHub.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4947

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4948

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

4949

# The total length of the window cannot exceed 1000 characters. Note that

4950

# the finding itself will be included in the window, so that hotwords may

4951

# be used to match substrings of the finding itself. For example, the

4952

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

4953

# adjusted upwards if the area code is known to be the local area code of

4954

# a company office using the hotword regex "\(xxx\)", where "xxx"

4955

# is the area code in question.

4956

# rule.

4957

"windowBefore": 42, # Number of characters before the finding to consider.

4958

"windowAfter": 42, # Number of characters after the finding to consider.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4959

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4960

},

4961

"exclusionRule": { # The rule that specifies conditions when findings of infoTypes specified in # Exclusion rule.

4962

# `InspectionRuleSet` are removed from results.

4963

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # Dictionary which defines the rule.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4964

# be used to match sensitive information specific to the data, such as a list

4965

# of employee IDs or job titles.

4966

#

4967

# Dictionary words are case-insensitive and all characters other than letters

4968

# and digits in the unicode [Basic Multilingual

4969

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

4970

# will be replaced with whitespace when scanning for matches, so the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4971

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

4972

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4973

# surrounding any match must be of a different type than the adjacent

4974

# characters within the word, so letters must be next to non-letters and

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4975

# digits next to non-digits. For example, the dictionary word "jen" will

4976

# match the first three letters of the text "jen123" but will return no

4977

# matches for "jennifer".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4978

#

4979

# Dictionary words containing a large number of characters that are not

4980

# letters or digits may result in unexpected findings because such characters

4981

# are treated as whitespace. The

4982

# [limits](https://cloud.google.com/dlp/limits) page contains details about

4983

# the size limits of dictionaries. For dictionaries that do not fit within

4984

# these constraints, consider using `LargeCustomDictionaryConfig` in the

4985

# `StoredInfoType` API.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4986

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

4987

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4988

# at least one phrase and every phrase must contain at least 2 characters

4989

# that are letters or digits. [required]

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4990

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4991

],

4992

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4993

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4994

# is accepted.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4995

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4996

# Example: gs://[BUCKET_NAME]/dictionary.txt

4997

},

4998

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4999

"regex": { # Message defining a custom regular expression. # Regular expression which defines the rule.

5000

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5001

# specified, the entire match is returned. No more than 3 may be included.

5002

42,

5003

],

5004

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5005

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5006

# google/re2 repository on GitHub.

5007

},

5008

"excludeInfoTypes": { # List of exclude infoTypes. # Set of infoTypes for which findings would affect this rule.

5009

"infoTypes": [ # InfoType list in ExclusionRule rule drops a finding when it overlaps or

5010

# contained within with a finding of an infoType from this list. For

5011

# example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and

5012

# `exclusion_rule` containing `exclude_info_types.info_types` with

5013

# "EMAIL_ADDRESS" the phone number findings are dropped if they overlap

5014

# with EMAIL_ADDRESS finding.

5015

# That leads to "555-222-2222@example.org" to generate only a single

5016

# finding, namely email address.

5017

{ # Type of information detected by the API.

5018

"name": "A String", # Name of the information type. Either a name of your choosing when

5019

# creating a CustomInfoType, or one of the names listed

5020

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5021

# a built-in type. InfoType names should conform to the pattern

5022

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

"matchingType": "A String", # How the rule is applied, see MatchingType documentation for details.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5027

},

5028

},

5029

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5030

},

5031

],

5032

"limits": { # Configuration to control the number of findings returned. # Configuration to control the number of findings returned.

5033

"maxFindingsPerItem": 42, # Max number of findings that will be returned for each item scanned.

5034

# When set within `InspectJobConfig`,

5035

# the maximum returned is 2000 regardless if this is set higher.

5036

# When set within `InspectContentRequest`, this field is ignored.

5037

"maxFindingsPerInfoType": [ # Configuration of findings limit given for specified infoTypes.

5038

{ # Max findings configuration per infoType, per content item or long

5039

# running DlpJob.

5040

"maxFindings": 42, # Max findings limit for the given infoType.

5041

"infoType": { # Type of information detected by the API. # Type of information the findings limit applies to. Only one limit per

5042

# info_type should be provided. If InfoTypeLimit does not have an

5043

# info_type, the DLP API applies the limit against all info_types that

5044

# are found but not specified in another InfoTypeLimit.

5045

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5046

# creating a CustomInfoType, or one of the names listed

5047

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5048

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5049

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5050

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5051

},

5052

],

5053

"maxFindingsPerRequest": 42, # Max number of findings that will be returned per request/job.

5054

# When set within `InspectContentRequest`, the maximum returned is 2000

5055

# regardless if this is set higher.

5056

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5057

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5058

"locationId": "A String", # The geographic location to process content inspection. Reserved for future

5059

# extensions.

5060

# When inspecting images location is restricted to 'global', 'us', 'asia',

5061

# and 'europe'.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5062

}

5063

5064

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

5071

5072

{ # Results of inspecting an item.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5073

"result": { # All the findings for a single scanned item. # The findings.

5074

"findings": [ # List of findings for an item.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5075

{ # Represents a piece of potentially sensitive content.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5076

"quoteInfo": { # Message for infoType-dependent details parsed from quote. # Contains data parsed from quotes. Only populated if include_quote was set

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5077

# to true and a supported infoType was requested. Currently supported

5078

# infoTypes: DATE, DATE_OF_BIRTH and TIME.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5079

"dateTime": { # Message for a date time object. # The date time indicated by the quote.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5080

# e.g. 2018-01-01, 5th August.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5081

"date": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # One or more of the following must be set.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5082

# Must be a valid date or time value.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5083

# and time zone are either specified elsewhere or are not significant. The date

5084

# is relative to the Proleptic Gregorian Calendar. This can represent:

5085

#

5086

# * A full date, with non-zero year, month and day values

5087

# * A month and day value, with a zero year, e.g. an anniversary

5088

# * A year on its own, with zero month and day values

5089

# * A year and month value, with a zero day, e.g. a credit card expiration date

5090

#

5091

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5092

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5093

# a year.

5094

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5095

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5096

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5097

# if specifying a year by itself or a year and month where the day is not

5098

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5099

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5100

"timeZone": { # Time zone of the date time object. # Time zone

5101

"offsetMinutes": 42, # Set only if the offset can be determined. Positive for time ahead of UTC.

5102

# E.g. For "UTC-9", this value is -540.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5103

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5104

"dayOfWeek": "A String", # Day of week

5105

"time": { # Represents a time of day. The date and time zone are either not significant # Time of day

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5106

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5107

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5108

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5109

# to allow the value "24:00:00" for scenarios like business closing time.

5110

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

5111

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5112

# allow the value 60 if it allows leap-seconds.

5113

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5114

},

5115

},

5116

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

5117

"infoType": { # Type of information detected by the API. # The type of content that might have been found.

5118

# Provided if `excluded_types` is false.

5119

"name": "A String", # Name of the information type. Either a name of your choosing when

5120

# creating a CustomInfoType, or one of the names listed

5121

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5122

# a built-in type. InfoType names should conform to the pattern

5123

# `[a-zA-Z0-9_]{1,64}`.

5124

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5125

"labels": { # The labels associated with this `Finding`.

5126

#

5127

# Label keys must be between 1 and 63 characters long and must conform

5128

# to the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?`.

5129

#

5130

# Label values must be between 0 and 63 characters long and must conform

5131

# to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`.

5132

#

5133

# No more than 10 labels can be associated with a given finding.

5134

#

5135

# Examples:

5136

# * `"environment" : "production"`

5137

# * `"pipeline" : "etl"`

5138

"a_key": "A String",

5139

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5140

"likelihood": "A String", # Confidence of how likely it is that the `info_type` is correct.

5141

"name": "A String", # Resource name in format

5142

# projects/{project}/locations/{location}/findings/{finding} Populated only

5143

# when viewing persisted findings.

5144

"location": { # Specifies the location of the finding. # Where the content was found.

5145

"codepointRange": { # Generic half-open interval [start, end) # Unicode character offsets delimiting the finding.

5146

# These are relative to the finding's containing element.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5147

# Provided when the content is text.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5148

"start": "A String", # Index of the first character of the range (inclusive).

5149

"end": "A String", # Index of the last character of the range (exclusive).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5150

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5151

"byteRange": { # Generic half-open interval [start, end) # Zero-based byte offsets delimiting the finding.

5152

# These are relative to the finding's containing element.

5153

# Note that when the content is not textual, this references

5154

# the UTF-8 encoded textual representation of the content.

5155

# Omitted if content is an image.

5156

"start": "A String", # Index of the first character of the range (inclusive).

5157

"end": "A String", # Index of the last character of the range (exclusive).

5158

},

5159

"container": { # Represents a container that may contain DLP findings. # Information about the container where this finding occurred, if available.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5160

# Examples of a container include a file, table, or database record.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5161

"updateTime": "A String", # Findings container modification timestamp, if applicable.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5162

# For Google Cloud Storage contains last file modification timestamp.

5163

# For BigQuery table contains last_modified_time property.

5164

# For Datastore - not populated.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5165

"rootPath": "A String", # The root of the container.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5166

# Examples:

5167

# - For BigQuery table `project_id:dataset_id.table_id`, the root is

5168

# `dataset_id`

5169

# - For Google Cloud Storage file `gs://bucket/folder/filename.txt`, the root

5170

# is `gs://bucket`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5171

"projectId": "A String", # Project where the finding was found.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5172

# Can be different from the project that owns the finding.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

5173

"version": "A String", # Findings container version, if available

5174

# ("generation" for Google Cloud Storage).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5175

"relativePath": "A String", # The rest of the path after the root.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5176

# Examples:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5177

# - For BigQuery table `project_id:dataset_id.table_id`, the relative path is

5178

# `table_id`

5179

# - Google Cloud Storage file `gs://bucket/folder/filename.txt`, the relative

5180

# path is `folder/filename.txt`

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

5181

"fullPath": "A String", # A string representation of the full container name.

5182

# Examples:

5183

# - BigQuery: 'Project:DataSetId.TableId'

5184

# - Google Cloud Storage: 'gs://Bucket/folders/filename.txt'

5185

"type": "A String", # Container type, for example BigQuery or Google Cloud Storage.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5186

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5187

"contentLocations": [ # List of nested objects pointing to the precise location of the finding

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5188

# within the file or record.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5189

{ # Precise location of the finding within a document, record, image, or metadata

5190

# container.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

5191

"containerVersion": "A String", # Findings container version, if available

5192

# ("generation" for Google Cloud Storage).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5193

"containerName": "A String", # Name of the container where the finding is located.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5194

# The top level name is the source file name or table name. Names of some

5195

# common storage containers are formatted as follows:

5196

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5197

# * BigQuery tables: `{project_id}:{dataset_id}.{table_id}`

5198

# * Cloud Storage files: `gs://{bucket}/{path}`

5199

# * Datastore namespace: {namespace}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5200

#

5201

# Nested names could be absent if the embedded object has no string

5202

# identifier (for an example an image contained within a document).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5203

"documentLocation": { # Location of a finding within a document. # Location data for document files.

5204

"fileOffset": "A String", # Offset of the line, from the beginning of the file, where the finding

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5205

# is located.

5206

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5207

"recordLocation": { # Location of a finding within a row or record. # Location within a row or record of a database table.

5208

"fieldId": { # General identifier of a data field in a storage service. # Field id of the field containing the finding.

5209

"name": "A String", # Name describing the field.

5210

},

5211

"tableLocation": { # Location of a finding within a table. # Location within a `ContentItem.Table`.

5212

"rowIndex": "A String", # The zero-based index of the row where the finding is located. Only

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5213

# populated for resources that have a natural ordering, not BigQuery. In

5214

# BigQuery, to identify the row a finding came from, populate

5215

# BigQueryOptions.identifying_fields with your primary key column names and

5216

# when you store the findings the value of those columns will be stored

5217

# inside of Finding.

5218

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5219

"recordKey": { # Message for a unique key indicating a record that contains a finding. # Key of the finding.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5220

"datastoreKey": { # Record key for a finding in Cloud Datastore.

5221

"entityKey": { # A unique identifier for a Datastore entity. # Datastore entity key.

5222

# If a key's partition ID or any of its path kinds or names are

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5223

# reserved/read-only, the key is reserved/read-only.

5224

# A reserved/read-only key is forbidden in certain documented contexts.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

5225

"partitionId": { # Datastore partition ID. # Entities are partitioned into subsets, currently identified by a project

5226

# ID and namespace ID.

5227

# Queries are scoped to a single partition.

5228

# A partition ID identifies a grouping of entities. The grouping is always

5229

# by project and namespace, however the namespace ID may be empty.

5230

#

5231

# A partition ID contains several dimensions:

5232

# project ID and namespace ID.

5233

"projectId": "A String", # The ID of the project to which the entities belong.

5234

"namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.

5235

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5236

"path": [ # The entity path.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5237

# An entity path consists of one or more elements composed of a kind and a

5238

# string or numerical identifier, which identify entities. The first

5239

# element identifies a _root entity_, the second element identifies

5240

# a _child_ of the root entity, the third element identifies a child of the

5241

# second entity, and so forth. The entities identified by all prefixes of

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5242

# the path are called the element's _ancestors_.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5243

#

5244

# A path can never be empty, and a path can have at most 100 elements.

5245

{ # A (kind, ID/name) pair used to construct a key path.

5246

#

5247

# If either name or ID is set, the element is complete.

5248

# If neither is set, the element is incomplete.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5249

"kind": "A String", # The kind of the entity.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5250

# A kind matching regex `__.*__` is reserved/read-only.

5251

# A kind must not contain more than 1500 bytes when UTF-8 encoded.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5252

# Cannot be `""`.

5253

"id": "A String", # The auto-allocated ID of the entity.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5254

# Never equal to zero. Values less than zero are discouraged and may not

5255

# be supported in the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5256

"name": "A String", # The name of the entity.

5257

# A name matching regex `__.*__` is reserved/read-only.

5258

# A name must not be more than 1500 bytes when UTF-8 encoded.

5259

# Cannot be `""`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5260

},

5261

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5262

},

5263

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5264

"bigQueryKey": { # Row key for identifying a record in BigQuery table.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

5265

"rowNumber": "A String", # Row number inferred at the time the table was scanned. This value is

5266

# nondeterministic, cannot be queried, and may be null for inspection

5267

# jobs. To locate findings within a table, specify

5268

# `inspect_job.storage_config.big_query_options.identifying_fields` in

5269

# `CreateDlpJobRequest`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5270

"tableReference": { # Message defining the location of a BigQuery table. A table is uniquely # Complete BigQuery table reference.

5271

# identified by its project_id, dataset_id, and table_name. Within a query

5272

# a table is often referenced with a string in the format of:

5273

# `<project_id>:<dataset_id>.<table_id>` or

5274

# `<project_id>.<dataset_id>.<table_id>`.

5275

"projectId": "A String", # The Google Cloud Platform project ID of the project containing the table.

5276

# If omitted, project ID is inferred from the API call.

5277

"datasetId": "A String", # Dataset ID of the table.

5278

"tableId": "A String", # Name of the table.

5279

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5280

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

5281

"idValues": [ # Values of identifying columns in the given row. Order of values matches

5282

# the order of `identifying_fields` specified in the scanning request.

5283

"A String",

5284

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5285

},

5286

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5287

"containerTimestamp": "A String", # Findings container modification timestamp, if applicable.

5288

# For Google Cloud Storage contains last file modification timestamp.

5289

# For BigQuery table contains last_modified_time property.

5290

# For Datastore - not populated.

5291

"metadataLocation": { # Metadata Location # Location within the metadata for inspected content.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

5292

"type": "A String", # Type of metadata containing the finding.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5293

"storageLabel": { # Storage metadata label to indicate which metadata entry contains findings. # Storage metadata.

5294

"key": "A String",

5295

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5296

},

5297

"imageLocation": { # Location of the finding within an image. # Location within an image's pixels.

5298

"boundingBoxes": [ # Bounding boxes locating the pixels within the image containing the finding.

5299

{ # Bounding box encompassing detected text within an image.

5300

"top": 42, # Top coordinate of the bounding box. (0,0) is upper left.

5301

"width": 42, # Width of the bounding box in pixels.

5302

"height": 42, # Height of the bounding box in pixels.

5303

"left": 42, # Left coordinate of the bounding box. (0,0) is upper left.

5304

},

5305

],

5306

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5307

},

5308

],

5309

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5310

"quote": "A String", # The content that was found. Even if the content is not textual, it

5311

# may be converted to a textual representation here.

5312

# Provided if `include_quote` is true and the finding is

5313

# less than or equal to 4096 bytes long. If the finding exceeds 4096 bytes

5314

# in length, the quote may be omitted.

5315

"createTime": "A String", # Timestamp when finding was detected.

5316

"jobName": "A String", # The job that stored the finding.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

5317

"jobCreateTime": "A String", # Time the job started that produced this finding.

5318

"triggerName": "A String", # Job trigger name, if applicable, for this finding.

5319

"resourceName": "A String", # The job that stored the finding.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5320

},

5321

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5322

"findingsTruncated": True or False, # If true, then this item might have more findings than were returned,

5323

# and the findings returned are an arbitrary subset of all findings.

5324

# The findings list might be truncated because the input items were too

5325

# large, or because the server reached the maximum amount of resources

5326

# allowed for a single API call. For best results, divide the input into

5327

# smaller batches.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5333

<code class="details" id="reidentify">reidentify(parent, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5334

<pre>Re-identifies content that has been de-identified.

5335

See

5336

https://cloud.google.com/dlp/docs/pseudonymization#re-identification_in_free_text_code_example

5337

to learn more.

5338

5339

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5340

parent: string, Required. The parent resource name. (required)

5341

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5342

The object takes the form of:

5343

5344

{ # Request to re-identify an item.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5345

"inspectConfig": { # Configuration description of the scanning process. # Configuration for the inspector.

5346

# When used with redactContent only info_types and min_likelihood are currently

5347

# used.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

5348

"minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is

5349

# POSSIBLE.

5350

# See https://cloud.google.com/dlp/docs/likelihood to learn more.

5351

"contentOptions": [ # List of options defining data content to scan.

5352

# If empty, text, images, and other content will be included.

5353

"A String",

5354

],

5355

"infoTypes": [ # Restricts what info_types to look for. The values must correspond to

5356

# InfoType values returned by ListInfoTypes or listed at

5357

# https://cloud.google.com/dlp/docs/infotypes-reference.

5358

#

5359

# When no InfoTypes or CustomInfoTypes are specified in a request, the

5360

# system may automatically choose what detectors to run. By default this may

5361

# be all types, but may change over time as detectors are updated.

5362

#

5363

# If you need precise control and predictability as to what detectors are

5364

# run you should specify specific InfoTypes listed in the reference,

5365

# otherwise a default list will be used, which may change over time.

5366

{ # Type of information detected by the API.

5367

"name": "A String", # Name of the information type. Either a name of your choosing when

5368

# creating a CustomInfoType, or one of the names listed

5369

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5370

# a built-in type. InfoType names should conform to the pattern

5371

# `[a-zA-Z0-9_]{1,64}`.

5372

},

5373

],

5374

"excludeInfoTypes": True or False, # When true, excludes type information of the findings.

5375

"customInfoTypes": [ # CustomInfoTypes provided by the user. See

5376

# https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

5377

{ # Custom information type provided by the user. Used to find domain-specific

5378

# sensitive information configurable to the data in question.

5379

"surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that

5380

# support reversing.

5381

# such as

5382

# [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).

5383

# These types of transformations are

5384

# those that perform pseudonymization, thereby producing a "surrogate" as

5385

# output. This should be used in conjunction with a field on the

5386

# transformation such as `surrogate_info_type`. This CustomInfoType does

5387

# not support the use of `detection_rules`.

5388

},

5389

"likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be

5390

# altered by a detection rule if the finding meets the criteria specified by

5391

# the rule. Defaults to `VERY_LIKELY` if not specified.

5392

"infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in

5393

# infoType, when the name matches one of existing infoTypes and that infoType

5394

# is specified in `InspectContent.info_types` field. Specifying the latter

5395

# adds findings to the one detected by the system. If built-in info type is

5396

# not specified in `InspectContent.info_types` list then the name is treated

5397

# as a custom info type.

5398

"name": "A String", # Name of the information type. Either a name of your choosing when

5399

# creating a CustomInfoType, or one of the names listed

5400

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5401

# a built-in type. InfoType names should conform to the pattern

5402

# `[a-zA-Z0-9_]{1,64}`.

5403

},

5404

"regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.

5405

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5406

# specified, the entire match is returned. No more than 3 may be included.

5407

42,

5408

],

5409

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5410

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5411

# google/re2 repository on GitHub.

5412

},

5413

"detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.

5414

# Rules are applied in order that they are specified. Not supported for the

5415

# `surrogate_type` CustomInfoType.

5416

{ # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a

5417

# `CustomInfoType` to alter behavior under certain circumstances, depending

5418

# on the specific details of the rule. Not supported for the `surrogate_type`

5419

# custom infoType.

5420

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

5421

# proximity of hotwords.

5422

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

5423

# part of a detection rule.

5424

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

5425

# levels. For example, if a finding would be `POSSIBLE` without the

5426

# detection rule and `relative_likelihood` is 1, then it is upgraded to

5427

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

5428

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

5429

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

5430

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

5431

# a final likelihood of `LIKELY`.

5432

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

5433

},

5434

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

5435

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5436

# specified, the entire match is returned. No more than 3 may be included.

5437

42,

5438

],

5439

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5440

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5441

# google/re2 repository on GitHub.

5442

},

5443

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

5444

# The total length of the window cannot exceed 1000 characters. Note that

5445

# the finding itself will be included in the window, so that hotwords may

5446

# be used to match substrings of the finding itself. For example, the

5447

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

5448

# adjusted upwards if the area code is known to be the local area code of

5449

# a company office using the hotword regex "\(xxx\)", where "xxx"

5450

# is the area code in question.

5451

# rule.

5452

"windowBefore": 42, # Number of characters before the finding to consider.

5453

"windowAfter": 42, # Number of characters after the finding to consider.

},

},

},

],

"exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding

5459

# to be returned. It still can be used for rules matching.

5460

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.

5461

# be used to match sensitive information specific to the data, such as a list

5462

# of employee IDs or job titles.

5463

#

5464

# Dictionary words are case-insensitive and all characters other than letters

5465

# and digits in the unicode [Basic Multilingual

5466

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

5467

# will be replaced with whitespace when scanning for matches, so the

5468

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

5469

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

5470

# surrounding any match must be of a different type than the adjacent

5471

# characters within the word, so letters must be next to non-letters and

5472

# digits next to non-digits. For example, the dictionary word "jen" will

5473

# match the first three letters of the text "jen123" but will return no

5474

# matches for "jennifer".

5475

#

5476

# Dictionary words containing a large number of characters that are not

5477

# letters or digits may result in unexpected findings because such characters

5478

# are treated as whitespace. The

5479

# [limits](https://cloud.google.com/dlp/limits) page contains details about

5480

# the size limits of dictionaries. For dictionaries that do not fit within

5481

# these constraints, consider using `LargeCustomDictionaryConfig` in the

5482

# `StoredInfoType` API.

5483

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

5484

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

5485

# at least one phrase and every phrase must contain at least 2 characters

5486

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

5491

# is accepted.

5492

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

5493

# Example: gs://[BUCKET_NAME]/dictionary.txt

5494

},

5495

},

5496

"storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in

5497

# `InspectDataSource`. Not currently supported in `InspectContent`.

5498

"name": "A String", # Resource name of the requested `StoredInfoType`, for example

5499

# `organizations/433245324/storedInfoTypes/432452342` or

5500

# `projects/project-id/storedInfoTypes/432452342`.

5501

"createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for

5502

# inspection was created. Output-only field, populated by the system.

5503

},

5504

},

5505

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5506

"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is

5507

# included in the response; see Finding.quote.

5508

"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig.

5509

# Exclusion rules, contained in the set are executed in the end, other

5510

# rules are executed in the order they are specified for each info type.

5511

{ # Rule set for modifying a set of infoTypes to alter behavior under certain

5512

# circumstances, depending on the specific details of the rules within the set.

5513

"infoTypes": [ # List of infoTypes this rule set is applied to.

5514

{ # Type of information detected by the API.

5515

"name": "A String", # Name of the information type. Either a name of your choosing when

5516

# creating a CustomInfoType, or one of the names listed

5517

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5518

# a built-in type. InfoType names should conform to the pattern

5519

# `[a-zA-Z0-9_]{1,64}`.

5520

},

5521

],

5522

"rules": [ # Set of rules to be applied to infoTypes. The rules are applied in order.

5523

{ # A single inspection rule to be applied to infoTypes, specified in

5524

# `InspectionRuleSet`.

5525

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

5526

# proximity of hotwords.

5527

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

5528

# part of a detection rule.

5529

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

5530

# levels. For example, if a finding would be `POSSIBLE` without the

5531

# detection rule and `relative_likelihood` is 1, then it is upgraded to

5532

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

5533

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

5534

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

5535

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

5536

# a final likelihood of `LIKELY`.

5537

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

5538

},

5539

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

5540

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5541

# specified, the entire match is returned. No more than 3 may be included.

5542

42,

5543

],

5544

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5545

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5546

# google/re2 repository on GitHub.

5547

},

5548

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

5549

# The total length of the window cannot exceed 1000 characters. Note that

5550

# the finding itself will be included in the window, so that hotwords may

5551

# be used to match substrings of the finding itself. For example, the

5552

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

5553

# adjusted upwards if the area code is known to be the local area code of

5554

# a company office using the hotword regex "\(xxx\)", where "xxx"

5555

# is the area code in question.

5556

# rule.

5557

"windowBefore": 42, # Number of characters before the finding to consider.

5558

"windowAfter": 42, # Number of characters after the finding to consider.

5559

},

5560

},

5561

"exclusionRule": { # The rule that specifies conditions when findings of infoTypes specified in # Exclusion rule.

5562

# `InspectionRuleSet` are removed from results.

5563

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # Dictionary which defines the rule.

5564

# be used to match sensitive information specific to the data, such as a list

5565

# of employee IDs or job titles.

5566

#

5567

# Dictionary words are case-insensitive and all characters other than letters

5568

# and digits in the unicode [Basic Multilingual

5569

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

5570

# will be replaced with whitespace when scanning for matches, so the

5571

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

5572

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

5573

# surrounding any match must be of a different type than the adjacent

5574

# characters within the word, so letters must be next to non-letters and

5575

# digits next to non-digits. For example, the dictionary word "jen" will

5576

# match the first three letters of the text "jen123" but will return no

5577

# matches for "jennifer".

5578

#

5579

# Dictionary words containing a large number of characters that are not

5580

# letters or digits may result in unexpected findings because such characters

5581

# are treated as whitespace. The

5582

# [limits](https://cloud.google.com/dlp/limits) page contains details about

5583

# the size limits of dictionaries. For dictionaries that do not fit within

5584

# these constraints, consider using `LargeCustomDictionaryConfig` in the

5585

# `StoredInfoType` API.

5586

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

5587

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

5588

# at least one phrase and every phrase must contain at least 2 characters

5589

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

5594

# is accepted.

5595

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

5596

# Example: gs://[BUCKET_NAME]/dictionary.txt

5597

},

5598

},

5599

"regex": { # Message defining a custom regular expression. # Regular expression which defines the rule.

5600

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5601

# specified, the entire match is returned. No more than 3 may be included.

5602

42,

5603

],

5604

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5605

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5606

# google/re2 repository on GitHub.

5607

},

5608

"excludeInfoTypes": { # List of exclude infoTypes. # Set of infoTypes for which findings would affect this rule.

5609

"infoTypes": [ # InfoType list in ExclusionRule rule drops a finding when it overlaps or

5610

# contained within with a finding of an infoType from this list. For

5611

# example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and

5612

# `exclusion_rule` containing `exclude_info_types.info_types` with

5613

# "EMAIL_ADDRESS" the phone number findings are dropped if they overlap

5614

# with EMAIL_ADDRESS finding.

5615

# That leads to "555-222-2222@example.org" to generate only a single

5616

# finding, namely email address.

5617

{ # Type of information detected by the API.

5618

"name": "A String", # Name of the information type. Either a name of your choosing when

5619

# creating a CustomInfoType, or one of the names listed

5620

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5621

# a built-in type. InfoType names should conform to the pattern

5622

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

"matchingType": "A String", # How the rule is applied, see MatchingType documentation for details.

},

},

],

},

],

"limits": { # Configuration to control the number of findings returned. # Configuration to control the number of findings returned.

5633

"maxFindingsPerItem": 42, # Max number of findings that will be returned for each item scanned.

5634

# When set within `InspectJobConfig`,

5635

# the maximum returned is 2000 regardless if this is set higher.

5636

# When set within `InspectContentRequest`, this field is ignored.

5637

"maxFindingsPerInfoType": [ # Configuration of findings limit given for specified infoTypes.

5638

{ # Max findings configuration per infoType, per content item or long

5639

# running DlpJob.

5640

"maxFindings": 42, # Max findings limit for the given infoType.

5641

"infoType": { # Type of information detected by the API. # Type of information the findings limit applies to. Only one limit per

5642

# info_type should be provided. If InfoTypeLimit does not have an

5643

# info_type, the DLP API applies the limit against all info_types that

5644

# are found but not specified in another InfoTypeLimit.

5645

"name": "A String", # Name of the information type. Either a name of your choosing when

5646

# creating a CustomInfoType, or one of the names listed

5647

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5648

# a built-in type. InfoType names should conform to the pattern

5649

# `[a-zA-Z0-9_]{1,64}`.

},

},

],

"maxFindingsPerRequest": 42, # Max number of findings that will be returned per request/job.

5654

# When set within `InspectContentRequest`, the maximum returned is 2000

5655

# regardless if this is set higher.

5656

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5657

},

5658

"locationId": "A String", # The geographic location to process content reidentification. Reserved for

5659

# future extensions.

5660

"reidentifyTemplateName": "A String", # Template to use. References an instance of `DeidentifyTemplate`.

5661

# Any configuration directly specified in `reidentify_config` or

5662

# `inspect_config` will override those set in the template. Singular fields

5663

# that are set in this request will replace their corresponding fields in the

5664

# template. Repeated fields are appended. Singular sub-messages and groups

5665

# are recursively merged.

5666

"reidentifyConfig": { # The configuration that controls how the data will change. # Configuration for the re-identification of the content item.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5667

# This field shares the same proto message type that is used for

5668

# de-identification, however its usage here is for the reversal of the

5669

# previous de-identification. Re-identification is performed by examining

5670

# the transformations used to de-identify the items and executing the

5671

# reverse. This requires that only reversible transformations

5672

# be provided here. The reversible transformations are:

5673

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5674

# - `CryptoDeterministicConfig`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5675

# - `CryptoReplaceFfxFpeConfig`

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

5676

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text

5677

# transformation everywhere.

5678

# apply various `PrimitiveTransformation`s to each finding, where the

5679

# transformation is applied to only values that were identified as a specific

5680

# info_type.

5681

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

5682

# for a given infoType.

5683

{ # A transformation to apply to text that is identified as a specific

5684

# info_type.

5685

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

5686

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

5687

# portion of the value.

5688

"partToExtract": "A String", # The part of the time to keep.

5689

},

5690

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

5691

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

5692

# to learn more.

5693

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

5694

# If set, must also set cryptoKey. If set, shift will be consistent for the

5695

# given context.

5696

"name": "A String", # Name describing the field.

5697

},

5698

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

5699

# range (inclusive ends). Negative means shift to earlier in time. Must not

5700

# be more than 365250 days (1000 years) each direction.

5701

#

5702

# For example, 3 means shift date to at most 3 days into the future.

5703

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

5704

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

5705

# results in the same shift for the same context and crypto_key. If

5706

# set, must also set context. Can only be applied to table items.

5707

# a key encryption key (KEK) stored by KMS).

5708

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5709

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5710

# unwrap the data crypto key.

5711

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5712

# leaking the key. Choose another type of key if possible.

5713

"key": "A String", # Required. A 128/192/256 bit key.

5714

},

5715

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5716

# It will be discarded after the request finishes.

5717

"name": "A String", # Required. Name of the key.

5718

# This is an arbitrary string used to differentiate different keys.

5719

# A unique key is generated per name: two separate `TransientCryptoKey`

5720

# protos share the same generated key if their names are the same.

5721

# When the data crypto key is generated, this name is not used in any way

5722

# (repeating the api call will result in a different key being generated).

5723

},

5724

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5725

# The wrapped key must be a 128/192/256 bit key.

5726

# Authorization requires the following IAM permissions when sending a request

5727

# to perform a crypto transformation using a kms-wrapped crypto key:

5728

# dlp.kms.encrypt

5729

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5730

"wrappedKey": "A String", # Required. The wrapped data crypto key.

},

},

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

5735

},

5736

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

5737

# Uses SHA-256.

5738

# The key size must be either 32 or 64 bytes.

5739

# Outputs a base64 encoded representation of the hashed output

5740

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

5741

# Currently, only string and integer values can be hashed.

5742

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

5743

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

5744

# a key encryption key (KEK) stored by KMS).

5745

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5746

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5747

# unwrap the data crypto key.

5748

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5749

# leaking the key. Choose another type of key if possible.

5750

"key": "A String", # Required. A 128/192/256 bit key.

5751

},

5752

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5753

# It will be discarded after the request finishes.

5754

"name": "A String", # Required. Name of the key.

5755

# This is an arbitrary string used to differentiate different keys.

5756

# A unique key is generated per name: two separate `TransientCryptoKey`

5757

# protos share the same generated key if their names are the same.

5758

# When the data crypto key is generated, this name is not used in any way

5759

# (repeating the api call will result in a different key being generated).

5760

},

5761

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5762

# The wrapped key must be a 128/192/256 bit key.

5763

# Authorization requires the following IAM permissions when sending a request

5764

# to perform a crypto transformation using a kms-wrapped crypto key:

5765

# dlp.kms.encrypt

5766

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5767

"wrappedKey": "A String", # Required. The wrapped data crypto key.

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

5772

# (FPE) with the FFX mode of operation; however when used in the

5773

# `ReidentifyContent` API method, it serves the opposite function by reversing

5774

# the surrogate back into the original identifier. The identifier must be

5775

# encoded as ASCII. For a given crypto key and context, the same identifier

5776

# will be replaced with the same surrogate. Identifiers must be at least two

5777

# characters long. In the case that the identifier is the empty string, it will

5778

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

5779

# more.

5780

#

5781

# Note: We recommend using CryptoDeterministicConfig for all use cases which

5782

# do not require preserving the input alphabet space and size, plus warrant

5783

# referential integrity.

5784

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

5785

# This annotation will be applied to the surrogate by prefixing it with

5786

# the name of the custom infoType followed by the number of

5787

# characters comprising the surrogate. The following scheme defines the

5788

# format: info_type_name(surrogate_character_count):surrogate

5789

#

5790

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

5791

# the surrogate is 'abc', the full replacement value

5792

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

5793

#

5794

# This annotation identifies the surrogate when inspecting content using the

5795

# custom infoType

5796

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

5797

# This facilitates reversal of the surrogate when it occurs in free text.

5798

#

5799

# In order for inspection to work properly, the name of this infoType must

5800

# not occur naturally anywhere in your data; otherwise, inspection may

5801

# find a surrogate that does not correspond to an actual identifier.

5802

# Therefore, choose your custom infoType name carefully after considering

5803

# what your data looks like. One way to select a name that has a high chance

5804

# of yielding reliable detection is to include one or more unicode characters

5805

# that are highly improbable to exist in your data.

5806

# For example, assuming your data is entered from a regular ASCII keyboard,

5807

# the symbol with the hex code point 29DD might be used like so:

5808

# ⧝MY_TOKEN_TYPE

5809

"name": "A String", # Name of the information type. Either a name of your choosing when

5810

# creating a CustomInfoType, or one of the names listed

5811

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5812

# a built-in type. InfoType names should conform to the pattern

5813

# `[a-zA-Z0-9_]{1,64}`.

5814

},

5815

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

5816

# identifier in two different contexts won't be given the same surrogate. If

5817

# the context is not set, a default tweak will be used.

5818

#

5819

# If the context is set but:

5820

#

5821

# 1. there is no record present when transforming a given value or

5822

# 1. the field is not present when transforming a given value,

5823

#

5824

# a default tweak will be used.

5825

#

5826

# Note that case (1) is expected when an `InfoTypeTransformation` is

5827

# applied to both structured and non-structured `ContentItem`s.

5828

# Currently, the referenced field may be of value type integer or string.

5829

#

5830

# The tweak is constructed as a sequence of bytes in big endian byte order

5831

# such that:

5832

#

5833

# - a 64 bit integer is encoded followed by a single byte of value 1

5834

# - a string is encoded in UTF-8 format followed by a single byte of value 2

5835

"name": "A String", # Name describing the field.

5836

},

5837

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

5838

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

5839

# a key encryption key (KEK) stored by KMS).

5840

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5841

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5842

# unwrap the data crypto key.

5843

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5844

# leaking the key. Choose another type of key if possible.

5845

"key": "A String", # Required. A 128/192/256 bit key.

5846

},

5847

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5848

# It will be discarded after the request finishes.

5849

"name": "A String", # Required. Name of the key.

5850

# This is an arbitrary string used to differentiate different keys.

5851

# A unique key is generated per name: two separate `TransientCryptoKey`

5852

# protos share the same generated key if their names are the same.

5853

# When the data crypto key is generated, this name is not used in any way

5854

# (repeating the api call will result in a different key being generated).

5855

},

5856

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5857

# The wrapped key must be a 128/192/256 bit key.

5858

# Authorization requires the following IAM permissions when sending a request

5859

# to perform a crypto transformation using a kms-wrapped crypto key:

5860

# dlp.kms.encrypt

5861

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5862

"wrappedKey": "A String", # Required. The wrapped data crypto key.

5863

},

5864

},

5865

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

5866

# that the FFX mode natively supports. This happens before/after

5867

# encryption/decryption.

5868

# Each character listed must appear only once.

5869

# Number of characters must be in the range [2, 95].

5870

# This must be encoded as ASCII.

5871

# The order of characters does not matter.

5872

"commonAlphabet": "A String", # Common alphabets.

5873

},

5874

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

5875

# input. Outputs a base64 encoded representation of the encrypted output.

5876

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

5877

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

5878

# This annotation will be applied to the surrogate by prefixing it with

5879

# the name of the custom info type followed by the number of

5880

# characters comprising the surrogate. The following scheme defines the

5881

# format: {info type name}({surrogate character count}):{surrogate}

5882

#

5883

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

5884

# the surrogate is 'abc', the full replacement value

5885

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

5886

#

5887

# This annotation identifies the surrogate when inspecting content using the

5888

# custom info type 'Surrogate'. This facilitates reversal of the

5889

# surrogate when it occurs in free text.

5890

#

5891

# Note: For record transformations where the entire cell in a table is being

5892

# transformed, surrogates are not mandatory. Surrogates are used to denote

5893

# the location of the token and are necessary for re-identification in free

5894

# form text.

5895

#

5896

# In order for inspection to work properly, the name of this info type must

5897

# not occur naturally anywhere in your data; otherwise, inspection may either

5898

#

5899

# - reverse a surrogate that does not correspond to an actual identifier

5900

# - be unable to parse the surrogate and result in an error

5901

#

5902

# Therefore, choose your custom info type name carefully after considering

5903

# what your data looks like. One way to select a name that has a high chance

5904

# of yielding reliable detection is to include one or more unicode characters

5905

# that are highly improbable to exist in your data.

5906

# For example, assuming your data is entered from a regular ASCII keyboard,

5907

# the symbol with the hex code point 29DD might be used like so:

5908

# ⧝MY_TOKEN_TYPE.

5909

"name": "A String", # Name of the information type. Either a name of your choosing when

5910

# creating a CustomInfoType, or one of the names listed

5911

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5912

# a built-in type. InfoType names should conform to the pattern

5913

# `[a-zA-Z0-9_]{1,64}`.

5914

},

5915

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

5916

# referential integrity such that the same identifier in two different

5917

# contexts will be given a distinct surrogate. The context is appended to

5918

# plaintext value being encrypted. On decryption the provided context is

5919

# validated against the value used during encryption. If a context was

5920

# provided during encryption, same context must be provided during decryption

5921

# as well.

5922

#

5923

# If the context is not set, plaintext would be used as is for encryption.

5924

# If the context is set but:

5925

#

5926

# 1. there is no record present when transforming a given value or

5927

# 2. the field is not present when transforming a given value,

5928

#

5929

# plaintext would be used as is for encryption.

5930

#

5931

# Note that case (1) is expected when an `InfoTypeTransformation` is

5932

# applied to both structured and non-structured `ContentItem`s.

5933

"name": "A String", # Name describing the field.

5934

},

5935

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

5936

# a key encryption key (KEK) stored by KMS).

5937

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5938

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5939

# unwrap the data crypto key.

5940

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5941

# leaking the key. Choose another type of key if possible.

5942

"key": "A String", # Required. A 128/192/256 bit key.

5943

},

5944

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5945

# It will be discarded after the request finishes.

5946

"name": "A String", # Required. Name of the key.

5947

# This is an arbitrary string used to differentiate different keys.

5948

# A unique key is generated per name: two separate `TransientCryptoKey`

5949

# protos share the same generated key if their names are the same.

5950

# When the data crypto key is generated, this name is not used in any way

5951

# (repeating the api call will result in a different key being generated).

5952

},

5953

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5954

# The wrapped key must be a 128/192/256 bit key.

5955

# Authorization requires the following IAM permissions when sending a request

5956

# to perform a crypto transformation using a kms-wrapped crypto key:

5957

# dlp.kms.encrypt

5958

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5959

"wrappedKey": "A String", # Required. The wrapped data crypto key.

},

},

},

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

5964

# replacement values are dynamically provided by the user for custom behavior,

5965

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

5966

# This can be used on

5967

# data of type: number, long, string, timestamp.

5968

# If the bound `Value` type differs from the type of data being transformed, we

5969

# will first attempt converting the type of the data to be transformed to match

5970

# the type of the bound before comparing.

5971

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

5972

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

5973

{ # Bucket is represented as a range, along with replacement values.

5974

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

5975

# the default behavior will be to hyphenate the min-max range.

5976

# Note that for the purposes of inspection or transformation, the number

5977

# of bytes considered to comprise a 'Value' is based on its representation

5978

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5979

# 123456789, the number of bytes would be counted as 9, even though an

5980

# int64 only holds up to 8 bytes of data.

5981

"timestampValue": "A String", # timestamp

5982

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5983

# and time zone are either specified elsewhere or are not significant. The date

5984

# is relative to the Proleptic Gregorian Calendar. This can represent:

5985

#

5986

# * A full date, with non-zero year, month and day values

5987

# * A month and day value, with a zero year, e.g. an anniversary

5988

# * A year on its own, with zero month and day values

5989

# * A year and month value, with a zero day, e.g. a credit card expiration date

5990

#

5991

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

5992

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5993

# a year.

5994

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5995

# month and day.

5996

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5997

# if specifying a year by itself or a year and month where the day is not

5998

# significant.

5999

},

6000

"stringValue": "A String", # string

6001

"integerValue": "A String", # integer

6002

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6003

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6004

# types are google.type.Date and `google.protobuf.Timestamp`.

6005

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6006

# to allow the value "24:00:00" for scenarios like business closing time.

6007

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6008

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6009

# allow the value 60 if it allows leap-seconds.

6010

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6011

},

6012

"booleanValue": True or False, # boolean

6013

"floatValue": 3.14, # float

6014

"dayOfWeekValue": "A String", # day of week

6015

},

6016

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

6017

# used.

6018

# Note that for the purposes of inspection or transformation, the number

6019

# of bytes considered to comprise a 'Value' is based on its representation

6020

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6021

# 123456789, the number of bytes would be counted as 9, even though an

6022

# int64 only holds up to 8 bytes of data.

6023

"timestampValue": "A String", # timestamp

6024

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6025

# and time zone are either specified elsewhere or are not significant. The date

6026

# is relative to the Proleptic Gregorian Calendar. This can represent:

6027

#

6028

# * A full date, with non-zero year, month and day values

6029

# * A month and day value, with a zero year, e.g. an anniversary

6030

# * A year on its own, with zero month and day values

6031

# * A year and month value, with a zero day, e.g. a credit card expiration date

6032

#

6033

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6034

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6035

# a year.

6036

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6037

# month and day.

6038

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6039

# if specifying a year by itself or a year and month where the day is not

6040

# significant.

6041

},

6042

"stringValue": "A String", # string

6043

"integerValue": "A String", # integer

6044

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6045

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6046

# types are google.type.Date and `google.protobuf.Timestamp`.

6047

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6048

# to allow the value "24:00:00" for scenarios like business closing time.

6049

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6050

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6051

# allow the value 60 if it allows leap-seconds.

6052

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6053

},

6054

"booleanValue": True or False, # boolean

6055

"floatValue": 3.14, # float

6056

"dayOfWeekValue": "A String", # day of week

6057

},

6058

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

6059

# Note that for the purposes of inspection or transformation, the number

6060

# of bytes considered to comprise a 'Value' is based on its representation

6061

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6062

# 123456789, the number of bytes would be counted as 9, even though an

6063

# int64 only holds up to 8 bytes of data.

6064

"timestampValue": "A String", # timestamp

6065

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6066

# and time zone are either specified elsewhere or are not significant. The date

6067

# is relative to the Proleptic Gregorian Calendar. This can represent:

6068

#

6069

# * A full date, with non-zero year, month and day values

6070

# * A month and day value, with a zero year, e.g. an anniversary

6071

# * A year on its own, with zero month and day values

6072

# * A year and month value, with a zero day, e.g. a credit card expiration date

6073

#

6074

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6075

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6076

# a year.

6077

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6078

# month and day.

6079

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6080

# if specifying a year by itself or a year and month where the day is not

6081

# significant.

6082

},

6083

"stringValue": "A String", # string

6084

"integerValue": "A String", # integer

6085

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6086

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6087

# types are google.type.Date and `google.protobuf.Timestamp`.

6088

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6089

# to allow the value "24:00:00" for scenarios like business closing time.

6090

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6091

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6092

# allow the value 60 if it allows leap-seconds.

6093

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6094

},

6095

"booleanValue": True or False, # boolean

6096

"floatValue": 3.14, # float

6097

"dayOfWeekValue": "A String", # day of week

},

},

],

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

6103

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

6104

# output would be 'My phone number is '.

6105

},

6106

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

6107

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

6108

# Note that for the purposes of inspection or transformation, the number

6109

# of bytes considered to comprise a 'Value' is based on its representation

6110

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6111

# 123456789, the number of bytes would be counted as 9, even though an

6112

# int64 only holds up to 8 bytes of data.

6113

"timestampValue": "A String", # timestamp

6114

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6115

# and time zone are either specified elsewhere or are not significant. The date

6116

# is relative to the Proleptic Gregorian Calendar. This can represent:

6117

#

6118

# * A full date, with non-zero year, month and day values

6119

# * A month and day value, with a zero year, e.g. an anniversary

6120

# * A year on its own, with zero month and day values

6121

# * A year and month value, with a zero day, e.g. a credit card expiration date

6122

#

6123

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6124

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6125

# a year.

6126

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6127

# month and day.

6128

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6129

# if specifying a year by itself or a year and month where the day is not

6130

# significant.

6131

},

6132

"stringValue": "A String", # string

6133

"integerValue": "A String", # integer

6134

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6135

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6136

# types are google.type.Date and `google.protobuf.Timestamp`.

6137

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6138

# to allow the value "24:00:00" for scenarios like business closing time.

6139

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6140

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6141

# allow the value 60 if it allows leap-seconds.

6142

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6143

},

6144

"booleanValue": True or False, # boolean

6145

"floatValue": 3.14, # float

6146

"dayOfWeekValue": "A String", # day of week

6147

},

6148

},

6149

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

6150

# Bucketing transformation can provide all of this functionality,

6151

# but requires more configuration. This message is provided as a convenience to

6152

# the user for simple bucketing strategies.

6153

#

6154

# The transformed value will be a hyphenated string of

6155

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

6156

# all values that are within this bucket will be replaced with "10-20".

6157

#

6158

# This can be used on data of type: double, long.

6159

#

6160

# If the bound Value type differs from the type of data

6161

# being transformed, we will first attempt converting the type of the data to

6162

# be transformed to match the type of the bound before comparing.

6163

#

6164

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

6165

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

6166

# grouped together into a single bucket; for example if `upper_bound` = 89,

6167

# then all values greater than 89 are replaced with the value "89+".

6168

# Note that for the purposes of inspection or transformation, the number

6169

# of bytes considered to comprise a 'Value' is based on its representation

6170

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6171

# 123456789, the number of bytes would be counted as 9, even though an

6172

# int64 only holds up to 8 bytes of data.

6173

"timestampValue": "A String", # timestamp

6174

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6175

# and time zone are either specified elsewhere or are not significant. The date

6176

# is relative to the Proleptic Gregorian Calendar. This can represent:

6177

#

6178

# * A full date, with non-zero year, month and day values

6179

# * A month and day value, with a zero year, e.g. an anniversary

6180

# * A year on its own, with zero month and day values

6181

# * A year and month value, with a zero day, e.g. a credit card expiration date

6182

#

6183

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6184

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6185

# a year.

6186

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6187

# month and day.

6188

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6189

# if specifying a year by itself or a year and month where the day is not

6190

# significant.

6191

},

6192

"stringValue": "A String", # string

6193

"integerValue": "A String", # integer

6194

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6195

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6196

# types are google.type.Date and `google.protobuf.Timestamp`.

6197

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6198

# to allow the value "24:00:00" for scenarios like business closing time.

6199

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6200

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6201

# allow the value 60 if it allows leap-seconds.

6202

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6203

},

6204

"booleanValue": True or False, # boolean

6205

"floatValue": 3.14, # float

6206

"dayOfWeekValue": "A String", # day of week

6207

},

6208

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

6209

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

6210

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

6211

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

6212

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

6213

# grouped together into a single bucket; for example if `lower_bound` = 10,

6214

# then all values less than 10 are replaced with the value "-10".

6215

# Note that for the purposes of inspection or transformation, the number

6216

# of bytes considered to comprise a 'Value' is based on its representation

6217

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6218

# 123456789, the number of bytes would be counted as 9, even though an

6219

# int64 only holds up to 8 bytes of data.

6220

"timestampValue": "A String", # timestamp

6221

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6222

# and time zone are either specified elsewhere or are not significant. The date

6223

# is relative to the Proleptic Gregorian Calendar. This can represent:

6224

#

6225

# * A full date, with non-zero year, month and day values

6226

# * A month and day value, with a zero year, e.g. an anniversary

6227

# * A year on its own, with zero month and day values

6228

# * A year and month value, with a zero day, e.g. a credit card expiration date

6229

#

6230

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6231

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6232

# a year.

6233

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6234

# month and day.

6235

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6236

# if specifying a year by itself or a year and month where the day is not

6237

# significant.

6238

},

6239

"stringValue": "A String", # string

6240

"integerValue": "A String", # integer

6241

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6242

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6243

# types are google.type.Date and `google.protobuf.Timestamp`.

6244

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6245

# to allow the value "24:00:00" for scenarios like business closing time.

6246

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6247

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6248

# allow the value 60 if it allows leap-seconds.

6249

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6250

},

6251

"booleanValue": True or False, # boolean

6252

"floatValue": 3.14, # float

6253

"dayOfWeekValue": "A String", # day of week

6254

},

6255

},

6256

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

6257

# fixed character. Masking can start from the beginning or end of the string.

6258

# This can be used on data of any type (numbers, longs, and so on) and when

6259

# de-identifying structured data we'll attempt to preserve the original data's

6260

# type. (This allows you to take a long like 123 and modify it to a string like

6261

# **3.

6262

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

6263

# characters. For example, if the input string is `555-555-5555` and you

6264

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

6265

# returns `***-**5-5555`.

6266

{ # Characters to skip when doing deidentification of a value. These will be left

6267

# alone and skipped.

6268

"charactersToSkip": "A String", # Characters to not transform when masking.

6269

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

6274

# masked. Skipped characters do not count towards this tally.

6275

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

6276

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

6277

# code or credit card number. This string must have a length of 1. If not

6278

# supplied, this value defaults to `*` for strings, and `0` for digits.

6279

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

6280

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

6281

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

6282

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

6283

# is `true`, then the string `12345` is masked as `12***`.

6284

},

6285

},

6286

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

6287

# this transformation to apply to all findings that correspond to

6288

# infoTypes that were requested in `InspectConfig`.

6289

{ # Type of information detected by the API.

6290

"name": "A String", # Name of the information type. Either a name of your choosing when

6291

# creating a CustomInfoType, or one of the names listed

6292

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6293

# a built-in type. InfoType names should conform to the pattern

6294

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6300

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default

6301

# mode is `TransformationErrorHandling.ThrowError`.

6302

# transformation error occurs when the requested transformation is incompatible

6303

# with the data. For example, trying to de-identify an IP address using a

6304

# `DateShift` transformation would result in a transformation error, since date

6305

# info cannot be extracted from an IP address.

6306

# Information about any incompatible transformations, and how they were

6307

# handled, is returned in the response as part of the

6308

# `TransformationOverviews`.

6309

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

6310

},

6311

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would # Ignore errors

6312

# cause an error. For example, if a `DateShift` transformation were applied

6313

# an an IP address, this mode would leave the IP address unchanged in the

6314

# response.

6315

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6316

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6317

"recordTransformations": { # A type of transformation that is applied over structured data such as a # Treat the dataset as structured. Transformations can be applied to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6318

# specific locations within structured datasets, such as transforming

6319

# a column within a table.

6320

# table.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6321

"fieldTransformations": [ # Transform the record by applying various field transformations.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6322

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6323

"fields": [ # Required. Input field(s) to apply the transformation to.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6324

{ # General identifier of a data field in a storage service.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6325

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6326

},

6327

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6328

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6329

# transform content that matches an `InfoType`.

6330

# apply various `PrimitiveTransformation`s to each finding, where the

6331

# transformation is applied to only values that were identified as a specific

6332

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6333

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6334

# for a given infoType.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6335

{ # A transformation to apply to text that is identified as a specific

6336

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6337

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

6338

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

6339

# portion of the value.

6340

"partToExtract": "A String", # The part of the time to keep.

6341

},

6342

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

6343

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

6344

# to learn more.

6345

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

6346

# If set, must also set cryptoKey. If set, shift will be consistent for the

6347

# given context.

6348

"name": "A String", # Name describing the field.

6349

},

6350

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

6351

# range (inclusive ends). Negative means shift to earlier in time. Must not

6352

# be more than 365250 days (1000 years) each direction.

6353

#

6354

# For example, 3 means shift date to at most 3 days into the future.

6355

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

6356

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

6357

# results in the same shift for the same context and crypto_key. If

6358

# set, must also set context. Can only be applied to table items.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6359

# a key encryption key (KEK) stored by KMS).

6360

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6361

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6362

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6363

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6364

# leaking the key. Choose another type of key if possible.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6365

"key": "A String", # Required. A 128/192/256 bit key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6366

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6367

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6368

# It will be discarded after the request finishes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6369

"name": "A String", # Required. Name of the key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6370

# This is an arbitrary string used to differentiate different keys.

6371

# A unique key is generated per name: two separate `TransientCryptoKey`

6372

# protos share the same generated key if their names are the same.

6373

# When the data crypto key is generated, this name is not used in any way

6374

# (repeating the api call will result in a different key being generated).

6375

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6376

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6377

# The wrapped key must be a 128/192/256 bit key.

6378

# Authorization requires the following IAM permissions when sending a request

6379

# to perform a crypto transformation using a kms-wrapped crypto key:

6380

# dlp.kms.encrypt

6381

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6382

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6383

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6384

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6385

},

6386

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

6387

},

6388

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

6389

# Uses SHA-256.

6390

# The key size must be either 32 or 64 bytes.

6391

# Outputs a base64 encoded representation of the hashed output

6392

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

6393

# Currently, only string and integer values can be hashed.

6394

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

6395

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

6396

# a key encryption key (KEK) stored by KMS).

6397

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6398

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6399

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6400

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6401

# leaking the key. Choose another type of key if possible.

6402

"key": "A String", # Required. A 128/192/256 bit key.

6403

},

6404

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6405

# It will be discarded after the request finishes.

6406

"name": "A String", # Required. Name of the key.

6407

# This is an arbitrary string used to differentiate different keys.

6408

# A unique key is generated per name: two separate `TransientCryptoKey`

6409

# protos share the same generated key if their names are the same.

6410

# When the data crypto key is generated, this name is not used in any way

6411

# (repeating the api call will result in a different key being generated).

6412

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6413

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6414

# The wrapped key must be a 128/192/256 bit key.

6415

# Authorization requires the following IAM permissions when sending a request

6416

# to perform a crypto transformation using a kms-wrapped crypto key:

6417

# dlp.kms.encrypt

6418

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6419

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6420

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6421

},

6422

},

6423

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

6424

# (FPE) with the FFX mode of operation; however when used in the

6425

# `ReidentifyContent` API method, it serves the opposite function by reversing

6426

# the surrogate back into the original identifier. The identifier must be

6427

# encoded as ASCII. For a given crypto key and context, the same identifier

6428

# will be replaced with the same surrogate. Identifiers must be at least two

6429

# characters long. In the case that the identifier is the empty string, it will

6430

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

6431

# more.

6432

#

6433

# Note: We recommend using CryptoDeterministicConfig for all use cases which

6434

# do not require preserving the input alphabet space and size, plus warrant

6435

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6436

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

6437

# This annotation will be applied to the surrogate by prefixing it with

6438

# the name of the custom infoType followed by the number of

6439

# characters comprising the surrogate. The following scheme defines the

6440

# format: info_type_name(surrogate_character_count):surrogate

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6441

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6442

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

6443

# the surrogate is 'abc', the full replacement value

6444

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

6445

#

6446

# This annotation identifies the surrogate when inspecting content using the

6447

# custom infoType

6448

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

6449

# This facilitates reversal of the surrogate when it occurs in free text.

6450

#

6451

# In order for inspection to work properly, the name of this infoType must

6452

# not occur naturally anywhere in your data; otherwise, inspection may

6453

# find a surrogate that does not correspond to an actual identifier.

6454

# Therefore, choose your custom infoType name carefully after considering

6455

# what your data looks like. One way to select a name that has a high chance

6456

# of yielding reliable detection is to include one or more unicode characters

6457

# that are highly improbable to exist in your data.

6458

# For example, assuming your data is entered from a regular ASCII keyboard,

6459

# the symbol with the hex code point 29DD might be used like so:

6460

# ⧝MY_TOKEN_TYPE

6461

"name": "A String", # Name of the information type. Either a name of your choosing when

6462

# creating a CustomInfoType, or one of the names listed

6463

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6464

# a built-in type. InfoType names should conform to the pattern

6465

# `[a-zA-Z0-9_]{1,64}`.

6466

},

6467

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

6468

# identifier in two different contexts won't be given the same surrogate. If

6469

# the context is not set, a default tweak will be used.

6470

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6471

# If the context is set but:

6472

#

6473

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6474

# 1. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6475

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6476

# a default tweak will be used.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6477

#

6478

# Note that case (1) is expected when an `InfoTypeTransformation` is

6479

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6480

# Currently, the referenced field may be of value type integer or string.

6481

#

6482

# The tweak is constructed as a sequence of bytes in big endian byte order

6483

# such that:

6484

#

6485

# - a 64 bit integer is encoded followed by a single byte of value 1

6486

# - a string is encoded in UTF-8 format followed by a single byte of value 2

6487

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6488

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6489

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

6490

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

6491

# a key encryption key (KEK) stored by KMS).

6492

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6493

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6494

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6495

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6496

# leaking the key. Choose another type of key if possible.

6497

"key": "A String", # Required. A 128/192/256 bit key.

6498

},

6499

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6500

# It will be discarded after the request finishes.

6501

"name": "A String", # Required. Name of the key.

6502

# This is an arbitrary string used to differentiate different keys.

6503

# A unique key is generated per name: two separate `TransientCryptoKey`

6504

# protos share the same generated key if their names are the same.

6505

# When the data crypto key is generated, this name is not used in any way

6506

# (repeating the api call will result in a different key being generated).

6507

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6508

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6509

# The wrapped key must be a 128/192/256 bit key.

6510

# Authorization requires the following IAM permissions when sending a request

6511

# to perform a crypto transformation using a kms-wrapped crypto key:

6512

# dlp.kms.encrypt

6513

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6514

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6515

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6516

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6517

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

6518

# that the FFX mode natively supports. This happens before/after

6519

# encryption/decryption.

6520

# Each character listed must appear only once.

6521

# Number of characters must be in the range [2, 95].

6522

# This must be encoded as ASCII.

6523

# The order of characters does not matter.

6524

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6525

},

6526

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

6527

# input. Outputs a base64 encoded representation of the encrypted output.

6528

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

6529

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6530

# This annotation will be applied to the surrogate by prefixing it with

6531

# the name of the custom info type followed by the number of

6532

# characters comprising the surrogate. The following scheme defines the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6533

# format: {info type name}({surrogate character count}):{surrogate}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6534

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6535

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

6536

# the surrogate is 'abc', the full replacement value

6537

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6538

#

6539

# This annotation identifies the surrogate when inspecting content using the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6540

# custom info type 'Surrogate'. This facilitates reversal of the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6541

# surrogate when it occurs in free text.

6542

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6543

# Note: For record transformations where the entire cell in a table is being

6544

# transformed, surrogates are not mandatory. Surrogates are used to denote

6545

# the location of the token and are necessary for re-identification in free

6546

# form text.

6547

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6548

# In order for inspection to work properly, the name of this info type must

6549

# not occur naturally anywhere in your data; otherwise, inspection may either

6550

#

6551

# - reverse a surrogate that does not correspond to an actual identifier

6552

# - be unable to parse the surrogate and result in an error

6553

#

6554

# Therefore, choose your custom info type name carefully after considering

6555

# what your data looks like. One way to select a name that has a high chance

6556

# of yielding reliable detection is to include one or more unicode characters

6557

# that are highly improbable to exist in your data.

6558

# For example, assuming your data is entered from a regular ASCII keyboard,

6559

# the symbol with the hex code point 29DD might be used like so:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6560

# ⧝MY_TOKEN_TYPE.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6561

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6562

# creating a CustomInfoType, or one of the names listed

6563

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6564

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6565

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6566

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6567

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

6568

# referential integrity such that the same identifier in two different

6569

# contexts will be given a distinct surrogate. The context is appended to

6570

# plaintext value being encrypted. On decryption the provided context is

6571

# validated against the value used during encryption. If a context was

6572

# provided during encryption, same context must be provided during decryption

6573

# as well.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6574

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6575

# If the context is not set, plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6576

# If the context is set but:

6577

#

6578

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6579

# 2. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6580

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6581

# plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6582

#

6583

# Note that case (1) is expected when an `InfoTypeTransformation` is

6584

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6585

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6586

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6587

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

6588

# a key encryption key (KEK) stored by KMS).

6589

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6590

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6591

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6592

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6593

# leaking the key. Choose another type of key if possible.

6594

"key": "A String", # Required. A 128/192/256 bit key.

6595

},

6596

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6597

# It will be discarded after the request finishes.

6598

"name": "A String", # Required. Name of the key.

6599

# This is an arbitrary string used to differentiate different keys.

6600

# A unique key is generated per name: two separate `TransientCryptoKey`

6601

# protos share the same generated key if their names are the same.

6602

# When the data crypto key is generated, this name is not used in any way

6603

# (repeating the api call will result in a different key being generated).

6604

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6605

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6606

# The wrapped key must be a 128/192/256 bit key.

6607

# Authorization requires the following IAM permissions when sending a request

6608

# to perform a crypto transformation using a kms-wrapped crypto key:

6609

# dlp.kms.encrypt

6610

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6611

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6612

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6613

},

6614

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6615

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6616

# replacement values are dynamically provided by the user for custom behavior,

6617

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

6618

# This can be used on

6619

# data of type: number, long, string, timestamp.

6620

# If the bound `Value` type differs from the type of data being transformed, we

6621

# will first attempt converting the type of the data to be transformed to match

6622

# the type of the bound before comparing.

6623

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6624

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6625

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6626

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

6627

# the default behavior will be to hyphenate the min-max range.

6628

# Note that for the purposes of inspection or transformation, the number

6629

# of bytes considered to comprise a 'Value' is based on its representation

6630

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6631

# 123456789, the number of bytes would be counted as 9, even though an

6632

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6633

"timestampValue": "A String", # timestamp

6634

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6635

# and time zone are either specified elsewhere or are not significant. The date

6636

# is relative to the Proleptic Gregorian Calendar. This can represent:

6637

#

6638

# * A full date, with non-zero year, month and day values

6639

# * A month and day value, with a zero year, e.g. an anniversary

6640

# * A year on its own, with zero month and day values

6641

# * A year and month value, with a zero day, e.g. a credit card expiration date

6642

#

6643

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6644

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6645

# a year.

6646

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6647

# month and day.

6648

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6649

# if specifying a year by itself or a year and month where the day is not

6650

# significant.

6651

},

6652

"stringValue": "A String", # string

6653

"integerValue": "A String", # integer

6654

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6655

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6656

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6657

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6658

# to allow the value "24:00:00" for scenarios like business closing time.

6659

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6660

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6661

# allow the value 60 if it allows leap-seconds.

6662

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6663

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6664

"booleanValue": True or False, # boolean

6665

"floatValue": 3.14, # float

6666

"dayOfWeekValue": "A String", # day of week

6667

},

6668

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

6669

# used.

6670

# Note that for the purposes of inspection or transformation, the number

6671

# of bytes considered to comprise a 'Value' is based on its representation

6672

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6673

# 123456789, the number of bytes would be counted as 9, even though an

6674

# int64 only holds up to 8 bytes of data.

6675

"timestampValue": "A String", # timestamp

6676

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6677

# and time zone are either specified elsewhere or are not significant. The date

6678

# is relative to the Proleptic Gregorian Calendar. This can represent:

6679

#

6680

# * A full date, with non-zero year, month and day values

6681

# * A month and day value, with a zero year, e.g. an anniversary

6682

# * A year on its own, with zero month and day values

6683

# * A year and month value, with a zero day, e.g. a credit card expiration date

6684

#

6685

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6686

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6687

# a year.

6688

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6689

# month and day.

6690

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6691

# if specifying a year by itself or a year and month where the day is not

6692

# significant.

6693

},

6694

"stringValue": "A String", # string

6695

"integerValue": "A String", # integer

6696

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6697

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6698

# types are google.type.Date and `google.protobuf.Timestamp`.

6699

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6700

# to allow the value "24:00:00" for scenarios like business closing time.

6701

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6702

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6703

# allow the value 60 if it allows leap-seconds.

6704

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6705

},

6706

"booleanValue": True or False, # boolean

6707

"floatValue": 3.14, # float

6708

"dayOfWeekValue": "A String", # day of week

6709

},

6710

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

6711

# Note that for the purposes of inspection or transformation, the number

6712

# of bytes considered to comprise a 'Value' is based on its representation

6713

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6714

# 123456789, the number of bytes would be counted as 9, even though an

6715

# int64 only holds up to 8 bytes of data.

6716

"timestampValue": "A String", # timestamp

6717

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6718

# and time zone are either specified elsewhere or are not significant. The date

6719

# is relative to the Proleptic Gregorian Calendar. This can represent:

6720

#

6721

# * A full date, with non-zero year, month and day values

6722

# * A month and day value, with a zero year, e.g. an anniversary

6723

# * A year on its own, with zero month and day values

6724

# * A year and month value, with a zero day, e.g. a credit card expiration date

6725

#

6726

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6727

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6728

# a year.

6729

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6730

# month and day.

6731

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6732

# if specifying a year by itself or a year and month where the day is not

6733

# significant.

6734

},

6735

"stringValue": "A String", # string

6736

"integerValue": "A String", # integer

6737

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6738

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6739

# types are google.type.Date and `google.protobuf.Timestamp`.

6740

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6741

# to allow the value "24:00:00" for scenarios like business closing time.

6742

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6743

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6744

# allow the value 60 if it allows leap-seconds.

6745

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6746

},

6747

"booleanValue": True or False, # boolean

6748

"floatValue": 3.14, # float

6749

"dayOfWeekValue": "A String", # day of week

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6754

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

6755

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

6756

# output would be 'My phone number is '.

6757

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6758

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

6759

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6760

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6761

# of bytes considered to comprise a 'Value' is based on its representation

6762

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6763

# 123456789, the number of bytes would be counted as 9, even though an

6764

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6765

"timestampValue": "A String", # timestamp

6766

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6767

# and time zone are either specified elsewhere or are not significant. The date

6768

# is relative to the Proleptic Gregorian Calendar. This can represent:

6769

#

6770

# * A full date, with non-zero year, month and day values

6771

# * A month and day value, with a zero year, e.g. an anniversary

6772

# * A year on its own, with zero month and day values

6773

# * A year and month value, with a zero day, e.g. a credit card expiration date

6774

#

6775

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6776

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6777

# a year.

6778

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6779

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6780

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6781

# if specifying a year by itself or a year and month where the day is not

6782

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6783

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6784

"stringValue": "A String", # string

6785

"integerValue": "A String", # integer

6786

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6787

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6788

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6789

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6790

# to allow the value "24:00:00" for scenarios like business closing time.

6791

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6792

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6793

# allow the value 60 if it allows leap-seconds.

6794

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6795

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6796

"booleanValue": True or False, # boolean

6797

"floatValue": 3.14, # float

6798

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6799

},

6800

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6801

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

6802

# Bucketing transformation can provide all of this functionality,

6803

# but requires more configuration. This message is provided as a convenience to

6804

# the user for simple bucketing strategies.

6805

#

6806

# The transformed value will be a hyphenated string of

6807

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

6808

# all values that are within this bucket will be replaced with "10-20".

6809

#

6810

# This can be used on data of type: double, long.

6811

#

6812

# If the bound Value type differs from the type of data

6813

# being transformed, we will first attempt converting the type of the data to

6814

# be transformed to match the type of the bound before comparing.

6815

#

6816

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6817

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

6818

# grouped together into a single bucket; for example if `upper_bound` = 89,

6819

# then all values greater than 89 are replaced with the value "89+".

6820

# Note that for the purposes of inspection or transformation, the number

6821

# of bytes considered to comprise a 'Value' is based on its representation

6822

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6823

# 123456789, the number of bytes would be counted as 9, even though an

6824

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6825

"timestampValue": "A String", # timestamp

6826

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6827

# and time zone are either specified elsewhere or are not significant. The date

6828

# is relative to the Proleptic Gregorian Calendar. This can represent:

6829

#

6830

# * A full date, with non-zero year, month and day values

6831

# * A month and day value, with a zero year, e.g. an anniversary

6832

# * A year on its own, with zero month and day values

6833

# * A year and month value, with a zero day, e.g. a credit card expiration date

6834

#

6835

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6836

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6837

# a year.

6838

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6839

# month and day.

6840

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6841

# if specifying a year by itself or a year and month where the day is not

6842

# significant.

6843

},

6844

"stringValue": "A String", # string

6845

"integerValue": "A String", # integer

6846

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6847

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6848

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6849

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6850

# to allow the value "24:00:00" for scenarios like business closing time.

6851

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6852

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6853

# allow the value 60 if it allows leap-seconds.

6854

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6855

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6856

"booleanValue": True or False, # boolean

6857

"floatValue": 3.14, # float

6858

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6859

},

6860

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

6861

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

6862

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

6863

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6864

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

6865

# grouped together into a single bucket; for example if `lower_bound` = 10,

6866

# then all values less than 10 are replaced with the value "-10".

6867

# Note that for the purposes of inspection or transformation, the number

6868

# of bytes considered to comprise a 'Value' is based on its representation

6869

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6870

# 123456789, the number of bytes would be counted as 9, even though an

6871

# int64 only holds up to 8 bytes of data.

6872

"timestampValue": "A String", # timestamp

6873

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6874

# and time zone are either specified elsewhere or are not significant. The date

6875

# is relative to the Proleptic Gregorian Calendar. This can represent:

6876

#

6877

# * A full date, with non-zero year, month and day values

6878

# * A month and day value, with a zero year, e.g. an anniversary

6879

# * A year on its own, with zero month and day values

6880

# * A year and month value, with a zero day, e.g. a credit card expiration date

6881

#

6882

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6883

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6884

# a year.

6885

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6886

# month and day.

6887

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6888

# if specifying a year by itself or a year and month where the day is not

6889

# significant.

6890

},

6891

"stringValue": "A String", # string

6892

"integerValue": "A String", # integer

6893

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6894

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6895

# types are google.type.Date and `google.protobuf.Timestamp`.

6896

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6897

# to allow the value "24:00:00" for scenarios like business closing time.

6898

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6899

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6900

# allow the value 60 if it allows leap-seconds.

6901

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6902

},

6903

"booleanValue": True or False, # boolean

6904

"floatValue": 3.14, # float

6905

"dayOfWeekValue": "A String", # day of week

6906

},

6907

},

6908

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

6909

# fixed character. Masking can start from the beginning or end of the string.

6910

# This can be used on data of any type (numbers, longs, and so on) and when

6911

# de-identifying structured data we'll attempt to preserve the original data's

6912

# type. (This allows you to take a long like 123 and modify it to a string like

6913

# **3.

6914

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

6915

# characters. For example, if the input string is `555-555-5555` and you

6916

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

6917

# returns `***-**5-5555`.

6918

{ # Characters to skip when doing deidentification of a value. These will be left

6919

# alone and skipped.

6920

"charactersToSkip": "A String", # Characters to not transform when masking.

6921

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

6926

# masked. Skipped characters do not count towards this tally.

6927

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

6928

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

6929

# code or credit card number. This string must have a length of 1. If not

6930

# supplied, this value defaults to `*` for strings, and `0` for digits.

6931

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

6932

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

6933

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

6934

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

6935

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6936

},

6937

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6938

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

6939

# this transformation to apply to all findings that correspond to

6940

# infoTypes that were requested in `InspectConfig`.

6941

{ # Type of information detected by the API.

6942

"name": "A String", # Name of the information type. Either a name of your choosing when

6943

# creating a CustomInfoType, or one of the names listed

6944

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6945

# a built-in type. InfoType names should conform to the pattern

6946

# `[a-zA-Z0-9_]{1,64}`.

6947

},

6948

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

6953

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

6954

# portion of the value.

6955

"partToExtract": "A String", # The part of the time to keep.

6956

},

6957

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

6958

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

6959

# to learn more.

6960

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

6961

# If set, must also set cryptoKey. If set, shift will be consistent for the

6962

# given context.

6963

"name": "A String", # Name describing the field.

6964

},

6965

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

6966

# range (inclusive ends). Negative means shift to earlier in time. Must not

6967

# be more than 365250 days (1000 years) each direction.

6968

#

6969

# For example, 3 means shift date to at most 3 days into the future.

6970

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

6971

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

6972

# results in the same shift for the same context and crypto_key. If

6973

# set, must also set context. Can only be applied to table items.

6974

# a key encryption key (KEK) stored by KMS).

6975

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6976

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6977

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6978

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6979

# leaking the key. Choose another type of key if possible.

6980

"key": "A String", # Required. A 128/192/256 bit key.

6981

},

6982

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6983

# It will be discarded after the request finishes.

6984

"name": "A String", # Required. Name of the key.

6985

# This is an arbitrary string used to differentiate different keys.

6986

# A unique key is generated per name: two separate `TransientCryptoKey`

6987

# protos share the same generated key if their names are the same.

6988

# When the data crypto key is generated, this name is not used in any way

6989

# (repeating the api call will result in a different key being generated).

6990

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

6991

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6992

# The wrapped key must be a 128/192/256 bit key.

6993

# Authorization requires the following IAM permissions when sending a request

6994

# to perform a crypto transformation using a kms-wrapped crypto key:

6995

# dlp.kms.encrypt

6996

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6997

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6998

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6999

},

7000

},

7001

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

7002

},

7003

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

7004

# Uses SHA-256.

7005

# The key size must be either 32 or 64 bytes.

7006

# Outputs a base64 encoded representation of the hashed output

7007

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

7008

# Currently, only string and integer values can be hashed.

7009

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

7010

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

7011

# a key encryption key (KEK) stored by KMS).

7012

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7013

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7014

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7015

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7016

# leaking the key. Choose another type of key if possible.

7017

"key": "A String", # Required. A 128/192/256 bit key.

7018

},

7019

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7020

# It will be discarded after the request finishes.

7021

"name": "A String", # Required. Name of the key.

7022

# This is an arbitrary string used to differentiate different keys.

7023

# A unique key is generated per name: two separate `TransientCryptoKey`

7024

# protos share the same generated key if their names are the same.

7025

# When the data crypto key is generated, this name is not used in any way

7026

# (repeating the api call will result in a different key being generated).

7027

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7028

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7029

# The wrapped key must be a 128/192/256 bit key.

7030

# Authorization requires the following IAM permissions when sending a request

7031

# to perform a crypto transformation using a kms-wrapped crypto key:

7032

# dlp.kms.encrypt

7033

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7034

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7035

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7036

},

7037

},

7038

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

7039

# (FPE) with the FFX mode of operation; however when used in the

7040

# `ReidentifyContent` API method, it serves the opposite function by reversing

7041

# the surrogate back into the original identifier. The identifier must be

7042

# encoded as ASCII. For a given crypto key and context, the same identifier

7043

# will be replaced with the same surrogate. Identifiers must be at least two

7044

# characters long. In the case that the identifier is the empty string, it will

7045

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

7046

# more.

7047

#

7048

# Note: We recommend using CryptoDeterministicConfig for all use cases which

7049

# do not require preserving the input alphabet space and size, plus warrant

7050

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7051

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

7052

# This annotation will be applied to the surrogate by prefixing it with

7053

# the name of the custom infoType followed by the number of

7054

# characters comprising the surrogate. The following scheme defines the

7055

# format: info_type_name(surrogate_character_count):surrogate

7056

#

7057

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

7058

# the surrogate is 'abc', the full replacement value

7059

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

7060

#

7061

# This annotation identifies the surrogate when inspecting content using the

7062

# custom infoType

7063

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

7064

# This facilitates reversal of the surrogate when it occurs in free text.

7065

#

7066

# In order for inspection to work properly, the name of this infoType must

7067

# not occur naturally anywhere in your data; otherwise, inspection may

7068

# find a surrogate that does not correspond to an actual identifier.

7069

# Therefore, choose your custom infoType name carefully after considering

7070

# what your data looks like. One way to select a name that has a high chance

7071

# of yielding reliable detection is to include one or more unicode characters

7072

# that are highly improbable to exist in your data.

7073

# For example, assuming your data is entered from a regular ASCII keyboard,

7074

# the symbol with the hex code point 29DD might be used like so:

7075

# ⧝MY_TOKEN_TYPE

7076

"name": "A String", # Name of the information type. Either a name of your choosing when

7077

# creating a CustomInfoType, or one of the names listed

7078

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

7079

# a built-in type. InfoType names should conform to the pattern

7080

# `[a-zA-Z0-9_]{1,64}`.

7081

},

7082

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

7083

# identifier in two different contexts won't be given the same surrogate. If

7084

# the context is not set, a default tweak will be used.

7085

#

7086

# If the context is set but:

7087

#

7088

# 1. there is no record present when transforming a given value or

7089

# 1. the field is not present when transforming a given value,

7090

#

7091

# a default tweak will be used.

7092

#

7093

# Note that case (1) is expected when an `InfoTypeTransformation` is

7094

# applied to both structured and non-structured `ContentItem`s.

7095

# Currently, the referenced field may be of value type integer or string.

7096

#

7097

# The tweak is constructed as a sequence of bytes in big endian byte order

7098

# such that:

7099

#

7100

# - a 64 bit integer is encoded followed by a single byte of value 1

7101

# - a string is encoded in UTF-8 format followed by a single byte of value 2

7102

"name": "A String", # Name describing the field.

7103

},

7104

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

7105

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

7106

# a key encryption key (KEK) stored by KMS).

7107

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7108

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7109

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7110

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7111

# leaking the key. Choose another type of key if possible.

7112

"key": "A String", # Required. A 128/192/256 bit key.

7113

},

7114

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7115

# It will be discarded after the request finishes.

7116

"name": "A String", # Required. Name of the key.

7117

# This is an arbitrary string used to differentiate different keys.

7118

# A unique key is generated per name: two separate `TransientCryptoKey`

7119

# protos share the same generated key if their names are the same.

7120

# When the data crypto key is generated, this name is not used in any way

7121

# (repeating the api call will result in a different key being generated).

7122

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7123

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7124

# The wrapped key must be a 128/192/256 bit key.

7125

# Authorization requires the following IAM permissions when sending a request

7126

# to perform a crypto transformation using a kms-wrapped crypto key:

7127

# dlp.kms.encrypt

7128

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7129

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7130

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7131

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7132

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

7133

# that the FFX mode natively supports. This happens before/after

7134

# encryption/decryption.

7135

# Each character listed must appear only once.

7136

# Number of characters must be in the range [2, 95].

7137

# This must be encoded as ASCII.

7138

# The order of characters does not matter.

7139

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7140

},

7141

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

7142

# input. Outputs a base64 encoded representation of the encrypted output.

7143

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

7144

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

7145

# This annotation will be applied to the surrogate by prefixing it with

7146

# the name of the custom info type followed by the number of

7147

# characters comprising the surrogate. The following scheme defines the

7148

# format: {info type name}({surrogate character count}):{surrogate}

7149

#

7150

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

7151

# the surrogate is 'abc', the full replacement value

7152

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

7153

#

7154

# This annotation identifies the surrogate when inspecting content using the

7155

# custom info type 'Surrogate'. This facilitates reversal of the

7156

# surrogate when it occurs in free text.

7157

#

7158

# Note: For record transformations where the entire cell in a table is being

7159

# transformed, surrogates are not mandatory. Surrogates are used to denote

7160

# the location of the token and are necessary for re-identification in free

7161

# form text.

7162

#

7163

# In order for inspection to work properly, the name of this info type must

7164

# not occur naturally anywhere in your data; otherwise, inspection may either

7165

#

7166

# - reverse a surrogate that does not correspond to an actual identifier

7167

# - be unable to parse the surrogate and result in an error

7168

#

7169

# Therefore, choose your custom info type name carefully after considering

7170

# what your data looks like. One way to select a name that has a high chance

7171

# of yielding reliable detection is to include one or more unicode characters

7172

# that are highly improbable to exist in your data.

7173

# For example, assuming your data is entered from a regular ASCII keyboard,

7174

# the symbol with the hex code point 29DD might be used like so:

7175

# ⧝MY_TOKEN_TYPE.

7176

"name": "A String", # Name of the information type. Either a name of your choosing when

7177

# creating a CustomInfoType, or one of the names listed

7178

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

7179

# a built-in type. InfoType names should conform to the pattern

7180

# `[a-zA-Z0-9_]{1,64}`.

7181

},

7182

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

7183

# referential integrity such that the same identifier in two different

7184

# contexts will be given a distinct surrogate. The context is appended to

7185

# plaintext value being encrypted. On decryption the provided context is

7186

# validated against the value used during encryption. If a context was

7187

# provided during encryption, same context must be provided during decryption

7188

# as well.

7189

#

7190

# If the context is not set, plaintext would be used as is for encryption.

7191

# If the context is set but:

7192

#

7193

# 1. there is no record present when transforming a given value or

7194

# 2. the field is not present when transforming a given value,

7195

#

7196

# plaintext would be used as is for encryption.

7197

#

7198

# Note that case (1) is expected when an `InfoTypeTransformation` is

7199

# applied to both structured and non-structured `ContentItem`s.

7200

"name": "A String", # Name describing the field.

7201

},

7202

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

7203

# a key encryption key (KEK) stored by KMS).

7204

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7205

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7206

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7207

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7208

# leaking the key. Choose another type of key if possible.

7209

"key": "A String", # Required. A 128/192/256 bit key.

7210

},

7211

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7212

# It will be discarded after the request finishes.

7213

"name": "A String", # Required. Name of the key.

7214

# This is an arbitrary string used to differentiate different keys.

7215

# A unique key is generated per name: two separate `TransientCryptoKey`

7216

# protos share the same generated key if their names are the same.

7217

# When the data crypto key is generated, this name is not used in any way

7218

# (repeating the api call will result in a different key being generated).

7219

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7220

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7221

# The wrapped key must be a 128/192/256 bit key.

7222

# Authorization requires the following IAM permissions when sending a request

7223

# to perform a crypto transformation using a kms-wrapped crypto key:

7224

# dlp.kms.encrypt

7225

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7226

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7227

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7228

},

7229

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7230

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

7231

# replacement values are dynamically provided by the user for custom behavior,

7232

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

7233

# This can be used on

7234

# data of type: number, long, string, timestamp.

7235

# If the bound `Value` type differs from the type of data being transformed, we

7236

# will first attempt converting the type of the data to be transformed to match

7237

# the type of the bound before comparing.

7238

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

7239

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

7240

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7241

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

7242

# the default behavior will be to hyphenate the min-max range.

7243

# Note that for the purposes of inspection or transformation, the number

7244

# of bytes considered to comprise a 'Value' is based on its representation

7245

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7246

# 123456789, the number of bytes would be counted as 9, even though an

7247

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7248

"timestampValue": "A String", # timestamp

7249

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7250

# and time zone are either specified elsewhere or are not significant. The date

7251

# is relative to the Proleptic Gregorian Calendar. This can represent:

7252

#

7253

# * A full date, with non-zero year, month and day values

7254

# * A month and day value, with a zero year, e.g. an anniversary

7255

# * A year on its own, with zero month and day values

7256

# * A year and month value, with a zero day, e.g. a credit card expiration date

7257

#

7258

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7259

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7260

# a year.

7261

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7262

# month and day.

7263

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7264

# if specifying a year by itself or a year and month where the day is not

7265

# significant.

7266

},

7267

"stringValue": "A String", # string

7268

"integerValue": "A String", # integer

7269

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7270

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7271

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7272

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7273

# to allow the value "24:00:00" for scenarios like business closing time.

7274

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7275

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7276

# allow the value 60 if it allows leap-seconds.

7277

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7278

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7279

"booleanValue": True or False, # boolean

7280

"floatValue": 3.14, # float

7281

"dayOfWeekValue": "A String", # day of week

7282

},

7283

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

7284

# used.

7285

# Note that for the purposes of inspection or transformation, the number

7286

# of bytes considered to comprise a 'Value' is based on its representation

7287

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7288

# 123456789, the number of bytes would be counted as 9, even though an

7289

# int64 only holds up to 8 bytes of data.

7290

"timestampValue": "A String", # timestamp

7291

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7292

# and time zone are either specified elsewhere or are not significant. The date

7293

# is relative to the Proleptic Gregorian Calendar. This can represent:

7294

#

7295

# * A full date, with non-zero year, month and day values

7296

# * A month and day value, with a zero year, e.g. an anniversary

7297

# * A year on its own, with zero month and day values

7298

# * A year and month value, with a zero day, e.g. a credit card expiration date

7299

#

7300

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7301

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7302

# a year.

7303

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7304

# month and day.

7305

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7306

# if specifying a year by itself or a year and month where the day is not

7307

# significant.

7308

},

7309

"stringValue": "A String", # string

7310

"integerValue": "A String", # integer

7311

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7312

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7313

# types are google.type.Date and `google.protobuf.Timestamp`.

7314

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7315

# to allow the value "24:00:00" for scenarios like business closing time.

7316

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7317

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7318

# allow the value 60 if it allows leap-seconds.

7319

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7320

},

7321

"booleanValue": True or False, # boolean

7322

"floatValue": 3.14, # float

7323

"dayOfWeekValue": "A String", # day of week

7324

},

7325

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

7326

# Note that for the purposes of inspection or transformation, the number

7327

# of bytes considered to comprise a 'Value' is based on its representation

7328

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7329

# 123456789, the number of bytes would be counted as 9, even though an

7330

# int64 only holds up to 8 bytes of data.

7331

"timestampValue": "A String", # timestamp

7332

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7333

# and time zone are either specified elsewhere or are not significant. The date

7334

# is relative to the Proleptic Gregorian Calendar. This can represent:

7335

#

7336

# * A full date, with non-zero year, month and day values

7337

# * A month and day value, with a zero year, e.g. an anniversary

7338

# * A year on its own, with zero month and day values

7339

# * A year and month value, with a zero day, e.g. a credit card expiration date

7340

#

7341

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7342

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7343

# a year.

7344

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7345

# month and day.

7346

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7347

# if specifying a year by itself or a year and month where the day is not

7348

# significant.

7349

},

7350

"stringValue": "A String", # string

7351

"integerValue": "A String", # integer

7352

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7353

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7354

# types are google.type.Date and `google.protobuf.Timestamp`.

7355

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7356

# to allow the value "24:00:00" for scenarios like business closing time.

7357

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7358

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7359

# allow the value 60 if it allows leap-seconds.

7360

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7361

},

7362

"booleanValue": True or False, # boolean

7363

"floatValue": 3.14, # float

7364

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7365

},

7366

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7367

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7368

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7369

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

7370

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

7371

# output would be 'My phone number is '.

7372

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7373

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

7374

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

7375

# Note that for the purposes of inspection or transformation, the number

7376

# of bytes considered to comprise a 'Value' is based on its representation

7377

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7378

# 123456789, the number of bytes would be counted as 9, even though an

7379

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7380

"timestampValue": "A String", # timestamp

7381

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7382

# and time zone are either specified elsewhere or are not significant. The date

7383

# is relative to the Proleptic Gregorian Calendar. This can represent:

7384

#

7385

# * A full date, with non-zero year, month and day values

7386

# * A month and day value, with a zero year, e.g. an anniversary

7387

# * A year on its own, with zero month and day values

7388

# * A year and month value, with a zero day, e.g. a credit card expiration date

7389

#

7390

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7391

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7392

# a year.

7393

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7394

# month and day.

7395

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7396

# if specifying a year by itself or a year and month where the day is not

7397

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7398

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7399

"stringValue": "A String", # string

7400

"integerValue": "A String", # integer

7401

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7402

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7403

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7404

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7405

# to allow the value "24:00:00" for scenarios like business closing time.

7406

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7407

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7408

# allow the value 60 if it allows leap-seconds.

7409

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7410

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7411

"booleanValue": True or False, # boolean

7412

"floatValue": 3.14, # float

7413

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7414

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7415

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7416

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

7417

# Bucketing transformation can provide all of this functionality,

7418

# but requires more configuration. This message is provided as a convenience to

7419

# the user for simple bucketing strategies.

7420

#

7421

# The transformed value will be a hyphenated string of

7422

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

7423

# all values that are within this bucket will be replaced with "10-20".

7424

#

7425

# This can be used on data of type: double, long.

7426

#

7427

# If the bound Value type differs from the type of data

7428

# being transformed, we will first attempt converting the type of the data to

7429

# be transformed to match the type of the bound before comparing.

7430

#

7431

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7432

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

7433

# grouped together into a single bucket; for example if `upper_bound` = 89,

7434

# then all values greater than 89 are replaced with the value "89+".

7435

# Note that for the purposes of inspection or transformation, the number

7436

# of bytes considered to comprise a 'Value' is based on its representation

7437

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7438

# 123456789, the number of bytes would be counted as 9, even though an

7439

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7440

"timestampValue": "A String", # timestamp

7441

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7442

# and time zone are either specified elsewhere or are not significant. The date

7443

# is relative to the Proleptic Gregorian Calendar. This can represent:

7444

#

7445

# * A full date, with non-zero year, month and day values

7446

# * A month and day value, with a zero year, e.g. an anniversary

7447

# * A year on its own, with zero month and day values

7448

# * A year and month value, with a zero day, e.g. a credit card expiration date

7449

#

7450

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7451

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7452

# a year.

7453

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7454

# month and day.

7455

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7456

# if specifying a year by itself or a year and month where the day is not

7457

# significant.

7458

},

7459

"stringValue": "A String", # string

7460

"integerValue": "A String", # integer

7461

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7462

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7463

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7464

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7465

# to allow the value "24:00:00" for scenarios like business closing time.

7466

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7467

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7468

# allow the value 60 if it allows leap-seconds.

7469

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7470

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7471

"booleanValue": True or False, # boolean

7472

"floatValue": 3.14, # float

7473

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7474

},

7475

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

7476

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

7477

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

7478

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7479

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

7480

# grouped together into a single bucket; for example if `lower_bound` = 10,

7481

# then all values less than 10 are replaced with the value "-10".

7482

# Note that for the purposes of inspection or transformation, the number

7483

# of bytes considered to comprise a 'Value' is based on its representation

7484

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7485

# 123456789, the number of bytes would be counted as 9, even though an

7486

# int64 only holds up to 8 bytes of data.

7487

"timestampValue": "A String", # timestamp

7488

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7489

# and time zone are either specified elsewhere or are not significant. The date

7490

# is relative to the Proleptic Gregorian Calendar. This can represent:

7491

#

7492

# * A full date, with non-zero year, month and day values

7493

# * A month and day value, with a zero year, e.g. an anniversary

7494

# * A year on its own, with zero month and day values

7495

# * A year and month value, with a zero day, e.g. a credit card expiration date

7496

#

7497

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7498

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7499

# a year.

7500

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7501

# month and day.

7502

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7503

# if specifying a year by itself or a year and month where the day is not

7504

# significant.

7505

},

7506

"stringValue": "A String", # string

7507

"integerValue": "A String", # integer

7508

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7509

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7510

# types are google.type.Date and `google.protobuf.Timestamp`.

7511

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7512

# to allow the value "24:00:00" for scenarios like business closing time.

7513

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7514

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7515

# allow the value 60 if it allows leap-seconds.

7516

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7517

},

7518

"booleanValue": True or False, # boolean

7519

"floatValue": 3.14, # float

7520

"dayOfWeekValue": "A String", # day of week

7521

},

7522

},

7523

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

7524

# fixed character. Masking can start from the beginning or end of the string.

7525

# This can be used on data of any type (numbers, longs, and so on) and when

7526

# de-identifying structured data we'll attempt to preserve the original data's

7527

# type. (This allows you to take a long like 123 and modify it to a string like

7528

# **3.

7529

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

7530

# characters. For example, if the input string is `555-555-5555` and you

7531

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

7532

# returns `***-**5-5555`.

7533

{ # Characters to skip when doing deidentification of a value. These will be left

7534

# alone and skipped.

7535

"charactersToSkip": "A String", # Characters to not transform when masking.

7536

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

7541

# masked. Skipped characters do not count towards this tally.

7542

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

7543

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

7544

# code or credit card number. This string must have a length of 1. If not

7545

# supplied, this value defaults to `*` for strings, and `0` for digits.

7546

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

7547

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

7548

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

7549

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

7550

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7551

},

7552

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7553

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

7554

# given `RecordCondition`. The conditions are allowed to reference fields

7555

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

7560

# column for the same record is within a specific range.

7561

# - Redact a field if the date of birth field is greater than 85.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7562

# a field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7563

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

7564

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

7565

# only supported value is `AND`.

7566

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

7567

"conditions": [ # A collection of conditions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7568

{ # The field type of `value` and `field` do not need to match to be

7569

# considered equal, but not all comparisons are possible.

7570

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

7571

# but all other comparisons are invalid with incompatible types.

7572

# A `value` of type:

7573

#

7574

# - `string` can be compared against all other types

7575

# - `boolean` can only be compared against other booleans

7576

# - `integer` can be compared against doubles or a string if the string value

7577

# can be parsed as an integer.

7578

# - `double` can be compared against integers or a string if the string can

7579

# be parsed as a double.

7580

# - `Timestamp` can be compared against strings in RFC 3339 date string

7581

# format.

7582

# - `TimeOfDay` can be compared against timestamps and strings in the format

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7583

# of 'HH:mm:ss'.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7584

#

7585

# If we fail to compare do to type mismatch, a warning will be given and

7586

# the condition will evaluate to false.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7587

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7588

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7589

# of bytes considered to comprise a 'Value' is based on its representation

7590

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7591

# 123456789, the number of bytes would be counted as 9, even though an

7592

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7593

"timestampValue": "A String", # timestamp

7594

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7595

# and time zone are either specified elsewhere or are not significant. The date

7596

# is relative to the Proleptic Gregorian Calendar. This can represent:

7597

#

7598

# * A full date, with non-zero year, month and day values

7599

# * A month and day value, with a zero year, e.g. an anniversary

7600

# * A year on its own, with zero month and day values

7601

# * A year and month value, with a zero day, e.g. a credit card expiration date

7602

#

7603

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7604

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7605

# a year.

7606

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7607

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7608

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7609

# if specifying a year by itself or a year and month where the day is not

7610

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7611

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7612

"stringValue": "A String", # string

7613

"integerValue": "A String", # integer

7614

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7615

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7616

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7617

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7618

# to allow the value "24:00:00" for scenarios like business closing time.

7619

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7620

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7621

# allow the value 60 if it allows leap-seconds.

7622

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7623

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7624

"booleanValue": True or False, # boolean

7625

"floatValue": 3.14, # float

7626

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7627

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7628

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

7629

"name": "A String", # Name describing the field.

7630

},

7631

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

},

],

},

},

},

},

],

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that

7640

# match any suppression rule are omitted from the output.

7641

{ # Configuration to suppress records whose suppression conditions evaluate to

7642

# true.

7643

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

7644

# evaluated to be suppressed from the transformed content.

7645

# a field.

7646

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

7647

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

7648

# only supported value is `AND`.

7649

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

7650

"conditions": [ # A collection of conditions.

7651

{ # The field type of `value` and `field` do not need to match to be

7652

# considered equal, but not all comparisons are possible.

7653

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

7654

# but all other comparisons are invalid with incompatible types.

7655

# A `value` of type:

7656

#

7657

# - `string` can be compared against all other types

7658

# - `boolean` can only be compared against other booleans

7659

# - `integer` can be compared against doubles or a string if the string value

7660

# can be parsed as an integer.

7661

# - `double` can be compared against integers or a string if the string can

7662

# be parsed as a double.

7663

# - `Timestamp` can be compared against strings in RFC 3339 date string

7664

# format.

7665

# - `TimeOfDay` can be compared against timestamps and strings in the format

7666

# of 'HH:mm:ss'.

7667

#

7668

# If we fail to compare do to type mismatch, a warning will be given and

7669

# the condition will evaluate to false.

7670

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

7671

# Note that for the purposes of inspection or transformation, the number

7672

# of bytes considered to comprise a 'Value' is based on its representation

7673

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7674

# 123456789, the number of bytes would be counted as 9, even though an

7675

# int64 only holds up to 8 bytes of data.

7676

"timestampValue": "A String", # timestamp

7677

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7678

# and time zone are either specified elsewhere or are not significant. The date

7679

# is relative to the Proleptic Gregorian Calendar. This can represent:

7680

#

7681

# * A full date, with non-zero year, month and day values

7682

# * A month and day value, with a zero year, e.g. an anniversary

7683

# * A year on its own, with zero month and day values

7684

# * A year and month value, with a zero day, e.g. a credit card expiration date

7685

#

7686

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7687

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7688

# a year.

7689

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7690

# month and day.

7691

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7692

# if specifying a year by itself or a year and month where the day is not

7693

# significant.

7694

},

7695

"stringValue": "A String", # string

7696

"integerValue": "A String", # integer

7697

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7698

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7699

# types are google.type.Date and `google.protobuf.Timestamp`.

7700

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7701

# to allow the value "24:00:00" for scenarios like business closing time.

7702

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7703

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7704

# allow the value 60 if it allows leap-seconds.

7705

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7706

},

7707

"booleanValue": True or False, # boolean

7708

"floatValue": 3.14, # float

7709

"dayOfWeekValue": "A String", # day of week

7710

},

7711

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

7712

"name": "A String", # Name describing the field.

7713

},

7714

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7715

},

7716

],

7717

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7718

},

7719

},

7720

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7721

],

7722

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7723

},

7724

"item": { # Container structure for the content to inspect. # The item to re-identify. Will be treated as text.

7725

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

7726

"data": "A String", # Content data to inspect or redact.

7727

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

7728

},

7729

"value": "A String", # String data to inspect or redact.

7730

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

7731

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

7732

# learn more.

7733

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

7734

# learn more.

7735

"rows": [ # Rows of the table.

7736

{ # Values of the row.

7737

"values": [ # Individual cells.

7738

{ # Set of primitive values supported by the system.

7739

# Note that for the purposes of inspection or transformation, the number

7740

# of bytes considered to comprise a 'Value' is based on its representation

7741

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7742

# 123456789, the number of bytes would be counted as 9, even though an

7743

# int64 only holds up to 8 bytes of data.

7744

"timestampValue": "A String", # timestamp

7745

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7746

# and time zone are either specified elsewhere or are not significant. The date

7747

# is relative to the Proleptic Gregorian Calendar. This can represent:

7748

#

7749

# * A full date, with non-zero year, month and day values

7750

# * A month and day value, with a zero year, e.g. an anniversary

7751

# * A year on its own, with zero month and day values

7752

# * A year and month value, with a zero day, e.g. a credit card expiration date

7753

#

7754

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7755

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7756

# a year.

7757

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7758

# month and day.

7759

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7760

# if specifying a year by itself or a year and month where the day is not

7761

# significant.

7762

},

7763

"stringValue": "A String", # string

7764

"integerValue": "A String", # integer

7765

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7766

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7767

# types are google.type.Date and `google.protobuf.Timestamp`.

7768

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7769

# to allow the value "24:00:00" for scenarios like business closing time.

7770

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7771

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7772

# allow the value 60 if it allows leap-seconds.

7773

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7774

},

7775

"booleanValue": True or False, # boolean

7776

"floatValue": 3.14, # float

7777

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7778

},

7779

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7780

},

7781

],

7782

"headers": [ # Headers of the table.

7783

{ # General identifier of a data field in a storage service.

7784

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7785

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7786

],

7787

},

7788

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7789

"inspectTemplateName": "A String", # Template to use. Any configuration directly specified in

7790

# `inspect_config` will override those set in the template. Singular fields

7791

# that are set in this request will replace their corresponding fields in the

7792

# template. Repeated fields are appended. Singular sub-messages and groups

7793

# are recursively merged.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7794

}

7795

7796

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

7803

7804

{ # Results of re-identifying a item.

7805

"overview": { # Overview of the modifications that occurred. # An overview of the changes that were made to the `item`.

7806

"transformationSummaries": [ # Transformations applied to the dataset.

7807

{ # Summary of a single transformation.

7808

# Only one of 'transformation', 'field_transformation', or 'record_suppress'

7809

# will be set.

7810

"fieldTransformations": [ # The field transformation that was applied.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7811

# If multiple field transformations are requested for a single field,

7812

# this list will contain all of them; otherwise, only one is supplied.

7813

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7814

"fields": [ # Required. Input field(s) to apply the transformation to.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7815

{ # General identifier of a data field in a storage service.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7816

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7817

},

7818

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7819

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7820

# transform content that matches an `InfoType`.

7821

# apply various `PrimitiveTransformation`s to each finding, where the

7822

# transformation is applied to only values that were identified as a specific

7823

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7824

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7825

# for a given infoType.

7826

{ # A transformation to apply to text that is identified as a specific

7827

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7828

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

7829

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

7830

# portion of the value.

7831

"partToExtract": "A String", # The part of the time to keep.

7832

},

7833

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

7834

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

7835

# to learn more.

7836

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

7837

# If set, must also set cryptoKey. If set, shift will be consistent for the

7838

# given context.

7839

"name": "A String", # Name describing the field.

7840

},

7841

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

7842

# range (inclusive ends). Negative means shift to earlier in time. Must not

7843

# be more than 365250 days (1000 years) each direction.

7844

#

7845

# For example, 3 means shift date to at most 3 days into the future.

7846

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

7847

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

7848

# results in the same shift for the same context and crypto_key. If

7849

# set, must also set context. Can only be applied to table items.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7850

# a key encryption key (KEK) stored by KMS).

7851

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7852

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7853

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7854

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7855

# leaking the key. Choose another type of key if possible.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7856

"key": "A String", # Required. A 128/192/256 bit key.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7857

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7858

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7859

# It will be discarded after the request finishes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7860

"name": "A String", # Required. Name of the key.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7861

# This is an arbitrary string used to differentiate different keys.

7862

# A unique key is generated per name: two separate `TransientCryptoKey`

7863

# protos share the same generated key if their names are the same.

7864

# When the data crypto key is generated, this name is not used in any way

7865

# (repeating the api call will result in a different key being generated).

7866

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7867

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7868

# The wrapped key must be a 128/192/256 bit key.

7869

# Authorization requires the following IAM permissions when sending a request

7870

# to perform a crypto transformation using a kms-wrapped crypto key:

7871

# dlp.kms.encrypt

7872

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7873

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7874

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7875

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7876

},

7877

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

7878

},

7879

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

7880

# Uses SHA-256.

7881

# The key size must be either 32 or 64 bytes.

7882

# Outputs a base64 encoded representation of the hashed output

7883

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

7884

# Currently, only string and integer values can be hashed.

7885

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

7886

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

7887

# a key encryption key (KEK) stored by KMS).

7888

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7889

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7890

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7891

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7892

# leaking the key. Choose another type of key if possible.

7893

"key": "A String", # Required. A 128/192/256 bit key.

7894

},

7895

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7896

# It will be discarded after the request finishes.

7897

"name": "A String", # Required. Name of the key.

7898

# This is an arbitrary string used to differentiate different keys.

7899

# A unique key is generated per name: two separate `TransientCryptoKey`

7900

# protos share the same generated key if their names are the same.

7901

# When the data crypto key is generated, this name is not used in any way

7902

# (repeating the api call will result in a different key being generated).

7903

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7904

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7905

# The wrapped key must be a 128/192/256 bit key.

7906

# Authorization requires the following IAM permissions when sending a request

7907

# to perform a crypto transformation using a kms-wrapped crypto key:

7908

# dlp.kms.encrypt

7909

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7910

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7911

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7912

},

7913

},

7914

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

7915

# (FPE) with the FFX mode of operation; however when used in the

7916

# `ReidentifyContent` API method, it serves the opposite function by reversing

7917

# the surrogate back into the original identifier. The identifier must be

7918

# encoded as ASCII. For a given crypto key and context, the same identifier

7919

# will be replaced with the same surrogate. Identifiers must be at least two

7920

# characters long. In the case that the identifier is the empty string, it will

7921

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

7922

# more.

7923

#

7924

# Note: We recommend using CryptoDeterministicConfig for all use cases which

7925

# do not require preserving the input alphabet space and size, plus warrant

7926

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7927

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

7928

# This annotation will be applied to the surrogate by prefixing it with

7929

# the name of the custom infoType followed by the number of

7930

# characters comprising the surrogate. The following scheme defines the

7931

# format: info_type_name(surrogate_character_count):surrogate

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7932

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7933

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

7934

# the surrogate is 'abc', the full replacement value

7935

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

7936

#

7937

# This annotation identifies the surrogate when inspecting content using the

7938

# custom infoType

7939

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

7940

# This facilitates reversal of the surrogate when it occurs in free text.

7941

#

7942

# In order for inspection to work properly, the name of this infoType must

7943

# not occur naturally anywhere in your data; otherwise, inspection may

7944

# find a surrogate that does not correspond to an actual identifier.

7945

# Therefore, choose your custom infoType name carefully after considering

7946

# what your data looks like. One way to select a name that has a high chance

7947

# of yielding reliable detection is to include one or more unicode characters

7948

# that are highly improbable to exist in your data.

7949

# For example, assuming your data is entered from a regular ASCII keyboard,

7950

# the symbol with the hex code point 29DD might be used like so:

7951

# ⧝MY_TOKEN_TYPE

7952

"name": "A String", # Name of the information type. Either a name of your choosing when

7953

# creating a CustomInfoType, or one of the names listed

7954

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

7955

# a built-in type. InfoType names should conform to the pattern

7956

# `[a-zA-Z0-9_]{1,64}`.

7957

},

7958

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

7959

# identifier in two different contexts won't be given the same surrogate. If

7960

# the context is not set, a default tweak will be used.

7961

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7962

# If the context is set but:

7963

#

7964

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7965

# 1. the field is not present when transforming a given value,

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7966

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7967

# a default tweak will be used.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7968

#

7969

# Note that case (1) is expected when an `InfoTypeTransformation` is

7970

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7971

# Currently, the referenced field may be of value type integer or string.

7972

#

7973

# The tweak is constructed as a sequence of bytes in big endian byte order

7974

# such that:

7975

#

7976

# - a 64 bit integer is encoded followed by a single byte of value 1

7977

# - a string is encoded in UTF-8 format followed by a single byte of value 2

7978

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7979

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7980

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

7981

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

7982

# a key encryption key (KEK) stored by KMS).

7983

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7984

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7985

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7986

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7987

# leaking the key. Choose another type of key if possible.

7988

"key": "A String", # Required. A 128/192/256 bit key.

7989

},

7990

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7991

# It will be discarded after the request finishes.

7992

"name": "A String", # Required. Name of the key.

7993

# This is an arbitrary string used to differentiate different keys.

7994

# A unique key is generated per name: two separate `TransientCryptoKey`

7995

# protos share the same generated key if their names are the same.

7996

# When the data crypto key is generated, this name is not used in any way

7997

# (repeating the api call will result in a different key being generated).

7998

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

7999

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8000

# The wrapped key must be a 128/192/256 bit key.

8001

# Authorization requires the following IAM permissions when sending a request

8002

# to perform a crypto transformation using a kms-wrapped crypto key:

8003

# dlp.kms.encrypt

8004

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8005

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8006

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8007

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8008

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

8009

# that the FFX mode natively supports. This happens before/after

8010

# encryption/decryption.

8011

# Each character listed must appear only once.

8012

# Number of characters must be in the range [2, 95].

8013

# This must be encoded as ASCII.

8014

# The order of characters does not matter.

8015

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8016

},

8017

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

8018

# input. Outputs a base64 encoded representation of the encrypted output.

8019

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

8020

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8021

# This annotation will be applied to the surrogate by prefixing it with

8022

# the name of the custom info type followed by the number of

8023

# characters comprising the surrogate. The following scheme defines the

8024

# format: {info type name}({surrogate character count}):{surrogate}

8025

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8026

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

8027

# the surrogate is 'abc', the full replacement value

8028

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8029

#

8030

# This annotation identifies the surrogate when inspecting content using the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8031

# custom info type 'Surrogate'. This facilitates reversal of the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8032

# surrogate when it occurs in free text.

8033

#

8034

# Note: For record transformations where the entire cell in a table is being

8035

# transformed, surrogates are not mandatory. Surrogates are used to denote

8036

# the location of the token and are necessary for re-identification in free

8037

# form text.

8038

#

8039

# In order for inspection to work properly, the name of this info type must

8040

# not occur naturally anywhere in your data; otherwise, inspection may either

8041

#

8042

# - reverse a surrogate that does not correspond to an actual identifier

8043

# - be unable to parse the surrogate and result in an error

8044

#

8045

# Therefore, choose your custom info type name carefully after considering

8046

# what your data looks like. One way to select a name that has a high chance

8047

# of yielding reliable detection is to include one or more unicode characters

8048

# that are highly improbable to exist in your data.

8049

# For example, assuming your data is entered from a regular ASCII keyboard,

8050

# the symbol with the hex code point 29DD might be used like so:

8051

# ⧝MY_TOKEN_TYPE.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8052

"name": "A String", # Name of the information type. Either a name of your choosing when

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8053

# creating a CustomInfoType, or one of the names listed

8054

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

8055

# a built-in type. InfoType names should conform to the pattern

8056

# `[a-zA-Z0-9_]{1,64}`.

8057

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8058

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

8059

# referential integrity such that the same identifier in two different

8060

# contexts will be given a distinct surrogate. The context is appended to

8061

# plaintext value being encrypted. On decryption the provided context is

8062

# validated against the value used during encryption. If a context was

8063

# provided during encryption, same context must be provided during decryption

8064

# as well.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8065

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8066

# If the context is not set, plaintext would be used as is for encryption.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8067

# If the context is set but:

8068

#

8069

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8070

# 2. the field is not present when transforming a given value,

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8071

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8072

# plaintext would be used as is for encryption.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8073

#

8074

# Note that case (1) is expected when an `InfoTypeTransformation` is

8075

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8076

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8077

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8078

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

8079

# a key encryption key (KEK) stored by KMS).

8080

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8081

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8082

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8083

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8084

# leaking the key. Choose another type of key if possible.

8085

"key": "A String", # Required. A 128/192/256 bit key.

8086

},

8087

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8088

# It will be discarded after the request finishes.

8089

"name": "A String", # Required. Name of the key.

8090

# This is an arbitrary string used to differentiate different keys.

8091

# A unique key is generated per name: two separate `TransientCryptoKey`

8092

# protos share the same generated key if their names are the same.

8093

# When the data crypto key is generated, this name is not used in any way

8094

# (repeating the api call will result in a different key being generated).

8095

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8096

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8097

# The wrapped key must be a 128/192/256 bit key.

8098

# Authorization requires the following IAM permissions when sending a request

8099

# to perform a crypto transformation using a kms-wrapped crypto key:

8100

# dlp.kms.encrypt

8101

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8102

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8103

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8104

},

8105

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8106

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8107

# replacement values are dynamically provided by the user for custom behavior,

8108

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

8109

# This can be used on

8110

# data of type: number, long, string, timestamp.

8111

# If the bound `Value` type differs from the type of data being transformed, we

8112

# will first attempt converting the type of the data to be transformed to match

8113

# the type of the bound before comparing.

8114

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8115

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8116

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8117

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

8118

# the default behavior will be to hyphenate the min-max range.

8119

# Note that for the purposes of inspection or transformation, the number

8120

# of bytes considered to comprise a 'Value' is based on its representation

8121

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8122

# 123456789, the number of bytes would be counted as 9, even though an

8123

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8124

"timestampValue": "A String", # timestamp

8125

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8126

# and time zone are either specified elsewhere or are not significant. The date

8127

# is relative to the Proleptic Gregorian Calendar. This can represent:

8128

#

8129

# * A full date, with non-zero year, month and day values

8130

# * A month and day value, with a zero year, e.g. an anniversary

8131

# * A year on its own, with zero month and day values

8132

# * A year and month value, with a zero day, e.g. a credit card expiration date

8133

#

8134

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8135

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8136

# a year.

8137

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8138

# month and day.

8139

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8140

# if specifying a year by itself or a year and month where the day is not

8141

# significant.

8142

},

8143

"stringValue": "A String", # string

8144

"integerValue": "A String", # integer

8145

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8146

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8147

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8148

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8149

# to allow the value "24:00:00" for scenarios like business closing time.

8150

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8151

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8152

# allow the value 60 if it allows leap-seconds.

8153

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8154

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8155

"booleanValue": True or False, # boolean

8156

"floatValue": 3.14, # float

8157

"dayOfWeekValue": "A String", # day of week

8158

},

8159

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

8160

# used.

8161

# Note that for the purposes of inspection or transformation, the number

8162

# of bytes considered to comprise a 'Value' is based on its representation

8163

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8164

# 123456789, the number of bytes would be counted as 9, even though an

8165

# int64 only holds up to 8 bytes of data.

8166

"timestampValue": "A String", # timestamp

8167

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8168

# and time zone are either specified elsewhere or are not significant. The date

8169

# is relative to the Proleptic Gregorian Calendar. This can represent:

8170

#

8171

# * A full date, with non-zero year, month and day values

8172

# * A month and day value, with a zero year, e.g. an anniversary

8173

# * A year on its own, with zero month and day values

8174

# * A year and month value, with a zero day, e.g. a credit card expiration date

8175

#

8176

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8177

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8178

# a year.

8179

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8180

# month and day.

8181

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8182

# if specifying a year by itself or a year and month where the day is not

8183

# significant.

8184

},

8185

"stringValue": "A String", # string

8186

"integerValue": "A String", # integer

8187

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8188

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8189

# types are google.type.Date and `google.protobuf.Timestamp`.

8190

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8191

# to allow the value "24:00:00" for scenarios like business closing time.

8192

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8193

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8194

# allow the value 60 if it allows leap-seconds.

8195

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8196

},

8197

"booleanValue": True or False, # boolean

8198

"floatValue": 3.14, # float

8199

"dayOfWeekValue": "A String", # day of week

8200

},

8201

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

8202

# Note that for the purposes of inspection or transformation, the number

8203

# of bytes considered to comprise a 'Value' is based on its representation

8204

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8205

# 123456789, the number of bytes would be counted as 9, even though an

8206

# int64 only holds up to 8 bytes of data.

8207

"timestampValue": "A String", # timestamp

8208

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8209

# and time zone are either specified elsewhere or are not significant. The date

8210

# is relative to the Proleptic Gregorian Calendar. This can represent:

8211

#

8212

# * A full date, with non-zero year, month and day values

8213

# * A month and day value, with a zero year, e.g. an anniversary

8214

# * A year on its own, with zero month and day values

8215

# * A year and month value, with a zero day, e.g. a credit card expiration date

8216

#

8217

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8218

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8219

# a year.

8220

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8221

# month and day.

8222

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8223

# if specifying a year by itself or a year and month where the day is not

8224

# significant.

8225

},

8226

"stringValue": "A String", # string

8227

"integerValue": "A String", # integer

8228

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8229

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8230

# types are google.type.Date and `google.protobuf.Timestamp`.

8231

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8232

# to allow the value "24:00:00" for scenarios like business closing time.

8233

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8234

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8235

# allow the value 60 if it allows leap-seconds.

8236

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8237

},

8238

"booleanValue": True or False, # boolean

8239

"floatValue": 3.14, # float

8240

"dayOfWeekValue": "A String", # day of week

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8245

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

8246

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

8247

# output would be 'My phone number is '.

8248

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8249

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

8250

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8251

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8252

# of bytes considered to comprise a 'Value' is based on its representation

8253

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8254

# 123456789, the number of bytes would be counted as 9, even though an

8255

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8256

"timestampValue": "A String", # timestamp

8257

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8258

# and time zone are either specified elsewhere or are not significant. The date

8259

# is relative to the Proleptic Gregorian Calendar. This can represent:

8260

#

8261

# * A full date, with non-zero year, month and day values

8262

# * A month and day value, with a zero year, e.g. an anniversary

8263

# * A year on its own, with zero month and day values

8264

# * A year and month value, with a zero day, e.g. a credit card expiration date

8265

#

8266

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8267

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8268

# a year.

8269

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8270

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8271

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8272

# if specifying a year by itself or a year and month where the day is not

8273

# significant.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8274

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8275

"stringValue": "A String", # string

8276

"integerValue": "A String", # integer

8277

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8278

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8279

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8280

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8281

# to allow the value "24:00:00" for scenarios like business closing time.

8282

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8283

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8284

# allow the value 60 if it allows leap-seconds.

8285

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8286

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8287

"booleanValue": True or False, # boolean

8288

"floatValue": 3.14, # float

8289

"dayOfWeekValue": "A String", # day of week

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8290

},

8291

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8292

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

8293

# Bucketing transformation can provide all of this functionality,

8294

# but requires more configuration. This message is provided as a convenience to

8295

# the user for simple bucketing strategies.

8296

#

8297

# The transformed value will be a hyphenated string of

8298

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

8299

# all values that are within this bucket will be replaced with "10-20".

8300

#

8301

# This can be used on data of type: double, long.

8302

#

8303

# If the bound Value type differs from the type of data

8304

# being transformed, we will first attempt converting the type of the data to

8305

# be transformed to match the type of the bound before comparing.

8306

#

8307

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8308

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

8309

# grouped together into a single bucket; for example if `upper_bound` = 89,

8310

# then all values greater than 89 are replaced with the value "89+".

8311

# Note that for the purposes of inspection or transformation, the number

8312

# of bytes considered to comprise a 'Value' is based on its representation

8313

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8314

# 123456789, the number of bytes would be counted as 9, even though an

8315

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8316

"timestampValue": "A String", # timestamp

8317

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8318

# and time zone are either specified elsewhere or are not significant. The date

8319

# is relative to the Proleptic Gregorian Calendar. This can represent:

8320

#

8321

# * A full date, with non-zero year, month and day values

8322

# * A month and day value, with a zero year, e.g. an anniversary

8323

# * A year on its own, with zero month and day values

8324

# * A year and month value, with a zero day, e.g. a credit card expiration date

8325

#

8326

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8327

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8328

# a year.

8329

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8330

# month and day.

8331

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8332

# if specifying a year by itself or a year and month where the day is not

8333

# significant.

8334

},

8335

"stringValue": "A String", # string

8336

"integerValue": "A String", # integer

8337

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8338

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8339

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8340

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8341

# to allow the value "24:00:00" for scenarios like business closing time.

8342

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8343

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8344

# allow the value 60 if it allows leap-seconds.

8345

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8346

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8347

"booleanValue": True or False, # boolean

8348

"floatValue": 3.14, # float

8349

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8350

},

8351

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

8352

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

8353

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

8354

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8355

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

8356

# grouped together into a single bucket; for example if `lower_bound` = 10,

8357

# then all values less than 10 are replaced with the value "-10".

8358

# Note that for the purposes of inspection or transformation, the number

8359

# of bytes considered to comprise a 'Value' is based on its representation

8360

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8361

# 123456789, the number of bytes would be counted as 9, even though an

8362

# int64 only holds up to 8 bytes of data.

8363

"timestampValue": "A String", # timestamp

8364

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8365

# and time zone are either specified elsewhere or are not significant. The date

8366

# is relative to the Proleptic Gregorian Calendar. This can represent:

8367

#

8368

# * A full date, with non-zero year, month and day values

8369

# * A month and day value, with a zero year, e.g. an anniversary

8370

# * A year on its own, with zero month and day values

8371

# * A year and month value, with a zero day, e.g. a credit card expiration date

8372

#

8373

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8374

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8375

# a year.

8376

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8377

# month and day.

8378

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8379

# if specifying a year by itself or a year and month where the day is not

8380

# significant.

8381

},

8382

"stringValue": "A String", # string

8383

"integerValue": "A String", # integer

8384

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8385

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8386

# types are google.type.Date and `google.protobuf.Timestamp`.

8387

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8388

# to allow the value "24:00:00" for scenarios like business closing time.

8389

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8390

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8391

# allow the value 60 if it allows leap-seconds.

8392

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8393

},

8394

"booleanValue": True or False, # boolean

8395

"floatValue": 3.14, # float

8396

"dayOfWeekValue": "A String", # day of week

8397

},

8398

},

8399

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

8400

# fixed character. Masking can start from the beginning or end of the string.

8401

# This can be used on data of any type (numbers, longs, and so on) and when

8402

# de-identifying structured data we'll attempt to preserve the original data's

8403

# type. (This allows you to take a long like 123 and modify it to a string like

8404

# **3.

8405

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

8406

# characters. For example, if the input string is `555-555-5555` and you

8407

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

8408

# returns `***-**5-5555`.

8409

{ # Characters to skip when doing deidentification of a value. These will be left

8410

# alone and skipped.

8411

"charactersToSkip": "A String", # Characters to not transform when masking.

8412

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

8417

# masked. Skipped characters do not count towards this tally.

8418

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

8419

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

8420

# code or credit card number. This string must have a length of 1. If not

8421

# supplied, this value defaults to `*` for strings, and `0` for digits.

8422

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

8423

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

8424

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

8425

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

8426

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8427

},

8428

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8429

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

8430

# this transformation to apply to all findings that correspond to

8431

# infoTypes that were requested in `InspectConfig`.

8432

{ # Type of information detected by the API.

8433

"name": "A String", # Name of the information type. Either a name of your choosing when

8434

# creating a CustomInfoType, or one of the names listed

8435

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

8436

# a built-in type. InfoType names should conform to the pattern

8437

# `[a-zA-Z0-9_]{1,64}`.

8438

},

8439

],

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8440

},

8441

],

8442

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8443

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

8444

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

8445

# portion of the value.

8446

"partToExtract": "A String", # The part of the time to keep.

8447

},

8448

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

8449

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

8450

# to learn more.

8451

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

8452

# If set, must also set cryptoKey. If set, shift will be consistent for the

8453

# given context.

8454

"name": "A String", # Name describing the field.

8455

},

8456

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

8457

# range (inclusive ends). Negative means shift to earlier in time. Must not

8458

# be more than 365250 days (1000 years) each direction.

8459

#

8460

# For example, 3 means shift date to at most 3 days into the future.

8461

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

8462

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

8463

# results in the same shift for the same context and crypto_key. If

8464

# set, must also set context. Can only be applied to table items.

8465

# a key encryption key (KEK) stored by KMS).

8466

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8467

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8468

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8469

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8470

# leaking the key. Choose another type of key if possible.

8471

"key": "A String", # Required. A 128/192/256 bit key.

8472

},

8473

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8474

# It will be discarded after the request finishes.

8475

"name": "A String", # Required. Name of the key.

8476

# This is an arbitrary string used to differentiate different keys.

8477

# A unique key is generated per name: two separate `TransientCryptoKey`

8478

# protos share the same generated key if their names are the same.

8479

# When the data crypto key is generated, this name is not used in any way

8480

# (repeating the api call will result in a different key being generated).

8481

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8482

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8483

# The wrapped key must be a 128/192/256 bit key.

8484

# Authorization requires the following IAM permissions when sending a request

8485

# to perform a crypto transformation using a kms-wrapped crypto key:

8486

# dlp.kms.encrypt

8487

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8488

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8489

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8490

},

8491

},

8492

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

8493

},

8494

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

8495

# Uses SHA-256.

8496

# The key size must be either 32 or 64 bytes.

8497

# Outputs a base64 encoded representation of the hashed output

8498

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

8499

# Currently, only string and integer values can be hashed.

8500

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

8501

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

8502

# a key encryption key (KEK) stored by KMS).

8503

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8504

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8505

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8506

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8507

# leaking the key. Choose another type of key if possible.

8508

"key": "A String", # Required. A 128/192/256 bit key.

8509

},

8510

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8511

# It will be discarded after the request finishes.

8512

"name": "A String", # Required. Name of the key.

8513

# This is an arbitrary string used to differentiate different keys.

8514

# A unique key is generated per name: two separate `TransientCryptoKey`

8515

# protos share the same generated key if their names are the same.

8516

# When the data crypto key is generated, this name is not used in any way

8517

# (repeating the api call will result in a different key being generated).

8518

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8519

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8520

# The wrapped key must be a 128/192/256 bit key.

8521

# Authorization requires the following IAM permissions when sending a request

8522

# to perform a crypto transformation using a kms-wrapped crypto key:

8523

# dlp.kms.encrypt

8524

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8525

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8526

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8527

},

8528

},

8529

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

8530

# (FPE) with the FFX mode of operation; however when used in the

8531

# `ReidentifyContent` API method, it serves the opposite function by reversing

8532

# the surrogate back into the original identifier. The identifier must be

8533

# encoded as ASCII. For a given crypto key and context, the same identifier

8534

# will be replaced with the same surrogate. Identifiers must be at least two

8535

# characters long. In the case that the identifier is the empty string, it will

8536

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

8537

# more.

8538

#

8539

# Note: We recommend using CryptoDeterministicConfig for all use cases which

8540

# do not require preserving the input alphabet space and size, plus warrant

8541

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8542

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

8543

# This annotation will be applied to the surrogate by prefixing it with

8544

# the name of the custom infoType followed by the number of

8545

# characters comprising the surrogate. The following scheme defines the

8546

# format: info_type_name(surrogate_character_count):surrogate

8547

#

8548

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

8549

# the surrogate is 'abc', the full replacement value

8550

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

8551

#

8552

# This annotation identifies the surrogate when inspecting content using the

8553

# custom infoType

8554

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

8555

# This facilitates reversal of the surrogate when it occurs in free text.

8556

#

8557

# In order for inspection to work properly, the name of this infoType must

8558

# not occur naturally anywhere in your data; otherwise, inspection may

8559

# find a surrogate that does not correspond to an actual identifier.

8560

# Therefore, choose your custom infoType name carefully after considering

8561

# what your data looks like. One way to select a name that has a high chance

8562

# of yielding reliable detection is to include one or more unicode characters

8563

# that are highly improbable to exist in your data.

8564

# For example, assuming your data is entered from a regular ASCII keyboard,

8565

# the symbol with the hex code point 29DD might be used like so:

8566

# ⧝MY_TOKEN_TYPE

8567

"name": "A String", # Name of the information type. Either a name of your choosing when

8568

# creating a CustomInfoType, or one of the names listed

8569

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

8570

# a built-in type. InfoType names should conform to the pattern

8571

# `[a-zA-Z0-9_]{1,64}`.

8572

},

8573

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

8574

# identifier in two different contexts won't be given the same surrogate. If

8575

# the context is not set, a default tweak will be used.

8576

#

8577

# If the context is set but:

8578

#

8579

# 1. there is no record present when transforming a given value or

8580

# 1. the field is not present when transforming a given value,

8581

#

8582

# a default tweak will be used.

8583

#

8584

# Note that case (1) is expected when an `InfoTypeTransformation` is

8585

# applied to both structured and non-structured `ContentItem`s.

8586

# Currently, the referenced field may be of value type integer or string.

8587

#

8588

# The tweak is constructed as a sequence of bytes in big endian byte order

8589

# such that:

8590

#

8591

# - a 64 bit integer is encoded followed by a single byte of value 1

8592

# - a string is encoded in UTF-8 format followed by a single byte of value 2

8593

"name": "A String", # Name describing the field.

8594

},

8595

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

8596

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

8597

# a key encryption key (KEK) stored by KMS).

8598

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8599

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8600

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8601

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8602

# leaking the key. Choose another type of key if possible.

8603

"key": "A String", # Required. A 128/192/256 bit key.

8604

},

8605

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8606

# It will be discarded after the request finishes.

8607

"name": "A String", # Required. Name of the key.

8608

# This is an arbitrary string used to differentiate different keys.

8609

# A unique key is generated per name: two separate `TransientCryptoKey`

8610

# protos share the same generated key if their names are the same.

8611

# When the data crypto key is generated, this name is not used in any way

8612

# (repeating the api call will result in a different key being generated).

8613

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8614

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8615

# The wrapped key must be a 128/192/256 bit key.

8616

# Authorization requires the following IAM permissions when sending a request

8617

# to perform a crypto transformation using a kms-wrapped crypto key:

8618

# dlp.kms.encrypt

8619

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8620

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8621

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8622

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8623

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

8624

# that the FFX mode natively supports. This happens before/after

8625

# encryption/decryption.

8626

# Each character listed must appear only once.

8627

# Number of characters must be in the range [2, 95].

8628

# This must be encoded as ASCII.

8629

# The order of characters does not matter.

8630

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8631

},

8632

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

8633

# input. Outputs a base64 encoded representation of the encrypted output.

8634

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

8635

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

8636

# This annotation will be applied to the surrogate by prefixing it with

8637

# the name of the custom info type followed by the number of

8638

# characters comprising the surrogate. The following scheme defines the

8639

# format: {info type name}({surrogate character count}):{surrogate}

8640

#

8641

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

8642

# the surrogate is 'abc', the full replacement value

8643

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

8644

#

8645

# This annotation identifies the surrogate when inspecting content using the

8646

# custom info type 'Surrogate'. This facilitates reversal of the

8647

# surrogate when it occurs in free text.

8648

#

8649

# Note: For record transformations where the entire cell in a table is being

8650

# transformed, surrogates are not mandatory. Surrogates are used to denote

8651

# the location of the token and are necessary for re-identification in free

8652

# form text.

8653

#

8654

# In order for inspection to work properly, the name of this info type must

8655

# not occur naturally anywhere in your data; otherwise, inspection may either

8656

#

8657

# - reverse a surrogate that does not correspond to an actual identifier

8658

# - be unable to parse the surrogate and result in an error

8659

#

8660

# Therefore, choose your custom info type name carefully after considering

8661

# what your data looks like. One way to select a name that has a high chance

8662

# of yielding reliable detection is to include one or more unicode characters

8663

# that are highly improbable to exist in your data.

8664

# For example, assuming your data is entered from a regular ASCII keyboard,

8665

# the symbol with the hex code point 29DD might be used like so:

8666

# ⧝MY_TOKEN_TYPE.

8667

"name": "A String", # Name of the information type. Either a name of your choosing when

8668

# creating a CustomInfoType, or one of the names listed

8669

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

8670

# a built-in type. InfoType names should conform to the pattern

8671

# `[a-zA-Z0-9_]{1,64}`.

8672

},

8673

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

8674

# referential integrity such that the same identifier in two different

8675

# contexts will be given a distinct surrogate. The context is appended to

8676

# plaintext value being encrypted. On decryption the provided context is

8677

# validated against the value used during encryption. If a context was

8678

# provided during encryption, same context must be provided during decryption

8679

# as well.

8680

#

8681

# If the context is not set, plaintext would be used as is for encryption.

8682

# If the context is set but:

8683

#

8684

# 1. there is no record present when transforming a given value or

8685

# 2. the field is not present when transforming a given value,

8686

#

8687

# plaintext would be used as is for encryption.

8688

#

8689

# Note that case (1) is expected when an `InfoTypeTransformation` is

8690

# applied to both structured and non-structured `ContentItem`s.

8691

"name": "A String", # Name describing the field.

8692

},

8693

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

8694

# a key encryption key (KEK) stored by KMS).

8695

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8696

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8697

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8698

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8699

# leaking the key. Choose another type of key if possible.

8700

"key": "A String", # Required. A 128/192/256 bit key.

8701

},

8702

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8703

# It will be discarded after the request finishes.

8704

"name": "A String", # Required. Name of the key.

8705

# This is an arbitrary string used to differentiate different keys.

8706

# A unique key is generated per name: two separate `TransientCryptoKey`

8707

# protos share the same generated key if their names are the same.

8708

# When the data crypto key is generated, this name is not used in any way

8709

# (repeating the api call will result in a different key being generated).

8710

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8711

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8712

# The wrapped key must be a 128/192/256 bit key.

8713

# Authorization requires the following IAM permissions when sending a request

8714

# to perform a crypto transformation using a kms-wrapped crypto key:

8715

# dlp.kms.encrypt

8716

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8717

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8718

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8719

},

8720

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8721

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

8722

# replacement values are dynamically provided by the user for custom behavior,

8723

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

8724

# This can be used on

8725

# data of type: number, long, string, timestamp.

8726

# If the bound `Value` type differs from the type of data being transformed, we

8727

# will first attempt converting the type of the data to be transformed to match

8728

# the type of the bound before comparing.

8729

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

8730

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

8731

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8732

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

8733

# the default behavior will be to hyphenate the min-max range.

8734

# Note that for the purposes of inspection or transformation, the number

8735

# of bytes considered to comprise a 'Value' is based on its representation

8736

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8737

# 123456789, the number of bytes would be counted as 9, even though an

8738

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8739

"timestampValue": "A String", # timestamp

8740

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8741

# and time zone are either specified elsewhere or are not significant. The date

8742

# is relative to the Proleptic Gregorian Calendar. This can represent:

8743

#

8744

# * A full date, with non-zero year, month and day values

8745

# * A month and day value, with a zero year, e.g. an anniversary

8746

# * A year on its own, with zero month and day values

8747

# * A year and month value, with a zero day, e.g. a credit card expiration date

8748

#

8749

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8750

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8751

# a year.

8752

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8753

# month and day.

8754

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8755

# if specifying a year by itself or a year and month where the day is not

8756

# significant.

8757

},

8758

"stringValue": "A String", # string

8759

"integerValue": "A String", # integer

8760

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8761

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8762

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8763

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8764

# to allow the value "24:00:00" for scenarios like business closing time.

8765

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8766

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8767

# allow the value 60 if it allows leap-seconds.

8768

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8769

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8770

"booleanValue": True or False, # boolean

8771

"floatValue": 3.14, # float

8772

"dayOfWeekValue": "A String", # day of week

8773

},

8774

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

8775

# used.

8776

# Note that for the purposes of inspection or transformation, the number

8777

# of bytes considered to comprise a 'Value' is based on its representation

8778

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8779

# 123456789, the number of bytes would be counted as 9, even though an

8780

# int64 only holds up to 8 bytes of data.

8781

"timestampValue": "A String", # timestamp

8782

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8783

# and time zone are either specified elsewhere or are not significant. The date

8784

# is relative to the Proleptic Gregorian Calendar. This can represent:

8785

#

8786

# * A full date, with non-zero year, month and day values

8787

# * A month and day value, with a zero year, e.g. an anniversary

8788

# * A year on its own, with zero month and day values

8789

# * A year and month value, with a zero day, e.g. a credit card expiration date

8790

#

8791

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8792

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8793

# a year.

8794

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8795

# month and day.

8796

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8797

# if specifying a year by itself or a year and month where the day is not

8798

# significant.

8799

},

8800

"stringValue": "A String", # string

8801

"integerValue": "A String", # integer

8802

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8803

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8804

# types are google.type.Date and `google.protobuf.Timestamp`.

8805

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8806

# to allow the value "24:00:00" for scenarios like business closing time.

8807

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8808

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8809

# allow the value 60 if it allows leap-seconds.

8810

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8811

},

8812

"booleanValue": True or False, # boolean

8813

"floatValue": 3.14, # float

8814

"dayOfWeekValue": "A String", # day of week

8815

},

8816

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

8817

# Note that for the purposes of inspection or transformation, the number

8818

# of bytes considered to comprise a 'Value' is based on its representation

8819

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8820

# 123456789, the number of bytes would be counted as 9, even though an

8821

# int64 only holds up to 8 bytes of data.

8822

"timestampValue": "A String", # timestamp

8823

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8824

# and time zone are either specified elsewhere or are not significant. The date

8825

# is relative to the Proleptic Gregorian Calendar. This can represent:

8826

#

8827

# * A full date, with non-zero year, month and day values

8828

# * A month and day value, with a zero year, e.g. an anniversary

8829

# * A year on its own, with zero month and day values

8830

# * A year and month value, with a zero day, e.g. a credit card expiration date

8831

#

8832

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8833

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8834

# a year.

8835

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8836

# month and day.

8837

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8838

# if specifying a year by itself or a year and month where the day is not

8839

# significant.

8840

},

8841

"stringValue": "A String", # string

8842

"integerValue": "A String", # integer

8843

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8844

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8845

# types are google.type.Date and `google.protobuf.Timestamp`.

8846

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8847

# to allow the value "24:00:00" for scenarios like business closing time.

8848

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8849

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8850

# allow the value 60 if it allows leap-seconds.

8851

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8852

},

8853

"booleanValue": True or False, # boolean

8854

"floatValue": 3.14, # float

8855

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8860

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

8861

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

8862

# output would be 'My phone number is '.

8863

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8864

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

8865

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

8866

# Note that for the purposes of inspection or transformation, the number

8867

# of bytes considered to comprise a 'Value' is based on its representation

8868

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8869

# 123456789, the number of bytes would be counted as 9, even though an

8870

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8871

"timestampValue": "A String", # timestamp

8872

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8873

# and time zone are either specified elsewhere or are not significant. The date

8874

# is relative to the Proleptic Gregorian Calendar. This can represent:

8875

#

8876

# * A full date, with non-zero year, month and day values

8877

# * A month and day value, with a zero year, e.g. an anniversary

8878

# * A year on its own, with zero month and day values

8879

# * A year and month value, with a zero day, e.g. a credit card expiration date

8880

#

8881

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8882

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8883

# a year.

8884

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8885

# month and day.

8886

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8887

# if specifying a year by itself or a year and month where the day is not

8888

# significant.

8889

},

8890

"stringValue": "A String", # string

8891

"integerValue": "A String", # integer

8892

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8893

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8894

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8895

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8896

# to allow the value "24:00:00" for scenarios like business closing time.

8897

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8898

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8899

# allow the value 60 if it allows leap-seconds.

8900

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8901

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8902

"booleanValue": True or False, # boolean

8903

"floatValue": 3.14, # float

8904

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8905

},

8906

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8907

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

8908

# Bucketing transformation can provide all of this functionality,

8909

# but requires more configuration. This message is provided as a convenience to

8910

# the user for simple bucketing strategies.

8911

#

8912

# The transformed value will be a hyphenated string of

8913

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

8914

# all values that are within this bucket will be replaced with "10-20".

8915

#

8916

# This can be used on data of type: double, long.

8917

#

8918

# If the bound Value type differs from the type of data

8919

# being transformed, we will first attempt converting the type of the data to

8920

# be transformed to match the type of the bound before comparing.

8921

#

8922

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8923

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

8924

# grouped together into a single bucket; for example if `upper_bound` = 89,

8925

# then all values greater than 89 are replaced with the value "89+".

8926

# Note that for the purposes of inspection or transformation, the number

8927

# of bytes considered to comprise a 'Value' is based on its representation

8928

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8929

# 123456789, the number of bytes would be counted as 9, even though an

8930

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8931

"timestampValue": "A String", # timestamp

8932

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8933

# and time zone are either specified elsewhere or are not significant. The date

8934

# is relative to the Proleptic Gregorian Calendar. This can represent:

8935

#

8936

# * A full date, with non-zero year, month and day values

8937

# * A month and day value, with a zero year, e.g. an anniversary

8938

# * A year on its own, with zero month and day values

8939

# * A year and month value, with a zero day, e.g. a credit card expiration date

8940

#

8941

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8942

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8943

# a year.

8944

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8945

# month and day.

8946

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8947

# if specifying a year by itself or a year and month where the day is not

8948

# significant.

8949

},

8950

"stringValue": "A String", # string

8951

"integerValue": "A String", # integer

8952

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8953

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8954

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8955

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8956

# to allow the value "24:00:00" for scenarios like business closing time.

8957

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8958

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8959

# allow the value 60 if it allows leap-seconds.

8960

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8961

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8962

"booleanValue": True or False, # boolean

8963

"floatValue": 3.14, # float

8964

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8965

},

8966

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

8967

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

8968

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

8969

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

8970

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

8971

# grouped together into a single bucket; for example if `lower_bound` = 10,

8972

# then all values less than 10 are replaced with the value "-10".

8973

# Note that for the purposes of inspection or transformation, the number

8974

# of bytes considered to comprise a 'Value' is based on its representation

8975

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8976

# 123456789, the number of bytes would be counted as 9, even though an

8977

# int64 only holds up to 8 bytes of data.

8978

"timestampValue": "A String", # timestamp

8979

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8980

# and time zone are either specified elsewhere or are not significant. The date

8981

# is relative to the Proleptic Gregorian Calendar. This can represent:

8982

#

8983

# * A full date, with non-zero year, month and day values

8984

# * A month and day value, with a zero year, e.g. an anniversary

8985

# * A year on its own, with zero month and day values

8986

# * A year and month value, with a zero day, e.g. a credit card expiration date

8987

#

8988

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8989

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8990

# a year.

8991

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8992

# month and day.

8993

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8994

# if specifying a year by itself or a year and month where the day is not

8995

# significant.

8996

},

8997

"stringValue": "A String", # string

8998

"integerValue": "A String", # integer

8999

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9000

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9001

# types are google.type.Date and `google.protobuf.Timestamp`.

9002

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9003

# to allow the value "24:00:00" for scenarios like business closing time.

9004

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9005

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9006

# allow the value 60 if it allows leap-seconds.

9007

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9008

},

9009

"booleanValue": True or False, # boolean

9010

"floatValue": 3.14, # float

9011

"dayOfWeekValue": "A String", # day of week

9012

},

9013

},

9014

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

9015

# fixed character. Masking can start from the beginning or end of the string.

9016

# This can be used on data of any type (numbers, longs, and so on) and when

9017

# de-identifying structured data we'll attempt to preserve the original data's

9018

# type. (This allows you to take a long like 123 and modify it to a string like

9019

# **3.

9020

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

9021

# characters. For example, if the input string is `555-555-5555` and you

9022

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

9023

# returns `***-**5-5555`.

9024

{ # Characters to skip when doing deidentification of a value. These will be left

9025

# alone and skipped.

9026

"charactersToSkip": "A String", # Characters to not transform when masking.

9027

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

9032

# masked. Skipped characters do not count towards this tally.

9033

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

9034

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

9035

# code or credit card number. This string must have a length of 1. If not

9036

# supplied, this value defaults to `*` for strings, and `0` for digits.

9037

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

9038

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

9039

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

9040

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

9041

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9042

},

9043

},

9044

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

9045

# given `RecordCondition`. The conditions are allowed to reference fields

9046

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

9051

# column for the same record is within a specific range.

9052

# - Redact a field if the date of birth field is greater than 85.

9053

# a field.

9054

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

9055

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

9056

# only supported value is `AND`.

9057

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

9058

"conditions": [ # A collection of conditions.

9059

{ # The field type of `value` and `field` do not need to match to be

9060

# considered equal, but not all comparisons are possible.

9061

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

9062

# but all other comparisons are invalid with incompatible types.

9063

# A `value` of type:

9064

#

9065

# - `string` can be compared against all other types

9066

# - `boolean` can only be compared against other booleans

9067

# - `integer` can be compared against doubles or a string if the string value

9068

# can be parsed as an integer.

9069

# - `double` can be compared against integers or a string if the string can

9070

# be parsed as a double.

9071

# - `Timestamp` can be compared against strings in RFC 3339 date string

9072

# format.

9073

# - `TimeOfDay` can be compared against timestamps and strings in the format

9074

# of 'HH:mm:ss'.

9075

#

9076

# If we fail to compare do to type mismatch, a warning will be given and

9077

# the condition will evaluate to false.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9078

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

9079

# Note that for the purposes of inspection or transformation, the number

9080

# of bytes considered to comprise a 'Value' is based on its representation

9081

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9082

# 123456789, the number of bytes would be counted as 9, even though an

9083

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9084

"timestampValue": "A String", # timestamp

9085

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9086

# and time zone are either specified elsewhere or are not significant. The date

9087

# is relative to the Proleptic Gregorian Calendar. This can represent:

9088

#

9089

# * A full date, with non-zero year, month and day values

9090

# * A month and day value, with a zero year, e.g. an anniversary

9091

# * A year on its own, with zero month and day values

9092

# * A year and month value, with a zero day, e.g. a credit card expiration date

9093

#

9094

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9095

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9096

# a year.

9097

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9098

# month and day.

9099

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9100

# if specifying a year by itself or a year and month where the day is not

9101

# significant.

9102

},

9103

"stringValue": "A String", # string

9104

"integerValue": "A String", # integer

9105

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9106

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9107

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9108

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9109

# to allow the value "24:00:00" for scenarios like business closing time.

9110

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9111

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9112

# allow the value 60 if it allows leap-seconds.

9113

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9114

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9115

"booleanValue": True or False, # boolean

9116

"floatValue": 3.14, # float

9117

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9118

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9119

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

9120

"name": "A String", # Name describing the field.

9121

},

9122

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9128

},

9129

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9130

"transformation": { # A rule for transforming a value. # The specific transformation these stats apply to.

9131

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

9132

# portion of the value.

9133

"partToExtract": "A String", # The part of the time to keep.

9134

},

9135

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

9136

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

9137

# to learn more.

9138

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

9139

# If set, must also set cryptoKey. If set, shift will be consistent for the

9140

# given context.

9141

"name": "A String", # Name describing the field.

9142

},

9143

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

9144

# range (inclusive ends). Negative means shift to earlier in time. Must not

9145

# be more than 365250 days (1000 years) each direction.

9146

#

9147

# For example, 3 means shift date to at most 3 days into the future.

9148

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

9149

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

9150

# results in the same shift for the same context and crypto_key. If

9151

# set, must also set context. Can only be applied to table items.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9152

# a key encryption key (KEK) stored by KMS).

9153

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9154

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9155

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9156

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9157

# leaking the key. Choose another type of key if possible.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9158

"key": "A String", # Required. A 128/192/256 bit key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9159

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9160

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9161

# It will be discarded after the request finishes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9162

"name": "A String", # Required. Name of the key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9163

# This is an arbitrary string used to differentiate different keys.

9164

# A unique key is generated per name: two separate `TransientCryptoKey`

9165

# protos share the same generated key if their names are the same.

9166

# When the data crypto key is generated, this name is not used in any way

9167

# (repeating the api call will result in a different key being generated).

9168

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9169

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9170

# The wrapped key must be a 128/192/256 bit key.

9171

# Authorization requires the following IAM permissions when sending a request

9172

# to perform a crypto transformation using a kms-wrapped crypto key:

9173

# dlp.kms.encrypt

9174

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9175

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9176

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9177

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9178

},

9179

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

9180

},

9181

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

9182

# Uses SHA-256.

9183

# The key size must be either 32 or 64 bytes.

9184

# Outputs a base64 encoded representation of the hashed output

9185

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

9186

# Currently, only string and integer values can be hashed.

9187

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

9188

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

9189

# a key encryption key (KEK) stored by KMS).

9190

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9191

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9192

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9193

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9194

# leaking the key. Choose another type of key if possible.

9195

"key": "A String", # Required. A 128/192/256 bit key.

9196

},

9197

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9198

# It will be discarded after the request finishes.

9199

"name": "A String", # Required. Name of the key.

9200

# This is an arbitrary string used to differentiate different keys.

9201

# A unique key is generated per name: two separate `TransientCryptoKey`

9202

# protos share the same generated key if their names are the same.

9203

# When the data crypto key is generated, this name is not used in any way

9204

# (repeating the api call will result in a different key being generated).

9205

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9206

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9207

# The wrapped key must be a 128/192/256 bit key.

9208

# Authorization requires the following IAM permissions when sending a request

9209

# to perform a crypto transformation using a kms-wrapped crypto key:

9210

# dlp.kms.encrypt

9211

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9212

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9213

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9214

},

9215

},

9216

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

9217

# (FPE) with the FFX mode of operation; however when used in the

9218

# `ReidentifyContent` API method, it serves the opposite function by reversing

9219

# the surrogate back into the original identifier. The identifier must be

9220

# encoded as ASCII. For a given crypto key and context, the same identifier

9221

# will be replaced with the same surrogate. Identifiers must be at least two

9222

# characters long. In the case that the identifier is the empty string, it will

9223

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

9224

# more.

9225

#

9226

# Note: We recommend using CryptoDeterministicConfig for all use cases which

9227

# do not require preserving the input alphabet space and size, plus warrant

9228

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9229

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

9230

# This annotation will be applied to the surrogate by prefixing it with

9231

# the name of the custom infoType followed by the number of

9232

# characters comprising the surrogate. The following scheme defines the

9233

# format: info_type_name(surrogate_character_count):surrogate

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9234

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9235

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

9236

# the surrogate is 'abc', the full replacement value

9237

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

9238

#

9239

# This annotation identifies the surrogate when inspecting content using the

9240

# custom infoType

9241

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

9242

# This facilitates reversal of the surrogate when it occurs in free text.

9243

#

9244

# In order for inspection to work properly, the name of this infoType must

9245

# not occur naturally anywhere in your data; otherwise, inspection may

9246

# find a surrogate that does not correspond to an actual identifier.

9247

# Therefore, choose your custom infoType name carefully after considering

9248

# what your data looks like. One way to select a name that has a high chance

9249

# of yielding reliable detection is to include one or more unicode characters

9250

# that are highly improbable to exist in your data.

9251

# For example, assuming your data is entered from a regular ASCII keyboard,

9252

# the symbol with the hex code point 29DD might be used like so:

9253

# ⧝MY_TOKEN_TYPE

9254

"name": "A String", # Name of the information type. Either a name of your choosing when

9255

# creating a CustomInfoType, or one of the names listed

9256

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

9257

# a built-in type. InfoType names should conform to the pattern

9258

# `[a-zA-Z0-9_]{1,64}`.

9259

},

9260

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

9261

# identifier in two different contexts won't be given the same surrogate. If

9262

# the context is not set, a default tweak will be used.

9263

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9264

# If the context is set but:

9265

#

9266

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9267

# 1. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9268

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9269

# a default tweak will be used.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9270

#

9271

# Note that case (1) is expected when an `InfoTypeTransformation` is

9272

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9273

# Currently, the referenced field may be of value type integer or string.

9274

#

9275

# The tweak is constructed as a sequence of bytes in big endian byte order

9276

# such that:

9277

#

9278

# - a 64 bit integer is encoded followed by a single byte of value 1

9279

# - a string is encoded in UTF-8 format followed by a single byte of value 2

9280

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9281

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9282

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

9283

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

9284

# a key encryption key (KEK) stored by KMS).

9285

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9286

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9287

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9288

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9289

# leaking the key. Choose another type of key if possible.

9290

"key": "A String", # Required. A 128/192/256 bit key.

9291

},

9292

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9293

# It will be discarded after the request finishes.

9294

"name": "A String", # Required. Name of the key.

9295

# This is an arbitrary string used to differentiate different keys.

9296

# A unique key is generated per name: two separate `TransientCryptoKey`

9297

# protos share the same generated key if their names are the same.

9298

# When the data crypto key is generated, this name is not used in any way

9299

# (repeating the api call will result in a different key being generated).

9300

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9301

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9302

# The wrapped key must be a 128/192/256 bit key.

9303

# Authorization requires the following IAM permissions when sending a request

9304

# to perform a crypto transformation using a kms-wrapped crypto key:

9305

# dlp.kms.encrypt

9306

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9307

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9308

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9309

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9310

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

9311

# that the FFX mode natively supports. This happens before/after

9312

# encryption/decryption.

9313

# Each character listed must appear only once.

9314

# Number of characters must be in the range [2, 95].

9315

# This must be encoded as ASCII.

9316

# The order of characters does not matter.

9317

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9318

},

9319

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

9320

# input. Outputs a base64 encoded representation of the encrypted output.

9321

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

9322

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9323

# This annotation will be applied to the surrogate by prefixing it with

9324

# the name of the custom info type followed by the number of

9325

# characters comprising the surrogate. The following scheme defines the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9326

# format: {info type name}({surrogate character count}):{surrogate}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9327

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9328

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

9329

# the surrogate is 'abc', the full replacement value

9330

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9331

#

9332

# This annotation identifies the surrogate when inspecting content using the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9333

# custom info type 'Surrogate'. This facilitates reversal of the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9334

# surrogate when it occurs in free text.

9335

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9336

# Note: For record transformations where the entire cell in a table is being

9337

# transformed, surrogates are not mandatory. Surrogates are used to denote

9338

# the location of the token and are necessary for re-identification in free

9339

# form text.

9340

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9341

# In order for inspection to work properly, the name of this info type must

9342

# not occur naturally anywhere in your data; otherwise, inspection may either

9343

#

9344

# - reverse a surrogate that does not correspond to an actual identifier

9345

# - be unable to parse the surrogate and result in an error

9346

#

9347

# Therefore, choose your custom info type name carefully after considering

9348

# what your data looks like. One way to select a name that has a high chance

9349

# of yielding reliable detection is to include one or more unicode characters

9350

# that are highly improbable to exist in your data.

9351

# For example, assuming your data is entered from a regular ASCII keyboard,

9352

# the symbol with the hex code point 29DD might be used like so:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9353

# ⧝MY_TOKEN_TYPE.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9354

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9355

# creating a CustomInfoType, or one of the names listed

9356

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

9357

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9358

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9359

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9360

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

9361

# referential integrity such that the same identifier in two different

9362

# contexts will be given a distinct surrogate. The context is appended to

9363

# plaintext value being encrypted. On decryption the provided context is

9364

# validated against the value used during encryption. If a context was

9365

# provided during encryption, same context must be provided during decryption

9366

# as well.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9367

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9368

# If the context is not set, plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9369

# If the context is set but:

9370

#

9371

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9372

# 2. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9373

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9374

# plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9375

#

9376

# Note that case (1) is expected when an `InfoTypeTransformation` is

9377

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9378

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9379

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9380

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

9381

# a key encryption key (KEK) stored by KMS).

9382

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9383

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9384

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9385

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9386

# leaking the key. Choose another type of key if possible.

9387

"key": "A String", # Required. A 128/192/256 bit key.

9388

},

9389

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9390

# It will be discarded after the request finishes.

9391

"name": "A String", # Required. Name of the key.

9392

# This is an arbitrary string used to differentiate different keys.

9393

# A unique key is generated per name: two separate `TransientCryptoKey`

9394

# protos share the same generated key if their names are the same.

9395

# When the data crypto key is generated, this name is not used in any way

9396

# (repeating the api call will result in a different key being generated).

9397

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9398

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9399

# The wrapped key must be a 128/192/256 bit key.

9400

# Authorization requires the following IAM permissions when sending a request

9401

# to perform a crypto transformation using a kms-wrapped crypto key:

9402

# dlp.kms.encrypt

9403

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9404

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9405

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9406

},

9407

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9408

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9409

# replacement values are dynamically provided by the user for custom behavior,

9410

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

9411

# This can be used on

9412

# data of type: number, long, string, timestamp.

9413

# If the bound `Value` type differs from the type of data being transformed, we

9414

# will first attempt converting the type of the data to be transformed to match

9415

# the type of the bound before comparing.

9416

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9417

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9418

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9419

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

9420

# the default behavior will be to hyphenate the min-max range.

9421

# Note that for the purposes of inspection or transformation, the number

9422

# of bytes considered to comprise a 'Value' is based on its representation

9423

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9424

# 123456789, the number of bytes would be counted as 9, even though an

9425

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9426

"timestampValue": "A String", # timestamp

9427

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9428

# and time zone are either specified elsewhere or are not significant. The date

9429

# is relative to the Proleptic Gregorian Calendar. This can represent:

9430

#

9431

# * A full date, with non-zero year, month and day values

9432

# * A month and day value, with a zero year, e.g. an anniversary

9433

# * A year on its own, with zero month and day values

9434

# * A year and month value, with a zero day, e.g. a credit card expiration date

9435

#

9436

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9437

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9438

# a year.

9439

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9440

# month and day.

9441

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9442

# if specifying a year by itself or a year and month where the day is not

9443

# significant.

9444

},

9445

"stringValue": "A String", # string

9446

"integerValue": "A String", # integer

9447

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9448

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9449

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9450

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9451

# to allow the value "24:00:00" for scenarios like business closing time.

9452

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9453

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9454

# allow the value 60 if it allows leap-seconds.

9455

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9456

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9457

"booleanValue": True or False, # boolean

9458

"floatValue": 3.14, # float

9459

"dayOfWeekValue": "A String", # day of week

9460

},

9461

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

9462

# used.

9463

# Note that for the purposes of inspection or transformation, the number

9464

# of bytes considered to comprise a 'Value' is based on its representation

9465

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9466

# 123456789, the number of bytes would be counted as 9, even though an

9467

# int64 only holds up to 8 bytes of data.

9468

"timestampValue": "A String", # timestamp

9469

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9470

# and time zone are either specified elsewhere or are not significant. The date

9471

# is relative to the Proleptic Gregorian Calendar. This can represent:

9472

#

9473

# * A full date, with non-zero year, month and day values

9474

# * A month and day value, with a zero year, e.g. an anniversary

9475

# * A year on its own, with zero month and day values

9476

# * A year and month value, with a zero day, e.g. a credit card expiration date

9477

#

9478

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9479

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9480

# a year.

9481

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9482

# month and day.

9483

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9484

# if specifying a year by itself or a year and month where the day is not

9485

# significant.

9486

},

9487

"stringValue": "A String", # string

9488

"integerValue": "A String", # integer

9489

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9490

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9491

# types are google.type.Date and `google.protobuf.Timestamp`.

9492

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9493

# to allow the value "24:00:00" for scenarios like business closing time.

9494

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9495

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9496

# allow the value 60 if it allows leap-seconds.

9497

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9498

},

9499

"booleanValue": True or False, # boolean

9500

"floatValue": 3.14, # float

9501

"dayOfWeekValue": "A String", # day of week

9502

},

9503

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

9504

# Note that for the purposes of inspection or transformation, the number

9505

# of bytes considered to comprise a 'Value' is based on its representation

9506

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9507

# 123456789, the number of bytes would be counted as 9, even though an

9508

# int64 only holds up to 8 bytes of data.

9509

"timestampValue": "A String", # timestamp

9510

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9511

# and time zone are either specified elsewhere or are not significant. The date

9512

# is relative to the Proleptic Gregorian Calendar. This can represent:

9513

#

9514

# * A full date, with non-zero year, month and day values

9515

# * A month and day value, with a zero year, e.g. an anniversary

9516

# * A year on its own, with zero month and day values

9517

# * A year and month value, with a zero day, e.g. a credit card expiration date

9518

#

9519

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9520

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9521

# a year.

9522

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9523

# month and day.

9524

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9525

# if specifying a year by itself or a year and month where the day is not

9526

# significant.

9527

},

9528

"stringValue": "A String", # string

9529

"integerValue": "A String", # integer

9530

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9531

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9532

# types are google.type.Date and `google.protobuf.Timestamp`.

9533

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9534

# to allow the value "24:00:00" for scenarios like business closing time.

9535

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9536

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9537

# allow the value 60 if it allows leap-seconds.

9538

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9539

},

9540

"booleanValue": True or False, # boolean

9541

"floatValue": 3.14, # float

9542

"dayOfWeekValue": "A String", # day of week

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9547

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

9548

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

9549

# output would be 'My phone number is '.

9550

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9551

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

9552

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9553

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9554

# of bytes considered to comprise a 'Value' is based on its representation

9555

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9556

# 123456789, the number of bytes would be counted as 9, even though an

9557

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9558

"timestampValue": "A String", # timestamp

9559

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9560

# and time zone are either specified elsewhere or are not significant. The date

9561

# is relative to the Proleptic Gregorian Calendar. This can represent:

9562

#

9563

# * A full date, with non-zero year, month and day values

9564

# * A month and day value, with a zero year, e.g. an anniversary

9565

# * A year on its own, with zero month and day values

9566

# * A year and month value, with a zero day, e.g. a credit card expiration date

9567

#

9568

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9569

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9570

# a year.

9571

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9572

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9573

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9574

# if specifying a year by itself or a year and month where the day is not

9575

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9576

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9577

"stringValue": "A String", # string

9578

"integerValue": "A String", # integer

9579

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9580

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9581

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9582

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9583

# to allow the value "24:00:00" for scenarios like business closing time.

9584

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9585

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9586

# allow the value 60 if it allows leap-seconds.

9587

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9588

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9589

"booleanValue": True or False, # boolean

9590

"floatValue": 3.14, # float

9591

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9592

},

9593

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9594

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

9595

# Bucketing transformation can provide all of this functionality,

9596

# but requires more configuration. This message is provided as a convenience to

9597

# the user for simple bucketing strategies.

9598

#

9599

# The transformed value will be a hyphenated string of

9600

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

9601

# all values that are within this bucket will be replaced with "10-20".

9602

#

9603

# This can be used on data of type: double, long.

9604

#

9605

# If the bound Value type differs from the type of data

9606

# being transformed, we will first attempt converting the type of the data to

9607

# be transformed to match the type of the bound before comparing.

9608

#

9609

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9610

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

9611

# grouped together into a single bucket; for example if `upper_bound` = 89,

9612

# then all values greater than 89 are replaced with the value "89+".

9613

# Note that for the purposes of inspection or transformation, the number

9614

# of bytes considered to comprise a 'Value' is based on its representation

9615

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9616

# 123456789, the number of bytes would be counted as 9, even though an

9617

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9618

"timestampValue": "A String", # timestamp

9619

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9620

# and time zone are either specified elsewhere or are not significant. The date

9621

# is relative to the Proleptic Gregorian Calendar. This can represent:

9622

#

9623

# * A full date, with non-zero year, month and day values

9624

# * A month and day value, with a zero year, e.g. an anniversary

9625

# * A year on its own, with zero month and day values

9626

# * A year and month value, with a zero day, e.g. a credit card expiration date

9627

#

9628

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9629

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9630

# a year.

9631

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9632

# month and day.

9633

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9634

# if specifying a year by itself or a year and month where the day is not

9635

# significant.

9636

},

9637

"stringValue": "A String", # string

9638

"integerValue": "A String", # integer

9639

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9640

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9641

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9642

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9643

# to allow the value "24:00:00" for scenarios like business closing time.

9644

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9645

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9646

# allow the value 60 if it allows leap-seconds.

9647

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9648

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9649

"booleanValue": True or False, # boolean

9650

"floatValue": 3.14, # float

9651

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9652

},

9653

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

9654

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

9655

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

9656

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9657

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

9658

# grouped together into a single bucket; for example if `lower_bound` = 10,

9659

# then all values less than 10 are replaced with the value "-10".

9660

# Note that for the purposes of inspection or transformation, the number

9661

# of bytes considered to comprise a 'Value' is based on its representation

9662

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9663

# 123456789, the number of bytes would be counted as 9, even though an

9664

# int64 only holds up to 8 bytes of data.

9665

"timestampValue": "A String", # timestamp

9666

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9667

# and time zone are either specified elsewhere or are not significant. The date

9668

# is relative to the Proleptic Gregorian Calendar. This can represent:

9669

#

9670

# * A full date, with non-zero year, month and day values

9671

# * A month and day value, with a zero year, e.g. an anniversary

9672

# * A year on its own, with zero month and day values

9673

# * A year and month value, with a zero day, e.g. a credit card expiration date

9674

#

9675

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9676

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9677

# a year.

9678

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9679

# month and day.

9680

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9681

# if specifying a year by itself or a year and month where the day is not

9682

# significant.

9683

},

9684

"stringValue": "A String", # string

9685

"integerValue": "A String", # integer

9686

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9687

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9688

# types are google.type.Date and `google.protobuf.Timestamp`.

9689

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9690

# to allow the value "24:00:00" for scenarios like business closing time.

9691

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9692

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9693

# allow the value 60 if it allows leap-seconds.

9694

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9695

},

9696

"booleanValue": True or False, # boolean

9697

"floatValue": 3.14, # float

9698

"dayOfWeekValue": "A String", # day of week

9699

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9700

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9701

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

9702

# fixed character. Masking can start from the beginning or end of the string.

9703

# This can be used on data of any type (numbers, longs, and so on) and when

9704

# de-identifying structured data we'll attempt to preserve the original data's

9705

# type. (This allows you to take a long like 123 and modify it to a string like

9706

# **3.

9707

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

9708

# characters. For example, if the input string is `555-555-5555` and you

9709

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

9710

# returns `***-**5-5555`.

9711

{ # Characters to skip when doing deidentification of a value. These will be left

9712

# alone and skipped.

9713

"charactersToSkip": "A String", # Characters to not transform when masking.

9714

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

9719

# masked. Skipped characters do not count towards this tally.

9720

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

9721

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

9722

# code or credit card number. This string must have a length of 1. If not

9723

# supplied, this value defaults to `*` for strings, and `0` for digits.

9724

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

9725

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

9726

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

9727

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

9728

# is `true`, then the string `12345` is masked as `12***`.

9729

},

9730

},

9731

"field": { # General identifier of a data field in a storage service. # Set if the transformation was limited to a specific FieldId.

9732

"name": "A String", # Name describing the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9733

},

9734

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

9735

"recordSuppress": { # Configuration to suppress records whose suppression conditions evaluate to # The specific suppression option these stats apply to.

9736

# true.

9737

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

9738

# evaluated to be suppressed from the transformed content.

9739

# a field.

9740

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

9741

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

9742

# only supported value is `AND`.

9743

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

9744

"conditions": [ # A collection of conditions.

9745

{ # The field type of `value` and `field` do not need to match to be

9746

# considered equal, but not all comparisons are possible.

9747

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

9748

# but all other comparisons are invalid with incompatible types.

9749

# A `value` of type:

9750

#

9751

# - `string` can be compared against all other types

9752

# - `boolean` can only be compared against other booleans

9753

# - `integer` can be compared against doubles or a string if the string value

9754

# can be parsed as an integer.

9755

# - `double` can be compared against integers or a string if the string can

9756

# be parsed as a double.

9757

# - `Timestamp` can be compared against strings in RFC 3339 date string

9758

# format.

9759

# - `TimeOfDay` can be compared against timestamps and strings in the format

9760

# of 'HH:mm:ss'.

9761

#

9762

# If we fail to compare do to type mismatch, a warning will be given and

9763

# the condition will evaluate to false.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9764

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

9765

# Note that for the purposes of inspection or transformation, the number

9766

# of bytes considered to comprise a 'Value' is based on its representation

9767

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9768

# 123456789, the number of bytes would be counted as 9, even though an

9769

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9770

"timestampValue": "A String", # timestamp

9771

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9772

# and time zone are either specified elsewhere or are not significant. The date

9773

# is relative to the Proleptic Gregorian Calendar. This can represent:

9774

#

9775

# * A full date, with non-zero year, month and day values

9776

# * A month and day value, with a zero year, e.g. an anniversary

9777

# * A year on its own, with zero month and day values

9778

# * A year and month value, with a zero day, e.g. a credit card expiration date

9779

#

9780

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9781

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9782

# a year.

9783

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9784

# month and day.

9785

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9786

# if specifying a year by itself or a year and month where the day is not

9787

# significant.

9788

},

9789

"stringValue": "A String", # string

9790

"integerValue": "A String", # integer

9791

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9792

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9793

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9794

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9795

# to allow the value "24:00:00" for scenarios like business closing time.

9796

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9797

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9798

# allow the value 60 if it allows leap-seconds.

9799

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9800

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9801

"booleanValue": True or False, # boolean

9802

"floatValue": 3.14, # float

9803

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9804

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9805

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

9806

"name": "A String", # Name describing the field.

9807

},

9808

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9809

},

9810

],

9811

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9812

},

9813

},

9814

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9815

"infoType": { # Type of information detected by the API. # Set if the transformation was limited to a specific InfoType.

9816

"name": "A String", # Name of the information type. Either a name of your choosing when

9817

# creating a CustomInfoType, or one of the names listed

9818

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

9819

# a built-in type. InfoType names should conform to the pattern

9820

# `[a-zA-Z0-9_]{1,64}`.

9821

},

9822

"results": [ # Collection of all transformations that took place or had an error.

9823

{ # A collection that informs the user the number of times a particular

9824

# `TransformationResultCode` and error details occurred.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9825

"details": "A String", # A place for warnings or errors to show up if a transformation didn't

9826

# work as expected.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9827

"code": "A String", # Outcome of the transformation.

9828

"count": "A String", # Number of transformations counted by this result.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9829

},

9830

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9831

},

9832

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9833

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

9834

},

9835

"item": { # Container structure for the content to inspect. # The re-identified item.

9836

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9837

"data": "A String", # Content data to inspect or redact.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9838

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9839

},

9840

"value": "A String", # String data to inspect or redact.

9841

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

9842

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

9843

# learn more.

9844

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

9845

# learn more.

9846

"rows": [ # Rows of the table.

9847

{ # Values of the row.

9848

"values": [ # Individual cells.

9849

{ # Set of primitive values supported by the system.

9850

# Note that for the purposes of inspection or transformation, the number

9851

# of bytes considered to comprise a 'Value' is based on its representation

9852

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9853

# 123456789, the number of bytes would be counted as 9, even though an

9854

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9855

"timestampValue": "A String", # timestamp

9856

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9857

# and time zone are either specified elsewhere or are not significant. The date

9858

# is relative to the Proleptic Gregorian Calendar. This can represent:

9859

#

9860

# * A full date, with non-zero year, month and day values

9861

# * A month and day value, with a zero year, e.g. an anniversary

9862

# * A year on its own, with zero month and day values

9863

# * A year and month value, with a zero day, e.g. a credit card expiration date

9864

#

9865

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9866

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9867

# a year.

9868

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9869

# month and day.

9870

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9871

# if specifying a year by itself or a year and month where the day is not

9872

# significant.

9873

},

9874

"stringValue": "A String", # string

9875

"integerValue": "A String", # integer

9876

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9877

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9878

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9879

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9880

# to allow the value "24:00:00" for scenarios like business closing time.

9881

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9882

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9883

# allow the value 60 if it allows leap-seconds.

9884

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9885

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame^]

9886

"booleanValue": True or False, # boolean

9887

"floatValue": 3.14, # float

9888

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

],

"headers": [ # Headers of the table.

9894

{ # General identifier of a data field in a storage service.

9895

"name": "A String", # Name describing the field.

9896

},

9897

],

9898

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9899

},

Bu Sun Kim