Blame - docs/dyn/dlp_v2.projects.locations.content.html - platform/external/python/google-api-python-client

<h1><a href="dlp_v2.html">Cloud Data Loss Prevention (DLP) API</a> . <a href="dlp_v2.projects.html">projects</a> . <a href="dlp_v2.projects.locations.html">locations</a> . <a href="dlp_v2.projects.locations.content.html">content</a></h1>

76

<h2>Instance Methods</h2>

77

78

<code><a href="#deidentify">deidentify(parent, locationId, body=None, x__xgafv=None)</a></code></p>

79

<p class="firstline">De-identifies potentially sensitive info from a ContentItem.</p>

80

81

<code><a href="#inspect">inspect(parent, locationId, body=None, x__xgafv=None)</a></code></p>

82

<p class="firstline">Finds potentially sensitive info in content.</p>

83

84

<code><a href="#reidentify">reidentify(parent, locationId, body=None, x__xgafv=None)</a></code></p>

85

<p class="firstline">Re-identifies content that has been de-identified.</p>

86

<h3>Method Details</h3>

87

88

<code class="details" id="deidentify">deidentify(parent, locationId, body=None, x__xgafv=None)</code>

89

<pre>De-identifies potentially sensitive info from a ContentItem.

90

This method has limits on input size and output size.

91

See https://cloud.google.com/dlp/docs/deidentify-sensitive-data to

92

learn more.

93

94

When no InfoTypes or CustomInfoTypes are specified in this request, the

95

system will automatically choose what detectors to run. By default this may

96

be all types, but may change over time as detectors are updated.

97

98

Args:

99

parent: string, The parent resource name, for example projects/my-project-id. (required)

100

locationId: string, The geographic location to process de-identification. Reserved for future

101

extensions. (required)

102

body: object, The request body.

103

The object takes the form of:

104

105

{ # Request to de-identify a list of items.

106

"item": { # Container structure for the content to inspect. # The item to de-identify. Will be treated as text.

107

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

108

"data": "A String", # Content data to inspect or redact.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

109

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

110

},

111

"value": "A String", # String data to inspect or redact.

112

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

113

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

114

# learn more.

115

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

116

# learn more.

117

"rows": [ # Rows of the table.

118

{ # Values of the row.

119

"values": [ # Individual cells.

120

{ # Set of primitive values supported by the system.

121

# Note that for the purposes of inspection or transformation, the number

122

# of bytes considered to comprise a 'Value' is based on its representation

123

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

124

# 123456789, the number of bytes would be counted as 9, even though an

125

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

126

"timestampValue": "A String", # timestamp

127

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

128

# and time zone are either specified elsewhere or are not significant. The date

129

# is relative to the Proleptic Gregorian Calendar. This can represent:

130

#

131

# * A full date, with non-zero year, month and day values

132

# * A month and day value, with a zero year, e.g. an anniversary

133

# * A year on its own, with zero month and day values

134

# * A year and month value, with a zero day, e.g. a credit card expiration date

135

#

136

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

137

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

138

# a year.

139

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

140

# month and day.

141

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

142

# if specifying a year by itself or a year and month where the day is not

143

# significant.

144

},

145

"stringValue": "A String", # string

146

"integerValue": "A String", # integer

147

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

148

# or are specified elsewhere. An API may choose to allow leap seconds. Related

149

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

150

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

151

# to allow the value "24:00:00" for scenarios like business closing time.

152

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

153

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

154

# allow the value 60 if it allows leap-seconds.

155

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

156

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

157

"booleanValue": True or False, # boolean

158

"floatValue": 3.14, # float

159

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

],

"headers": [ # Headers of the table.

165

{ # General identifier of a data field in a storage service.

166

"name": "A String", # Name describing the field.

},

],

},

},

"inspectTemplateName": "A String", # Template to use. Any configuration directly specified in

172

# inspect_config will override those set in the template. Singular fields

173

# that are set in this request will replace their corresponding fields in the

174

# template. Repeated fields are appended. Singular sub-messages and groups

175

# are recursively merged.

176

"deidentifyTemplateName": "A String", # Template to use. Any configuration directly specified in

177

# deidentify_config will override those set in the template. Singular fields

178

# that are set in this request will replace their corresponding fields in the

179

# template. Repeated fields are appended. Singular sub-messages and groups

180

# are recursively merged.

181

"inspectConfig": { # Configuration description of the scanning process. # Configuration for the inspector.

182

# Items specified here will override the template referenced by the

183

# inspect_template_name argument.

184

# When used with redactContent only info_types and min_likelihood are currently

185

# used.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

186

"minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is

187

# POSSIBLE.

188

# See https://cloud.google.com/dlp/docs/likelihood to learn more.

189

"contentOptions": [ # List of options defining data content to scan.

190

# If empty, text, images, and other content will be included.

191

"A String",

192

],

193

"infoTypes": [ # Restricts what info_types to look for. The values must correspond to

194

# InfoType values returned by ListInfoTypes or listed at

195

# https://cloud.google.com/dlp/docs/infotypes-reference.

196

#

197

# When no InfoTypes or CustomInfoTypes are specified in a request, the

198

# system may automatically choose what detectors to run. By default this may

199

# be all types, but may change over time as detectors are updated.

200

#

201

# If you need precise control and predictability as to what detectors are

202

# run you should specify specific InfoTypes listed in the reference,

203

# otherwise a default list will be used, which may change over time.

204

{ # Type of information detected by the API.

205

"name": "A String", # Name of the information type. Either a name of your choosing when

206

# creating a CustomInfoType, or one of the names listed

207

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

208

# a built-in type. InfoType names should conform to the pattern

209

# `[a-zA-Z0-9_]{1,64}`.

210

},

211

],

212

"excludeInfoTypes": True or False, # When true, excludes type information of the findings.

213

"customInfoTypes": [ # CustomInfoTypes provided by the user. See

214

# https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

215

{ # Custom information type provided by the user. Used to find domain-specific

216

# sensitive information configurable to the data in question.

217

"surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that

218

# support reversing.

219

# such as

220

# [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).

221

# These types of transformations are

222

# those that perform pseudonymization, thereby producing a "surrogate" as

223

# output. This should be used in conjunction with a field on the

224

# transformation such as `surrogate_info_type`. This CustomInfoType does

225

# not support the use of `detection_rules`.

226

},

227

"likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be

228

# altered by a detection rule if the finding meets the criteria specified by

229

# the rule. Defaults to `VERY_LIKELY` if not specified.

230

"infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in

231

# infoType, when the name matches one of existing infoTypes and that infoType

232

# is specified in `InspectContent.info_types` field. Specifying the latter

233

# adds findings to the one detected by the system. If built-in info type is

234

# not specified in `InspectContent.info_types` list then the name is treated

235

# as a custom info type.

236

"name": "A String", # Name of the information type. Either a name of your choosing when

237

# creating a CustomInfoType, or one of the names listed

238

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

239

# a built-in type. InfoType names should conform to the pattern

240

# `[a-zA-Z0-9_]{1,64}`.

241

},

242

"regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.

243

"groupIndexes": [ # The index of the submatch to extract as findings. When not

244

# specified, the entire match is returned. No more than 3 may be included.

245

42,

246

],

247

"pattern": "A String", # Pattern defining the regular expression. Its syntax

248

# (https://github.com/google/re2/wiki/Syntax) can be found under the

249

# google/re2 repository on GitHub.

250

},

251

"detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.

252

# Rules are applied in order that they are specified. Not supported for the

253

# `surrogate_type` CustomInfoType.

254

{ # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a

255

# `CustomInfoType` to alter behavior under certain circumstances, depending

256

# on the specific details of the rule. Not supported for the `surrogate_type`

257

# custom infoType.

258

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

259

# proximity of hotwords.

260

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

261

# part of a detection rule.

262

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

263

# levels. For example, if a finding would be `POSSIBLE` without the

264

# detection rule and `relative_likelihood` is 1, then it is upgraded to

265

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

266

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

267

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

268

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

269

# a final likelihood of `LIKELY`.

270

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

271

},

272

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

273

"groupIndexes": [ # The index of the submatch to extract as findings. When not

274

# specified, the entire match is returned. No more than 3 may be included.

275

42,

276

],

277

"pattern": "A String", # Pattern defining the regular expression. Its syntax

278

# (https://github.com/google/re2/wiki/Syntax) can be found under the

279

# google/re2 repository on GitHub.

280

},

281

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

282

# The total length of the window cannot exceed 1000 characters. Note that

283

# the finding itself will be included in the window, so that hotwords may

284

# be used to match substrings of the finding itself. For example, the

285

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

286

# adjusted upwards if the area code is known to be the local area code of

287

# a company office using the hotword regex "\(xxx\)", where "xxx"

288

# is the area code in question.

289

# rule.

290

"windowBefore": 42, # Number of characters before the finding to consider.

291

"windowAfter": 42, # Number of characters after the finding to consider.

},

},

},

],

"exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding

297

# to be returned. It still can be used for rules matching.

298

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.

299

# be used to match sensitive information specific to the data, such as a list

300

# of employee IDs or job titles.

301

#

302

# Dictionary words are case-insensitive and all characters other than letters

303

# and digits in the unicode [Basic Multilingual

304

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

305

# will be replaced with whitespace when scanning for matches, so the

306

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

307

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

308

# surrounding any match must be of a different type than the adjacent

309

# characters within the word, so letters must be next to non-letters and

310

# digits next to non-digits. For example, the dictionary word "jen" will

311

# match the first three letters of the text "jen123" but will return no

312

# matches for "jennifer".

313

#

314

# Dictionary words containing a large number of characters that are not

315

# letters or digits may result in unexpected findings because such characters

316

# are treated as whitespace. The

317

# [limits](https://cloud.google.com/dlp/limits) page contains details about

318

# the size limits of dictionaries. For dictionaries that do not fit within

319

# these constraints, consider using `LargeCustomDictionaryConfig` in the

320

# `StoredInfoType` API.

321

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

322

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

323

# at least one phrase and every phrase must contain at least 2 characters

324

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

329

# is accepted.

330

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

331

# Example: gs://[BUCKET_NAME]/dictionary.txt

332

},

333

},

334

"storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in

335

# `InspectDataSource`. Not currently supported in `InspectContent`.

336

"name": "A String", # Resource name of the requested `StoredInfoType`, for example

337

# `organizations/433245324/storedInfoTypes/432452342` or

338

# `projects/project-id/storedInfoTypes/432452342`.

339

"createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for

340

# inspection was created. Output-only field, populated by the system.

341

},

342

},

343

],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

344

"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is

345

# included in the response; see Finding.quote.

346

"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig.

347

# Exclusion rules, contained in the set are executed in the end, other

348

# rules are executed in the order they are specified for each info type.

349

{ # Rule set for modifying a set of infoTypes to alter behavior under certain

350

# circumstances, depending on the specific details of the rules within the set.

351

"infoTypes": [ # List of infoTypes this rule set is applied to.

352

{ # Type of information detected by the API.

353

"name": "A String", # Name of the information type. Either a name of your choosing when

354

# creating a CustomInfoType, or one of the names listed

355

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

356

# a built-in type. InfoType names should conform to the pattern

357

# `[a-zA-Z0-9_]{1,64}`.

358

},

359

],

360

"rules": [ # Set of rules to be applied to infoTypes. The rules are applied in order.

361

{ # A single inspection rule to be applied to infoTypes, specified in

362

# `InspectionRuleSet`.

363

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

364

# proximity of hotwords.

365

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

366

# part of a detection rule.

367

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

368

# levels. For example, if a finding would be `POSSIBLE` without the

369

# detection rule and `relative_likelihood` is 1, then it is upgraded to

370

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

371

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

372

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

373

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

374

# a final likelihood of `LIKELY`.

375

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

376

},

377

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

378

"groupIndexes": [ # The index of the submatch to extract as findings. When not

379

# specified, the entire match is returned. No more than 3 may be included.

380

42,

381

],

382

"pattern": "A String", # Pattern defining the regular expression. Its syntax

383

# (https://github.com/google/re2/wiki/Syntax) can be found under the

384

# google/re2 repository on GitHub.

385

},

386

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

387

# The total length of the window cannot exceed 1000 characters. Note that

388

# the finding itself will be included in the window, so that hotwords may

389

# be used to match substrings of the finding itself. For example, the

390

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

391

# adjusted upwards if the area code is known to be the local area code of

392

# a company office using the hotword regex "\(xxx\)", where "xxx"

393

# is the area code in question.

394

# rule.

395

"windowBefore": 42, # Number of characters before the finding to consider.

396

"windowAfter": 42, # Number of characters after the finding to consider.

397

},

398

},

399

"exclusionRule": { # The rule that specifies conditions when findings of infoTypes specified in # Exclusion rule.

400

# `InspectionRuleSet` are removed from results.

401

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # Dictionary which defines the rule.

402

# be used to match sensitive information specific to the data, such as a list

403

# of employee IDs or job titles.

404

#

405

# Dictionary words are case-insensitive and all characters other than letters

406

# and digits in the unicode [Basic Multilingual

407

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

408

# will be replaced with whitespace when scanning for matches, so the

409

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

410

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

411

# surrounding any match must be of a different type than the adjacent

412

# characters within the word, so letters must be next to non-letters and

413

# digits next to non-digits. For example, the dictionary word "jen" will

414

# match the first three letters of the text "jen123" but will return no

415

# matches for "jennifer".

416

#

417

# Dictionary words containing a large number of characters that are not

418

# letters or digits may result in unexpected findings because such characters

419

# are treated as whitespace. The

420

# [limits](https://cloud.google.com/dlp/limits) page contains details about

421

# the size limits of dictionaries. For dictionaries that do not fit within

422

# these constraints, consider using `LargeCustomDictionaryConfig` in the

423

# `StoredInfoType` API.

424

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

425

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

426

# at least one phrase and every phrase must contain at least 2 characters

427

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

432

# is accepted.

433

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

434

# Example: gs://[BUCKET_NAME]/dictionary.txt

435

},

436

},

437

"regex": { # Message defining a custom regular expression. # Regular expression which defines the rule.

438

"groupIndexes": [ # The index of the submatch to extract as findings. When not

439

# specified, the entire match is returned. No more than 3 may be included.

440

42,

441

],

442

"pattern": "A String", # Pattern defining the regular expression. Its syntax

443

# (https://github.com/google/re2/wiki/Syntax) can be found under the

444

# google/re2 repository on GitHub.

445

},

446

"excludeInfoTypes": { # List of exclude infoTypes. # Set of infoTypes for which findings would affect this rule.

447

"infoTypes": [ # InfoType list in ExclusionRule rule drops a finding when it overlaps or

448

# contained within with a finding of an infoType from this list. For

449

# example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and

450

# `exclusion_rule` containing `exclude_info_types.info_types` with

451

# "EMAIL_ADDRESS" the phone number findings are dropped if they overlap

452

# with EMAIL_ADDRESS finding.

453

# That leads to "555-222-2222@example.org" to generate only a single

454

# finding, namely email address.

455

{ # Type of information detected by the API.

456

"name": "A String", # Name of the information type. Either a name of your choosing when

457

# creating a CustomInfoType, or one of the names listed

458

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

459

# a built-in type. InfoType names should conform to the pattern

460

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

"matchingType": "A String", # How the rule is applied, see MatchingType documentation for details.

},

},

],

},

],

"limits": { # Configuration to control the number of findings returned. # Configuration to control the number of findings returned.

471

"maxFindingsPerItem": 42, # Max number of findings that will be returned for each item scanned.

472

# When set within `InspectJobConfig`,

473

# the maximum returned is 2000 regardless if this is set higher.

474

# When set within `InspectContentRequest`, this field is ignored.

475

"maxFindingsPerInfoType": [ # Configuration of findings limit given for specified infoTypes.

476

{ # Max findings configuration per infoType, per content item or long

477

# running DlpJob.

478

"maxFindings": 42, # Max findings limit for the given infoType.

479

"infoType": { # Type of information detected by the API. # Type of information the findings limit applies to. Only one limit per

480

# info_type should be provided. If InfoTypeLimit does not have an

481

# info_type, the DLP API applies the limit against all info_types that

482

# are found but not specified in another InfoTypeLimit.

483

"name": "A String", # Name of the information type. Either a name of your choosing when

484

# creating a CustomInfoType, or one of the names listed

485

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

486

# a built-in type. InfoType names should conform to the pattern

487

# `[a-zA-Z0-9_]{1,64}`.

},

},

],

"maxFindingsPerRequest": 42, # Max number of findings that will be returned per request/job.

492

# When set within `InspectContentRequest`, the maximum returned is 2000

493

# regardless if this is set higher.

494

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

495

},

496

"deidentifyConfig": { # The configuration that controls how the data will change. # Configuration for the de-identification of the content item.

497

# Items specified here will override the template referenced by the

498

# deidentify_template_name argument.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

499

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text

500

# transformation everywhere.

501

# apply various `PrimitiveTransformation`s to each finding, where the

502

# transformation is applied to only values that were identified as a specific

503

# info_type.

504

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

505

# for a given infoType.

506

{ # A transformation to apply to text that is identified as a specific

507

# info_type.

508

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

509

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

510

# portion of the value.

511

"partToExtract": "A String", # The part of the time to keep.

512

},

513

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

514

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

515

# to learn more.

516

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

517

# If set, must also set cryptoKey. If set, shift will be consistent for the

518

# given context.

519

"name": "A String", # Name describing the field.

520

},

521

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

522

# range (inclusive ends). Negative means shift to earlier in time. Must not

523

# be more than 365250 days (1000 years) each direction.

524

#

525

# For example, 3 means shift date to at most 3 days into the future.

526

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

527

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

528

# results in the same shift for the same context and crypto_key. If

529

# set, must also set context. Can only be applied to table items.

530

# a key encryption key (KEK) stored by KMS).

531

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

532

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

533

# unwrap the data crypto key.

534

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

535

# leaking the key. Choose another type of key if possible.

536

"key": "A String", # Required. A 128/192/256 bit key.

537

},

538

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

539

# It will be discarded after the request finishes.

540

"name": "A String", # Required. Name of the key.

541

# This is an arbitrary string used to differentiate different keys.

542

# A unique key is generated per name: two separate `TransientCryptoKey`

543

# protos share the same generated key if their names are the same.

544

# When the data crypto key is generated, this name is not used in any way

545

# (repeating the api call will result in a different key being generated).

546

},

547

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

548

# The wrapped key must be a 128/192/256 bit key.

549

# Authorization requires the following IAM permissions when sending a request

550

# to perform a crypto transformation using a kms-wrapped crypto key:

551

# dlp.kms.encrypt

552

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

553

"wrappedKey": "A String", # Required. The wrapped data crypto key.

},

},

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

558

},

559

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

560

# Uses SHA-256.

561

# The key size must be either 32 or 64 bytes.

562

# Outputs a base64 encoded representation of the hashed output

563

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

564

# Currently, only string and integer values can be hashed.

565

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

566

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

567

# a key encryption key (KEK) stored by KMS).

568

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

569

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

570

# unwrap the data crypto key.

571

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

572

# leaking the key. Choose another type of key if possible.

573

"key": "A String", # Required. A 128/192/256 bit key.

574

},

575

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

576

# It will be discarded after the request finishes.

577

"name": "A String", # Required. Name of the key.

578

# This is an arbitrary string used to differentiate different keys.

579

# A unique key is generated per name: two separate `TransientCryptoKey`

580

# protos share the same generated key if their names are the same.

581

# When the data crypto key is generated, this name is not used in any way

582

# (repeating the api call will result in a different key being generated).

583

},

584

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

585

# The wrapped key must be a 128/192/256 bit key.

586

# Authorization requires the following IAM permissions when sending a request

587

# to perform a crypto transformation using a kms-wrapped crypto key:

588

# dlp.kms.encrypt

589

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

590

"wrappedKey": "A String", # Required. The wrapped data crypto key.

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

595

# (FPE) with the FFX mode of operation; however when used in the

596

# `ReidentifyContent` API method, it serves the opposite function by reversing

597

# the surrogate back into the original identifier. The identifier must be

598

# encoded as ASCII. For a given crypto key and context, the same identifier

599

# will be replaced with the same surrogate. Identifiers must be at least two

600

# characters long. In the case that the identifier is the empty string, it will

601

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

602

# more.

603

#

604

# Note: We recommend using CryptoDeterministicConfig for all use cases which

605

# do not require preserving the input alphabet space and size, plus warrant

606

# referential integrity.

607

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

608

# This annotation will be applied to the surrogate by prefixing it with

609

# the name of the custom infoType followed by the number of

610

# characters comprising the surrogate. The following scheme defines the

611

# format: info_type_name(surrogate_character_count):surrogate

612

#

613

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

614

# the surrogate is 'abc', the full replacement value

615

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

616

#

617

# This annotation identifies the surrogate when inspecting content using the

618

# custom infoType

619

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

620

# This facilitates reversal of the surrogate when it occurs in free text.

621

#

622

# In order for inspection to work properly, the name of this infoType must

623

# not occur naturally anywhere in your data; otherwise, inspection may

624

# find a surrogate that does not correspond to an actual identifier.

625

# Therefore, choose your custom infoType name carefully after considering

626

# what your data looks like. One way to select a name that has a high chance

627

# of yielding reliable detection is to include one or more unicode characters

628

# that are highly improbable to exist in your data.

629

# For example, assuming your data is entered from a regular ASCII keyboard,

630

# the symbol with the hex code point 29DD might be used like so:

631

# ⧝MY_TOKEN_TYPE

632

"name": "A String", # Name of the information type. Either a name of your choosing when

633

# creating a CustomInfoType, or one of the names listed

634

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

635

# a built-in type. InfoType names should conform to the pattern

636

# `[a-zA-Z0-9_]{1,64}`.

637

},

638

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

639

# identifier in two different contexts won't be given the same surrogate. If

640

# the context is not set, a default tweak will be used.

641

#

642

# If the context is set but:

643

#

644

# 1. there is no record present when transforming a given value or

645

# 1. the field is not present when transforming a given value,

646

#

647

# a default tweak will be used.

648

#

649

# Note that case (1) is expected when an `InfoTypeTransformation` is

650

# applied to both structured and non-structured `ContentItem`s.

651

# Currently, the referenced field may be of value type integer or string.

652

#

653

# The tweak is constructed as a sequence of bytes in big endian byte order

654

# such that:

655

#

656

# - a 64 bit integer is encoded followed by a single byte of value 1

657

# - a string is encoded in UTF-8 format followed by a single byte of value 2

658

"name": "A String", # Name describing the field.

659

},

660

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

661

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

662

# a key encryption key (KEK) stored by KMS).

663

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

664

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

665

# unwrap the data crypto key.

666

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

667

# leaking the key. Choose another type of key if possible.

668

"key": "A String", # Required. A 128/192/256 bit key.

669

},

670

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

671

# It will be discarded after the request finishes.

672

"name": "A String", # Required. Name of the key.

673

# This is an arbitrary string used to differentiate different keys.

674

# A unique key is generated per name: two separate `TransientCryptoKey`

675

# protos share the same generated key if their names are the same.

676

# When the data crypto key is generated, this name is not used in any way

677

# (repeating the api call will result in a different key being generated).

678

},

679

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

680

# The wrapped key must be a 128/192/256 bit key.

681

# Authorization requires the following IAM permissions when sending a request

682

# to perform a crypto transformation using a kms-wrapped crypto key:

683

# dlp.kms.encrypt

684

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

685

"wrappedKey": "A String", # Required. The wrapped data crypto key.

686

},

687

},

688

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

689

# that the FFX mode natively supports. This happens before/after

690

# encryption/decryption.

691

# Each character listed must appear only once.

692

# Number of characters must be in the range [2, 95].

693

# This must be encoded as ASCII.

694

# The order of characters does not matter.

695

"commonAlphabet": "A String", # Common alphabets.

696

},

697

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

698

# input. Outputs a base64 encoded representation of the encrypted output.

699

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

700

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

701

# This annotation will be applied to the surrogate by prefixing it with

702

# the name of the custom info type followed by the number of

703

# characters comprising the surrogate. The following scheme defines the

704

# format: {info type name}({surrogate character count}):{surrogate}

705

#

706

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

707

# the surrogate is 'abc', the full replacement value

708

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

709

#

710

# This annotation identifies the surrogate when inspecting content using the

711

# custom info type 'Surrogate'. This facilitates reversal of the

712

# surrogate when it occurs in free text.

713

#

714

# Note: For record transformations where the entire cell in a table is being

715

# transformed, surrogates are not mandatory. Surrogates are used to denote

716

# the location of the token and are necessary for re-identification in free

717

# form text.

718

#

719

# In order for inspection to work properly, the name of this info type must

720

# not occur naturally anywhere in your data; otherwise, inspection may either

721

#

722

# - reverse a surrogate that does not correspond to an actual identifier

723

# - be unable to parse the surrogate and result in an error

724

#

725

# Therefore, choose your custom info type name carefully after considering

726

# what your data looks like. One way to select a name that has a high chance

727

# of yielding reliable detection is to include one or more unicode characters

728

# that are highly improbable to exist in your data.

729

# For example, assuming your data is entered from a regular ASCII keyboard,

730

# the symbol with the hex code point 29DD might be used like so:

731

# ⧝MY_TOKEN_TYPE.

732

"name": "A String", # Name of the information type. Either a name of your choosing when

733

# creating a CustomInfoType, or one of the names listed

734

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

735

# a built-in type. InfoType names should conform to the pattern

736

# `[a-zA-Z0-9_]{1,64}`.

737

},

738

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

739

# referential integrity such that the same identifier in two different

740

# contexts will be given a distinct surrogate. The context is appended to

741

# plaintext value being encrypted. On decryption the provided context is

742

# validated against the value used during encryption. If a context was

743

# provided during encryption, same context must be provided during decryption

744

# as well.

745

#

746

# If the context is not set, plaintext would be used as is for encryption.

747

# If the context is set but:

748

#

749

# 1. there is no record present when transforming a given value or

750

# 2. the field is not present when transforming a given value,

751

#

752

# plaintext would be used as is for encryption.

753

#

754

# Note that case (1) is expected when an `InfoTypeTransformation` is

755

# applied to both structured and non-structured `ContentItem`s.

756

"name": "A String", # Name describing the field.

757

},

758

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

759

# a key encryption key (KEK) stored by KMS).

760

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

761

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

762

# unwrap the data crypto key.

763

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

764

# leaking the key. Choose another type of key if possible.

765

"key": "A String", # Required. A 128/192/256 bit key.

766

},

767

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

768

# It will be discarded after the request finishes.

769

"name": "A String", # Required. Name of the key.

770

# This is an arbitrary string used to differentiate different keys.

771

# A unique key is generated per name: two separate `TransientCryptoKey`

772

# protos share the same generated key if their names are the same.

773

# When the data crypto key is generated, this name is not used in any way

774

# (repeating the api call will result in a different key being generated).

775

},

776

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

777

# The wrapped key must be a 128/192/256 bit key.

778

# Authorization requires the following IAM permissions when sending a request

779

# to perform a crypto transformation using a kms-wrapped crypto key:

780

# dlp.kms.encrypt

781

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

782

"wrappedKey": "A String", # Required. The wrapped data crypto key.

},

},

},

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

787

# replacement values are dynamically provided by the user for custom behavior,

788

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

789

# This can be used on

790

# data of type: number, long, string, timestamp.

791

# If the bound `Value` type differs from the type of data being transformed, we

792

# will first attempt converting the type of the data to be transformed to match

793

# the type of the bound before comparing.

794

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

795

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

796

{ # Bucket is represented as a range, along with replacement values.

797

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

798

# the default behavior will be to hyphenate the min-max range.

799

# Note that for the purposes of inspection or transformation, the number

800

# of bytes considered to comprise a 'Value' is based on its representation

801

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

802

# 123456789, the number of bytes would be counted as 9, even though an

803

# int64 only holds up to 8 bytes of data.

804

"timestampValue": "A String", # timestamp

805

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

806

# and time zone are either specified elsewhere or are not significant. The date

807

# is relative to the Proleptic Gregorian Calendar. This can represent:

808

#

809

# * A full date, with non-zero year, month and day values

810

# * A month and day value, with a zero year, e.g. an anniversary

811

# * A year on its own, with zero month and day values

812

# * A year and month value, with a zero day, e.g. a credit card expiration date

813

#

814

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

815

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

816

# a year.

817

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

818

# month and day.

819

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

820

# if specifying a year by itself or a year and month where the day is not

821

# significant.

822

},

823

"stringValue": "A String", # string

824

"integerValue": "A String", # integer

825

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

826

# or are specified elsewhere. An API may choose to allow leap seconds. Related

827

# types are google.type.Date and `google.protobuf.Timestamp`.

828

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

829

# to allow the value "24:00:00" for scenarios like business closing time.

830

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

831

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

832

# allow the value 60 if it allows leap-seconds.

833

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

834

},

835

"booleanValue": True or False, # boolean

836

"floatValue": 3.14, # float

837

"dayOfWeekValue": "A String", # day of week

838

},

839

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

840

# used.

841

# Note that for the purposes of inspection or transformation, the number

842

# of bytes considered to comprise a 'Value' is based on its representation

843

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

844

# 123456789, the number of bytes would be counted as 9, even though an

845

# int64 only holds up to 8 bytes of data.

846

"timestampValue": "A String", # timestamp

847

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

848

# and time zone are either specified elsewhere or are not significant. The date

849

# is relative to the Proleptic Gregorian Calendar. This can represent:

850

#

851

# * A full date, with non-zero year, month and day values

852

# * A month and day value, with a zero year, e.g. an anniversary

853

# * A year on its own, with zero month and day values

854

# * A year and month value, with a zero day, e.g. a credit card expiration date

855

#

856

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

857

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

858

# a year.

859

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

860

# month and day.

861

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

862

# if specifying a year by itself or a year and month where the day is not

863

# significant.

864

},

865

"stringValue": "A String", # string

866

"integerValue": "A String", # integer

867

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

868

# or are specified elsewhere. An API may choose to allow leap seconds. Related

869

# types are google.type.Date and `google.protobuf.Timestamp`.

870

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

871

# to allow the value "24:00:00" for scenarios like business closing time.

872

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

873

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

874

# allow the value 60 if it allows leap-seconds.

875

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

876

},

877

"booleanValue": True or False, # boolean

878

"floatValue": 3.14, # float

879

"dayOfWeekValue": "A String", # day of week

880

},

881

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

882

# Note that for the purposes of inspection or transformation, the number

883

# of bytes considered to comprise a 'Value' is based on its representation

884

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

885

# 123456789, the number of bytes would be counted as 9, even though an

886

# int64 only holds up to 8 bytes of data.

887

"timestampValue": "A String", # timestamp

888

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

889

# and time zone are either specified elsewhere or are not significant. The date

890

# is relative to the Proleptic Gregorian Calendar. This can represent:

891

#

892

# * A full date, with non-zero year, month and day values

893

# * A month and day value, with a zero year, e.g. an anniversary

894

# * A year on its own, with zero month and day values

895

# * A year and month value, with a zero day, e.g. a credit card expiration date

896

#

897

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

898

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

899

# a year.

900

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

901

# month and day.

902

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

903

# if specifying a year by itself or a year and month where the day is not

904

# significant.

905

},

906

"stringValue": "A String", # string

907

"integerValue": "A String", # integer

908

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

909

# or are specified elsewhere. An API may choose to allow leap seconds. Related

910

# types are google.type.Date and `google.protobuf.Timestamp`.

911

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

912

# to allow the value "24:00:00" for scenarios like business closing time.

913

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

914

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

915

# allow the value 60 if it allows leap-seconds.

916

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

917

},

918

"booleanValue": True or False, # boolean

919

"floatValue": 3.14, # float

920

"dayOfWeekValue": "A String", # day of week

},

},

],

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

926

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

927

# output would be 'My phone number is '.

928

},

929

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

930

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

931

# Note that for the purposes of inspection or transformation, the number

932

# of bytes considered to comprise a 'Value' is based on its representation

933

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

934

# 123456789, the number of bytes would be counted as 9, even though an

935

# int64 only holds up to 8 bytes of data.

936

"timestampValue": "A String", # timestamp

937

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

938

# and time zone are either specified elsewhere or are not significant. The date

939

# is relative to the Proleptic Gregorian Calendar. This can represent:

940

#

941

# * A full date, with non-zero year, month and day values

942

# * A month and day value, with a zero year, e.g. an anniversary

943

# * A year on its own, with zero month and day values

944

# * A year and month value, with a zero day, e.g. a credit card expiration date

945

#

946

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

947

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

948

# a year.

949

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

950

# month and day.

951

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

952

# if specifying a year by itself or a year and month where the day is not

953

# significant.

954

},

955

"stringValue": "A String", # string

956

"integerValue": "A String", # integer

957

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

958

# or are specified elsewhere. An API may choose to allow leap seconds. Related

959

# types are google.type.Date and `google.protobuf.Timestamp`.

960

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

961

# to allow the value "24:00:00" for scenarios like business closing time.

962

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

963

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

964

# allow the value 60 if it allows leap-seconds.

965

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

966

},

967

"booleanValue": True or False, # boolean

968

"floatValue": 3.14, # float

969

"dayOfWeekValue": "A String", # day of week

970

},

971

},

972

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

973

# Bucketing transformation can provide all of this functionality,

974

# but requires more configuration. This message is provided as a convenience to

975

# the user for simple bucketing strategies.

976

#

977

# The transformed value will be a hyphenated string of

978

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

979

# all values that are within this bucket will be replaced with "10-20".

980

#

981

# This can be used on data of type: double, long.

982

#

983

# If the bound Value type differs from the type of data

984

# being transformed, we will first attempt converting the type of the data to

985

# be transformed to match the type of the bound before comparing.

986

#

987

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

988

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

989

# grouped together into a single bucket; for example if `upper_bound` = 89,

990

# then all values greater than 89 are replaced with the value "89+".

991

# Note that for the purposes of inspection or transformation, the number

992

# of bytes considered to comprise a 'Value' is based on its representation

993

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

994

# 123456789, the number of bytes would be counted as 9, even though an

995

# int64 only holds up to 8 bytes of data.

996

"timestampValue": "A String", # timestamp

997

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

998

# and time zone are either specified elsewhere or are not significant. The date

999

# is relative to the Proleptic Gregorian Calendar. This can represent:

1000

#

1001

# * A full date, with non-zero year, month and day values

1002

# * A month and day value, with a zero year, e.g. an anniversary

1003

# * A year on its own, with zero month and day values

1004

# * A year and month value, with a zero day, e.g. a credit card expiration date

1005

#

1006

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1007

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1008

# a year.

1009

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1010

# month and day.

1011

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1012

# if specifying a year by itself or a year and month where the day is not

1013

# significant.

1014

},

1015

"stringValue": "A String", # string

1016

"integerValue": "A String", # integer

1017

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1018

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1019

# types are google.type.Date and `google.protobuf.Timestamp`.

1020

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1021

# to allow the value "24:00:00" for scenarios like business closing time.

1022

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1023

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1024

# allow the value 60 if it allows leap-seconds.

1025

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1026

},

1027

"booleanValue": True or False, # boolean

1028

"floatValue": 3.14, # float

1029

"dayOfWeekValue": "A String", # day of week

1030

},

1031

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

1032

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

1033

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

1034

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

1035

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

1036

# grouped together into a single bucket; for example if `lower_bound` = 10,

1037

# then all values less than 10 are replaced with the value "-10".

1038

# Note that for the purposes of inspection or transformation, the number

1039

# of bytes considered to comprise a 'Value' is based on its representation

1040

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1041

# 123456789, the number of bytes would be counted as 9, even though an

1042

# int64 only holds up to 8 bytes of data.

1043

"timestampValue": "A String", # timestamp

1044

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1045

# and time zone are either specified elsewhere or are not significant. The date

1046

# is relative to the Proleptic Gregorian Calendar. This can represent:

1047

#

1048

# * A full date, with non-zero year, month and day values

1049

# * A month and day value, with a zero year, e.g. an anniversary

1050

# * A year on its own, with zero month and day values

1051

# * A year and month value, with a zero day, e.g. a credit card expiration date

1052

#

1053

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1054

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1055

# a year.

1056

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1057

# month and day.

1058

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1059

# if specifying a year by itself or a year and month where the day is not

1060

# significant.

1061

},

1062

"stringValue": "A String", # string

1063

"integerValue": "A String", # integer

1064

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1065

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1066

# types are google.type.Date and `google.protobuf.Timestamp`.

1067

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1068

# to allow the value "24:00:00" for scenarios like business closing time.

1069

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1070

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1071

# allow the value 60 if it allows leap-seconds.

1072

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1073

},

1074

"booleanValue": True or False, # boolean

1075

"floatValue": 3.14, # float

1076

"dayOfWeekValue": "A String", # day of week

1077

},

1078

},

1079

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

1080

# fixed character. Masking can start from the beginning or end of the string.

1081

# This can be used on data of any type (numbers, longs, and so on) and when

1082

# de-identifying structured data we'll attempt to preserve the original data's

1083

# type. (This allows you to take a long like 123 and modify it to a string like

1084

# **3.

1085

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

1086

# characters. For example, if the input string is `555-555-5555` and you

1087

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

1088

# returns `***-**5-5555`.

1089

{ # Characters to skip when doing deidentification of a value. These will be left

1090

# alone and skipped.

1091

"charactersToSkip": "A String", # Characters to not transform when masking.

1092

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

1097

# masked. Skipped characters do not count towards this tally.

1098

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

1099

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

1100

# code or credit card number. This string must have a length of 1. If not

1101

# supplied, this value defaults to `*` for strings, and `0` for digits.

1102

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

1103

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

1104

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

1105

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

1106

# is `true`, then the string `12345` is masked as `12***`.

1107

},

1108

},

1109

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

1110

# this transformation to apply to all findings that correspond to

1111

# infoTypes that were requested in `InspectConfig`.

1112

{ # Type of information detected by the API.

1113

"name": "A String", # Name of the information type. Either a name of your choosing when

1114

# creating a CustomInfoType, or one of the names listed

1115

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1116

# a built-in type. InfoType names should conform to the pattern

1117

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

],

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1123

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default

1124

# mode is `TransformationErrorHandling.ThrowError`.

1125

# transformation error occurs when the requested transformation is incompatible

1126

# with the data. For example, trying to de-identify an IP address using a

1127

# `DateShift` transformation would result in a transformation error, since date

1128

# info cannot be extracted from an IP address.

1129

# Information about any incompatible transformations, and how they were

1130

# handled, is returned in the response as part of the

1131

# `TransformationOverviews`.

1132

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

1133

},

1134

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would # Ignore errors

1135

# cause an error. For example, if a `DateShift` transformation were applied

1136

# an an IP address, this mode would leave the IP address unchanged in the

# response.

},

},

"recordTransformations": { # A type of transformation that is applied over structured data such as a # Treat the dataset as structured. Transformations can be applied to

1141

# specific locations within structured datasets, such as transforming

1142

# a column within a table.

1143

# table.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1144

"fieldTransformations": [ # Transform the record by applying various field transformations.

1145

{ # The transformation to apply to the field.

1146

"fields": [ # Required. Input field(s) to apply the transformation to.

1147

{ # General identifier of a data field in a storage service.

1148

"name": "A String", # Name describing the field.

1149

},

1150

],

1151

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

1152

# transform content that matches an `InfoType`.

1153

# apply various `PrimitiveTransformation`s to each finding, where the

1154

# transformation is applied to only values that were identified as a specific

1155

# info_type.

1156

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

1157

# for a given infoType.

1158

{ # A transformation to apply to text that is identified as a specific

1159

# info_type.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1160

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

1161

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

1162

# portion of the value.

1163

"partToExtract": "A String", # The part of the time to keep.

1164

},

1165

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

1166

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

1167

# to learn more.

1168

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

1169

# If set, must also set cryptoKey. If set, shift will be consistent for the

1170

# given context.

1171

"name": "A String", # Name describing the field.

1172

},

1173

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

1174

# range (inclusive ends). Negative means shift to earlier in time. Must not

1175

# be more than 365250 days (1000 years) each direction.

1176

#

1177

# For example, 3 means shift date to at most 3 days into the future.

1178

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1179

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

1180

# results in the same shift for the same context and crypto_key. If

1181

# set, must also set context. Can only be applied to table items.

1182

# a key encryption key (KEK) stored by KMS).

1183

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1184

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1185

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1186

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1187

# leaking the key. Choose another type of key if possible.

1188

"key": "A String", # Required. A 128/192/256 bit key.

1189

},

1190

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1191

# It will be discarded after the request finishes.

1192

"name": "A String", # Required. Name of the key.

1193

# This is an arbitrary string used to differentiate different keys.

1194

# A unique key is generated per name: two separate `TransientCryptoKey`

1195

# protos share the same generated key if their names are the same.

1196

# When the data crypto key is generated, this name is not used in any way

1197

# (repeating the api call will result in a different key being generated).

1198

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1199

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1200

# The wrapped key must be a 128/192/256 bit key.

1201

# Authorization requires the following IAM permissions when sending a request

1202

# to perform a crypto transformation using a kms-wrapped crypto key:

1203

# dlp.kms.encrypt

1204

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1205

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1206

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1207

},

1208

},

1209

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1210

},

1211

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

1212

# Uses SHA-256.

1213

# The key size must be either 32 or 64 bytes.

1214

# Outputs a base64 encoded representation of the hashed output

1215

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

1216

# Currently, only string and integer values can be hashed.

1217

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

1218

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

1219

# a key encryption key (KEK) stored by KMS).

1220

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1221

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1222

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1223

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1224

# leaking the key. Choose another type of key if possible.

1225

"key": "A String", # Required. A 128/192/256 bit key.

1226

},

1227

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1228

# It will be discarded after the request finishes.

1229

"name": "A String", # Required. Name of the key.

1230

# This is an arbitrary string used to differentiate different keys.

1231

# A unique key is generated per name: two separate `TransientCryptoKey`

1232

# protos share the same generated key if their names are the same.

1233

# When the data crypto key is generated, this name is not used in any way

1234

# (repeating the api call will result in a different key being generated).

1235

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1236

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1237

# The wrapped key must be a 128/192/256 bit key.

1238

# Authorization requires the following IAM permissions when sending a request

1239

# to perform a crypto transformation using a kms-wrapped crypto key:

1240

# dlp.kms.encrypt

1241

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1242

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1243

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1244

},

1245

},

1246

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

1247

# (FPE) with the FFX mode of operation; however when used in the

1248

# `ReidentifyContent` API method, it serves the opposite function by reversing

1249

# the surrogate back into the original identifier. The identifier must be

1250

# encoded as ASCII. For a given crypto key and context, the same identifier

1251

# will be replaced with the same surrogate. Identifiers must be at least two

1252

# characters long. In the case that the identifier is the empty string, it will

1253

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

1254

# more.

1255

#

1256

# Note: We recommend using CryptoDeterministicConfig for all use cases which

1257

# do not require preserving the input alphabet space and size, plus warrant

1258

# referential integrity.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1259

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

1260

# This annotation will be applied to the surrogate by prefixing it with

1261

# the name of the custom infoType followed by the number of

1262

# characters comprising the surrogate. The following scheme defines the

1263

# format: info_type_name(surrogate_character_count):surrogate

1264

#

1265

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

1266

# the surrogate is 'abc', the full replacement value

1267

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1268

#

1269

# This annotation identifies the surrogate when inspecting content using the

1270

# custom infoType

1271

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

1272

# This facilitates reversal of the surrogate when it occurs in free text.

1273

#

1274

# In order for inspection to work properly, the name of this infoType must

1275

# not occur naturally anywhere in your data; otherwise, inspection may

1276

# find a surrogate that does not correspond to an actual identifier.

1277

# Therefore, choose your custom infoType name carefully after considering

1278

# what your data looks like. One way to select a name that has a high chance

1279

# of yielding reliable detection is to include one or more unicode characters

1280

# that are highly improbable to exist in your data.

1281

# For example, assuming your data is entered from a regular ASCII keyboard,

1282

# the symbol with the hex code point 29DD might be used like so:

1283

# ⧝MY_TOKEN_TYPE

1284

"name": "A String", # Name of the information type. Either a name of your choosing when

1285

# creating a CustomInfoType, or one of the names listed

1286

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1287

# a built-in type. InfoType names should conform to the pattern

1288

# `[a-zA-Z0-9_]{1,64}`.

1289

},

1290

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

1291

# identifier in two different contexts won't be given the same surrogate. If

1292

# the context is not set, a default tweak will be used.

1293

#

1294

# If the context is set but:

1295

#

1296

# 1. there is no record present when transforming a given value or

1297

# 1. the field is not present when transforming a given value,

1298

#

1299

# a default tweak will be used.

1300

#

1301

# Note that case (1) is expected when an `InfoTypeTransformation` is

1302

# applied to both structured and non-structured `ContentItem`s.

1303

# Currently, the referenced field may be of value type integer or string.

1304

#

1305

# The tweak is constructed as a sequence of bytes in big endian byte order

1306

# such that:

1307

#

1308

# - a 64 bit integer is encoded followed by a single byte of value 1

1309

# - a string is encoded in UTF-8 format followed by a single byte of value 2

1310

"name": "A String", # Name describing the field.

1311

},

1312

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

1313

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

1314

# a key encryption key (KEK) stored by KMS).

1315

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1316

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1317

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1318

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1319

# leaking the key. Choose another type of key if possible.

1320

"key": "A String", # Required. A 128/192/256 bit key.

1321

},

1322

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1323

# It will be discarded after the request finishes.

1324

"name": "A String", # Required. Name of the key.

1325

# This is an arbitrary string used to differentiate different keys.

1326

# A unique key is generated per name: two separate `TransientCryptoKey`

1327

# protos share the same generated key if their names are the same.

1328

# When the data crypto key is generated, this name is not used in any way

1329

# (repeating the api call will result in a different key being generated).

1330

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1331

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1332

# The wrapped key must be a 128/192/256 bit key.

1333

# Authorization requires the following IAM permissions when sending a request

1334

# to perform a crypto transformation using a kms-wrapped crypto key:

1335

# dlp.kms.encrypt

1336

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1337

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1338

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1339

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1340

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

1341

# that the FFX mode natively supports. This happens before/after

1342

# encryption/decryption.

1343

# Each character listed must appear only once.

1344

# Number of characters must be in the range [2, 95].

1345

# This must be encoded as ASCII.

1346

# The order of characters does not matter.

1347

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1348

},

1349

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

1350

# input. Outputs a base64 encoded representation of the encrypted output.

1351

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

1352

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

1353

# This annotation will be applied to the surrogate by prefixing it with

1354

# the name of the custom info type followed by the number of

1355

# characters comprising the surrogate. The following scheme defines the

1356

# format: {info type name}({surrogate character count}):{surrogate}

1357

#

1358

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

1359

# the surrogate is 'abc', the full replacement value

1360

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1361

#

1362

# This annotation identifies the surrogate when inspecting content using the

1363

# custom info type 'Surrogate'. This facilitates reversal of the

1364

# surrogate when it occurs in free text.

1365

#

1366

# Note: For record transformations where the entire cell in a table is being

1367

# transformed, surrogates are not mandatory. Surrogates are used to denote

1368

# the location of the token and are necessary for re-identification in free

1369

# form text.

1370

#

1371

# In order for inspection to work properly, the name of this info type must

1372

# not occur naturally anywhere in your data; otherwise, inspection may either

1373

#

1374

# - reverse a surrogate that does not correspond to an actual identifier

1375

# - be unable to parse the surrogate and result in an error

1376

#

1377

# Therefore, choose your custom info type name carefully after considering

1378

# what your data looks like. One way to select a name that has a high chance

1379

# of yielding reliable detection is to include one or more unicode characters

1380

# that are highly improbable to exist in your data.

1381

# For example, assuming your data is entered from a regular ASCII keyboard,

1382

# the symbol with the hex code point 29DD might be used like so:

1383

# ⧝MY_TOKEN_TYPE.

1384

"name": "A String", # Name of the information type. Either a name of your choosing when

1385

# creating a CustomInfoType, or one of the names listed

1386

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1387

# a built-in type. InfoType names should conform to the pattern

1388

# `[a-zA-Z0-9_]{1,64}`.

1389

},

1390

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

1391

# referential integrity such that the same identifier in two different

1392

# contexts will be given a distinct surrogate. The context is appended to

1393

# plaintext value being encrypted. On decryption the provided context is

1394

# validated against the value used during encryption. If a context was

1395

# provided during encryption, same context must be provided during decryption

1396

# as well.

1397

#

1398

# If the context is not set, plaintext would be used as is for encryption.

1399

# If the context is set but:

1400

#

1401

# 1. there is no record present when transforming a given value or

1402

# 2. the field is not present when transforming a given value,

1403

#

1404

# plaintext would be used as is for encryption.

1405

#

1406

# Note that case (1) is expected when an `InfoTypeTransformation` is

1407

# applied to both structured and non-structured `ContentItem`s.

1408

"name": "A String", # Name describing the field.

1409

},

1410

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

1411

# a key encryption key (KEK) stored by KMS).

1412

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1413

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1414

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1415

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1416

# leaking the key. Choose another type of key if possible.

1417

"key": "A String", # Required. A 128/192/256 bit key.

1418

},

1419

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1420

# It will be discarded after the request finishes.

1421

"name": "A String", # Required. Name of the key.

1422

# This is an arbitrary string used to differentiate different keys.

1423

# A unique key is generated per name: two separate `TransientCryptoKey`

1424

# protos share the same generated key if their names are the same.

1425

# When the data crypto key is generated, this name is not used in any way

1426

# (repeating the api call will result in a different key being generated).

1427

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1428

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1429

# The wrapped key must be a 128/192/256 bit key.

1430

# Authorization requires the following IAM permissions when sending a request

1431

# to perform a crypto transformation using a kms-wrapped crypto key:

1432

# dlp.kms.encrypt

1433

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1434

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1435

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1436

},

1437

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1438

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

1439

# replacement values are dynamically provided by the user for custom behavior,

1440

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

1441

# This can be used on

1442

# data of type: number, long, string, timestamp.

1443

# If the bound `Value` type differs from the type of data being transformed, we

1444

# will first attempt converting the type of the data to be transformed to match

1445

# the type of the bound before comparing.

1446

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

1447

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

1448

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1449

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

1450

# the default behavior will be to hyphenate the min-max range.

1451

# Note that for the purposes of inspection or transformation, the number

1452

# of bytes considered to comprise a 'Value' is based on its representation

1453

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1454

# 123456789, the number of bytes would be counted as 9, even though an

1455

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1456

"timestampValue": "A String", # timestamp

1457

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1458

# and time zone are either specified elsewhere or are not significant. The date

1459

# is relative to the Proleptic Gregorian Calendar. This can represent:

1460

#

1461

# * A full date, with non-zero year, month and day values

1462

# * A month and day value, with a zero year, e.g. an anniversary

1463

# * A year on its own, with zero month and day values

1464

# * A year and month value, with a zero day, e.g. a credit card expiration date

1465

#

1466

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1467

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1468

# a year.

1469

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1470

# month and day.

1471

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1472

# if specifying a year by itself or a year and month where the day is not

1473

# significant.

1474

},

1475

"stringValue": "A String", # string

1476

"integerValue": "A String", # integer

1477

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1478

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1479

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1480

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1481

# to allow the value "24:00:00" for scenarios like business closing time.

1482

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1483

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1484

# allow the value 60 if it allows leap-seconds.

1485

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1486

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1487

"booleanValue": True or False, # boolean

1488

"floatValue": 3.14, # float

1489

"dayOfWeekValue": "A String", # day of week

1490

},

1491

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

1492

# used.

1493

# Note that for the purposes of inspection or transformation, the number

1494

# of bytes considered to comprise a 'Value' is based on its representation

1495

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1496

# 123456789, the number of bytes would be counted as 9, even though an

1497

# int64 only holds up to 8 bytes of data.

1498

"timestampValue": "A String", # timestamp

1499

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1500

# and time zone are either specified elsewhere or are not significant. The date

1501

# is relative to the Proleptic Gregorian Calendar. This can represent:

1502

#

1503

# * A full date, with non-zero year, month and day values

1504

# * A month and day value, with a zero year, e.g. an anniversary

1505

# * A year on its own, with zero month and day values

1506

# * A year and month value, with a zero day, e.g. a credit card expiration date

1507

#

1508

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1509

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1510

# a year.

1511

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1512

# month and day.

1513

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1514

# if specifying a year by itself or a year and month where the day is not

1515

# significant.

1516

},

1517

"stringValue": "A String", # string

1518

"integerValue": "A String", # integer

1519

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1520

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1521

# types are google.type.Date and `google.protobuf.Timestamp`.

1522

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1523

# to allow the value "24:00:00" for scenarios like business closing time.

1524

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1525

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1526

# allow the value 60 if it allows leap-seconds.

1527

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1528

},

1529

"booleanValue": True or False, # boolean

1530

"floatValue": 3.14, # float

1531

"dayOfWeekValue": "A String", # day of week

1532

},

1533

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

1534

# Note that for the purposes of inspection or transformation, the number

1535

# of bytes considered to comprise a 'Value' is based on its representation

1536

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1537

# 123456789, the number of bytes would be counted as 9, even though an

1538

# int64 only holds up to 8 bytes of data.

1539

"timestampValue": "A String", # timestamp

1540

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1541

# and time zone are either specified elsewhere or are not significant. The date

1542

# is relative to the Proleptic Gregorian Calendar. This can represent:

1543

#

1544

# * A full date, with non-zero year, month and day values

1545

# * A month and day value, with a zero year, e.g. an anniversary

1546

# * A year on its own, with zero month and day values

1547

# * A year and month value, with a zero day, e.g. a credit card expiration date

1548

#

1549

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1550

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1551

# a year.

1552

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1553

# month and day.

1554

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1555

# if specifying a year by itself or a year and month where the day is not

1556

# significant.

1557

},

1558

"stringValue": "A String", # string

1559

"integerValue": "A String", # integer

1560

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1561

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1562

# types are google.type.Date and `google.protobuf.Timestamp`.

1563

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1564

# to allow the value "24:00:00" for scenarios like business closing time.

1565

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1566

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1567

# allow the value 60 if it allows leap-seconds.

1568

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1569

},

1570

"booleanValue": True or False, # boolean

1571

"floatValue": 3.14, # float

1572

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1577

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

1578

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

1579

# output would be 'My phone number is '.

1580

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1581

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

1582

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

1583

# Note that for the purposes of inspection or transformation, the number

1584

# of bytes considered to comprise a 'Value' is based on its representation

1585

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1586

# 123456789, the number of bytes would be counted as 9, even though an

1587

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1588

"timestampValue": "A String", # timestamp

1589

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1590

# and time zone are either specified elsewhere or are not significant. The date

1591

# is relative to the Proleptic Gregorian Calendar. This can represent:

1592

#

1593

# * A full date, with non-zero year, month and day values

1594

# * A month and day value, with a zero year, e.g. an anniversary

1595

# * A year on its own, with zero month and day values

1596

# * A year and month value, with a zero day, e.g. a credit card expiration date

1597

#

1598

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1599

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1600

# a year.

1601

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1602

# month and day.

1603

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1604

# if specifying a year by itself or a year and month where the day is not

1605

# significant.

1606

},

1607

"stringValue": "A String", # string

1608

"integerValue": "A String", # integer

1609

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1610

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1611

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1612

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1613

# to allow the value "24:00:00" for scenarios like business closing time.

1614

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1615

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1616

# allow the value 60 if it allows leap-seconds.

1617

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1618

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1619

"booleanValue": True or False, # boolean

1620

"floatValue": 3.14, # float

1621

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1622

},

1623

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1624

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

1625

# Bucketing transformation can provide all of this functionality,

1626

# but requires more configuration. This message is provided as a convenience to

1627

# the user for simple bucketing strategies.

1628

#

1629

# The transformed value will be a hyphenated string of

1630

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

1631

# all values that are within this bucket will be replaced with "10-20".

1632

#

1633

# This can be used on data of type: double, long.

1634

#

1635

# If the bound Value type differs from the type of data

1636

# being transformed, we will first attempt converting the type of the data to

1637

# be transformed to match the type of the bound before comparing.

1638

#

1639

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1640

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

1641

# grouped together into a single bucket; for example if `upper_bound` = 89,

1642

# then all values greater than 89 are replaced with the value "89+".

1643

# Note that for the purposes of inspection or transformation, the number

1644

# of bytes considered to comprise a 'Value' is based on its representation

1645

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1646

# 123456789, the number of bytes would be counted as 9, even though an

1647

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1648

"timestampValue": "A String", # timestamp

1649

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1650

# and time zone are either specified elsewhere or are not significant. The date

1651

# is relative to the Proleptic Gregorian Calendar. This can represent:

1652

#

1653

# * A full date, with non-zero year, month and day values

1654

# * A month and day value, with a zero year, e.g. an anniversary

1655

# * A year on its own, with zero month and day values

1656

# * A year and month value, with a zero day, e.g. a credit card expiration date

1657

#

1658

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1659

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1660

# a year.

1661

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1662

# month and day.

1663

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1664

# if specifying a year by itself or a year and month where the day is not

1665

# significant.

1666

},

1667

"stringValue": "A String", # string

1668

"integerValue": "A String", # integer

1669

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1670

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1671

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1672

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1673

# to allow the value "24:00:00" for scenarios like business closing time.

1674

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1675

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1676

# allow the value 60 if it allows leap-seconds.

1677

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1678

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1679

"booleanValue": True or False, # boolean

1680

"floatValue": 3.14, # float

1681

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1682

},

1683

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

1684

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

1685

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

1686

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1687

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

1688

# grouped together into a single bucket; for example if `lower_bound` = 10,

1689

# then all values less than 10 are replaced with the value "-10".

1690

# Note that for the purposes of inspection or transformation, the number

1691

# of bytes considered to comprise a 'Value' is based on its representation

1692

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1693

# 123456789, the number of bytes would be counted as 9, even though an

1694

# int64 only holds up to 8 bytes of data.

1695

"timestampValue": "A String", # timestamp

1696

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1697

# and time zone are either specified elsewhere or are not significant. The date

1698

# is relative to the Proleptic Gregorian Calendar. This can represent:

1699

#

1700

# * A full date, with non-zero year, month and day values

1701

# * A month and day value, with a zero year, e.g. an anniversary

1702

# * A year on its own, with zero month and day values

1703

# * A year and month value, with a zero day, e.g. a credit card expiration date

1704

#

1705

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1706

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1707

# a year.

1708

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1709

# month and day.

1710

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1711

# if specifying a year by itself or a year and month where the day is not

1712

# significant.

1713

},

1714

"stringValue": "A String", # string

1715

"integerValue": "A String", # integer

1716

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1717

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1718

# types are google.type.Date and `google.protobuf.Timestamp`.

1719

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1720

# to allow the value "24:00:00" for scenarios like business closing time.

1721

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1722

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1723

# allow the value 60 if it allows leap-seconds.

1724

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1725

},

1726

"booleanValue": True or False, # boolean

1727

"floatValue": 3.14, # float

1728

"dayOfWeekValue": "A String", # day of week

1729

},

1730

},

1731

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

1732

# fixed character. Masking can start from the beginning or end of the string.

1733

# This can be used on data of any type (numbers, longs, and so on) and when

1734

# de-identifying structured data we'll attempt to preserve the original data's

1735

# type. (This allows you to take a long like 123 and modify it to a string like

1736

# **3.

1737

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

1738

# characters. For example, if the input string is `555-555-5555` and you

1739

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

1740

# returns `***-**5-5555`.

1741

{ # Characters to skip when doing deidentification of a value. These will be left

1742

# alone and skipped.

1743

"charactersToSkip": "A String", # Characters to not transform when masking.

1744

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

1749

# masked. Skipped characters do not count towards this tally.

1750

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

1751

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

1752

# code or credit card number. This string must have a length of 1. If not

1753

# supplied, this value defaults to `*` for strings, and `0` for digits.

1754

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

1755

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

1756

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

1757

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

1758

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1759

},

1760

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1761

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

1762

# this transformation to apply to all findings that correspond to

1763

# infoTypes that were requested in `InspectConfig`.

1764

{ # Type of information detected by the API.

1765

"name": "A String", # Name of the information type. Either a name of your choosing when

1766

# creating a CustomInfoType, or one of the names listed

1767

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1768

# a built-in type. InfoType names should conform to the pattern

1769

# `[a-zA-Z0-9_]{1,64}`.

1770

},

1771

],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

1776

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

1777

# portion of the value.

1778

"partToExtract": "A String", # The part of the time to keep.

1779

},

1780

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

1781

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

1782

# to learn more.

1783

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

1784

# If set, must also set cryptoKey. If set, shift will be consistent for the

1785

# given context.

1786

"name": "A String", # Name describing the field.

1787

},

1788

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

1789

# range (inclusive ends). Negative means shift to earlier in time. Must not

1790

# be more than 365250 days (1000 years) each direction.

1791

#

1792

# For example, 3 means shift date to at most 3 days into the future.

1793

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1794

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

1795

# results in the same shift for the same context and crypto_key. If

1796

# set, must also set context. Can only be applied to table items.

1797

# a key encryption key (KEK) stored by KMS).

1798

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1799

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1800

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1801

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1802

# leaking the key. Choose another type of key if possible.

1803

"key": "A String", # Required. A 128/192/256 bit key.

1804

},

1805

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1806

# It will be discarded after the request finishes.

1807

"name": "A String", # Required. Name of the key.

1808

# This is an arbitrary string used to differentiate different keys.

1809

# A unique key is generated per name: two separate `TransientCryptoKey`

1810

# protos share the same generated key if their names are the same.

1811

# When the data crypto key is generated, this name is not used in any way

1812

# (repeating the api call will result in a different key being generated).

1813

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1814

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1815

# The wrapped key must be a 128/192/256 bit key.

1816

# Authorization requires the following IAM permissions when sending a request

1817

# to perform a crypto transformation using a kms-wrapped crypto key:

1818

# dlp.kms.encrypt

1819

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1820

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1821

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1822

},

1823

},

1824

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1825

},

1826

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

1827

# Uses SHA-256.

1828

# The key size must be either 32 or 64 bytes.

1829

# Outputs a base64 encoded representation of the hashed output

1830

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

1831

# Currently, only string and integer values can be hashed.

1832

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

1833

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

1834

# a key encryption key (KEK) stored by KMS).

1835

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1836

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1837

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1838

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1839

# leaking the key. Choose another type of key if possible.

1840

"key": "A String", # Required. A 128/192/256 bit key.

1841

},

1842

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1843

# It will be discarded after the request finishes.

1844

"name": "A String", # Required. Name of the key.

1845

# This is an arbitrary string used to differentiate different keys.

1846

# A unique key is generated per name: two separate `TransientCryptoKey`

1847

# protos share the same generated key if their names are the same.

1848

# When the data crypto key is generated, this name is not used in any way

1849

# (repeating the api call will result in a different key being generated).

1850

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1851

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1852

# The wrapped key must be a 128/192/256 bit key.

1853

# Authorization requires the following IAM permissions when sending a request

1854

# to perform a crypto transformation using a kms-wrapped crypto key:

1855

# dlp.kms.encrypt

1856

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1857

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1858

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1859

},

1860

},

1861

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

1862

# (FPE) with the FFX mode of operation; however when used in the

1863

# `ReidentifyContent` API method, it serves the opposite function by reversing

1864

# the surrogate back into the original identifier. The identifier must be

1865

# encoded as ASCII. For a given crypto key and context, the same identifier

1866

# will be replaced with the same surrogate. Identifiers must be at least two

1867

# characters long. In the case that the identifier is the empty string, it will

1868

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

1869

# more.

1870

#

1871

# Note: We recommend using CryptoDeterministicConfig for all use cases which

1872

# do not require preserving the input alphabet space and size, plus warrant

1873

# referential integrity.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1874

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

1875

# This annotation will be applied to the surrogate by prefixing it with

1876

# the name of the custom infoType followed by the number of

1877

# characters comprising the surrogate. The following scheme defines the

1878

# format: info_type_name(surrogate_character_count):surrogate

1879

#

1880

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

1881

# the surrogate is 'abc', the full replacement value

1882

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1883

#

1884

# This annotation identifies the surrogate when inspecting content using the

1885

# custom infoType

1886

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

1887

# This facilitates reversal of the surrogate when it occurs in free text.

1888

#

1889

# In order for inspection to work properly, the name of this infoType must

1890

# not occur naturally anywhere in your data; otherwise, inspection may

1891

# find a surrogate that does not correspond to an actual identifier.

1892

# Therefore, choose your custom infoType name carefully after considering

1893

# what your data looks like. One way to select a name that has a high chance

1894

# of yielding reliable detection is to include one or more unicode characters

1895

# that are highly improbable to exist in your data.

1896

# For example, assuming your data is entered from a regular ASCII keyboard,

1897

# the symbol with the hex code point 29DD might be used like so:

1898

# ⧝MY_TOKEN_TYPE

1899

"name": "A String", # Name of the information type. Either a name of your choosing when

1900

# creating a CustomInfoType, or one of the names listed

1901

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1902

# a built-in type. InfoType names should conform to the pattern

1903

# `[a-zA-Z0-9_]{1,64}`.

1904

},

1905

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

1906

# identifier in two different contexts won't be given the same surrogate. If

1907

# the context is not set, a default tweak will be used.

1908

#

1909

# If the context is set but:

1910

#

1911

# 1. there is no record present when transforming a given value or

1912

# 1. the field is not present when transforming a given value,

1913

#

1914

# a default tweak will be used.

1915

#

1916

# Note that case (1) is expected when an `InfoTypeTransformation` is

1917

# applied to both structured and non-structured `ContentItem`s.

1918

# Currently, the referenced field may be of value type integer or string.

1919

#

1920

# The tweak is constructed as a sequence of bytes in big endian byte order

1921

# such that:

1922

#

1923

# - a 64 bit integer is encoded followed by a single byte of value 1

1924

# - a string is encoded in UTF-8 format followed by a single byte of value 2

1925

"name": "A String", # Name describing the field.

1926

},

1927

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

1928

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

1929

# a key encryption key (KEK) stored by KMS).

1930

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1931

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1932

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1933

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1934

# leaking the key. Choose another type of key if possible.

1935

"key": "A String", # Required. A 128/192/256 bit key.

1936

},

1937

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1938

# It will be discarded after the request finishes.

1939

"name": "A String", # Required. Name of the key.

1940

# This is an arbitrary string used to differentiate different keys.

1941

# A unique key is generated per name: two separate `TransientCryptoKey`

1942

# protos share the same generated key if their names are the same.

1943

# When the data crypto key is generated, this name is not used in any way

1944

# (repeating the api call will result in a different key being generated).

1945

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1946

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1947

# The wrapped key must be a 128/192/256 bit key.

1948

# Authorization requires the following IAM permissions when sending a request

1949

# to perform a crypto transformation using a kms-wrapped crypto key:

1950

# dlp.kms.encrypt

1951

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1952

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1953

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1954

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

1955

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

1956

# that the FFX mode natively supports. This happens before/after

1957

# encryption/decryption.

1958

# Each character listed must appear only once.

1959

# Number of characters must be in the range [2, 95].

1960

# This must be encoded as ASCII.

1961

# The order of characters does not matter.

1962

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

1963

},

1964

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

1965

# input. Outputs a base64 encoded representation of the encrypted output.

1966

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

1967

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

1968

# This annotation will be applied to the surrogate by prefixing it with

1969

# the name of the custom info type followed by the number of

1970

# characters comprising the surrogate. The following scheme defines the

1971

# format: {info type name}({surrogate character count}):{surrogate}

1972

#

1973

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

1974

# the surrogate is 'abc', the full replacement value

1975

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1976

#

1977

# This annotation identifies the surrogate when inspecting content using the

1978

# custom info type 'Surrogate'. This facilitates reversal of the

1979

# surrogate when it occurs in free text.

1980

#

1981

# Note: For record transformations where the entire cell in a table is being

1982

# transformed, surrogates are not mandatory. Surrogates are used to denote

1983

# the location of the token and are necessary for re-identification in free

1984

# form text.

1985

#

1986

# In order for inspection to work properly, the name of this info type must

1987

# not occur naturally anywhere in your data; otherwise, inspection may either

1988

#

1989

# - reverse a surrogate that does not correspond to an actual identifier

1990

# - be unable to parse the surrogate and result in an error

1991

#

1992

# Therefore, choose your custom info type name carefully after considering

1993

# what your data looks like. One way to select a name that has a high chance

1994

# of yielding reliable detection is to include one or more unicode characters

1995

# that are highly improbable to exist in your data.

1996

# For example, assuming your data is entered from a regular ASCII keyboard,

1997

# the symbol with the hex code point 29DD might be used like so:

1998

# ⧝MY_TOKEN_TYPE.

1999

"name": "A String", # Name of the information type. Either a name of your choosing when

2000

# creating a CustomInfoType, or one of the names listed

2001

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2002

# a built-in type. InfoType names should conform to the pattern

2003

# `[a-zA-Z0-9_]{1,64}`.

2004

},

2005

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

2006

# referential integrity such that the same identifier in two different

2007

# contexts will be given a distinct surrogate. The context is appended to

2008

# plaintext value being encrypted. On decryption the provided context is

2009

# validated against the value used during encryption. If a context was

2010

# provided during encryption, same context must be provided during decryption

2011

# as well.

2012

#

2013

# If the context is not set, plaintext would be used as is for encryption.

2014

# If the context is set but:

2015

#

2016

# 1. there is no record present when transforming a given value or

2017

# 2. the field is not present when transforming a given value,

2018

#

2019

# plaintext would be used as is for encryption.

2020

#

2021

# Note that case (1) is expected when an `InfoTypeTransformation` is

2022

# applied to both structured and non-structured `ContentItem`s.

2023

"name": "A String", # Name describing the field.

2024

},

2025

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

2026

# a key encryption key (KEK) stored by KMS).

2027

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2028

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2029

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2030

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2031

# leaking the key. Choose another type of key if possible.

2032

"key": "A String", # Required. A 128/192/256 bit key.

2033

},

2034

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2035

# It will be discarded after the request finishes.

2036

"name": "A String", # Required. Name of the key.

2037

# This is an arbitrary string used to differentiate different keys.

2038

# A unique key is generated per name: two separate `TransientCryptoKey`

2039

# protos share the same generated key if their names are the same.

2040

# When the data crypto key is generated, this name is not used in any way

2041

# (repeating the api call will result in a different key being generated).

2042

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2043

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2044

# The wrapped key must be a 128/192/256 bit key.

2045

# Authorization requires the following IAM permissions when sending a request

2046

# to perform a crypto transformation using a kms-wrapped crypto key:

2047

# dlp.kms.encrypt

2048

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2049

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2050

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2051

},

2052

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2053

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

2054

# replacement values are dynamically provided by the user for custom behavior,

2055

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

2056

# This can be used on

2057

# data of type: number, long, string, timestamp.

2058

# If the bound `Value` type differs from the type of data being transformed, we

2059

# will first attempt converting the type of the data to be transformed to match

2060

# the type of the bound before comparing.

2061

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

2062

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

2063

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2064

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

2065

# the default behavior will be to hyphenate the min-max range.

2066

# Note that for the purposes of inspection or transformation, the number

2067

# of bytes considered to comprise a 'Value' is based on its representation

2068

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2069

# 123456789, the number of bytes would be counted as 9, even though an

2070

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2071

"timestampValue": "A String", # timestamp

2072

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2073

# and time zone are either specified elsewhere or are not significant. The date

2074

# is relative to the Proleptic Gregorian Calendar. This can represent:

2075

#

2076

# * A full date, with non-zero year, month and day values

2077

# * A month and day value, with a zero year, e.g. an anniversary

2078

# * A year on its own, with zero month and day values

2079

# * A year and month value, with a zero day, e.g. a credit card expiration date

2080

#

2081

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2082

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2083

# a year.

2084

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2085

# month and day.

2086

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2087

# if specifying a year by itself or a year and month where the day is not

2088

# significant.

2089

},

2090

"stringValue": "A String", # string

2091

"integerValue": "A String", # integer

2092

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2093

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2094

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2095

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2096

# to allow the value "24:00:00" for scenarios like business closing time.

2097

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2098

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2099

# allow the value 60 if it allows leap-seconds.

2100

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2101

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2102

"booleanValue": True or False, # boolean

2103

"floatValue": 3.14, # float

2104

"dayOfWeekValue": "A String", # day of week

2105

},

2106

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

2107

# used.

2108

# Note that for the purposes of inspection or transformation, the number

2109

# of bytes considered to comprise a 'Value' is based on its representation

2110

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2111

# 123456789, the number of bytes would be counted as 9, even though an

2112

# int64 only holds up to 8 bytes of data.

2113

"timestampValue": "A String", # timestamp

2114

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2115

# and time zone are either specified elsewhere or are not significant. The date

2116

# is relative to the Proleptic Gregorian Calendar. This can represent:

2117

#

2118

# * A full date, with non-zero year, month and day values

2119

# * A month and day value, with a zero year, e.g. an anniversary

2120

# * A year on its own, with zero month and day values

2121

# * A year and month value, with a zero day, e.g. a credit card expiration date

2122

#

2123

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2124

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2125

# a year.

2126

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2127

# month and day.

2128

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2129

# if specifying a year by itself or a year and month where the day is not

2130

# significant.

2131

},

2132

"stringValue": "A String", # string

2133

"integerValue": "A String", # integer

2134

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2135

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2136

# types are google.type.Date and `google.protobuf.Timestamp`.

2137

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2138

# to allow the value "24:00:00" for scenarios like business closing time.

2139

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2140

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2141

# allow the value 60 if it allows leap-seconds.

2142

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2143

},

2144

"booleanValue": True or False, # boolean

2145

"floatValue": 3.14, # float

2146

"dayOfWeekValue": "A String", # day of week

2147

},

2148

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

2149

# Note that for the purposes of inspection or transformation, the number

2150

# of bytes considered to comprise a 'Value' is based on its representation

2151

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2152

# 123456789, the number of bytes would be counted as 9, even though an

2153

# int64 only holds up to 8 bytes of data.

2154

"timestampValue": "A String", # timestamp

2155

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2156

# and time zone are either specified elsewhere or are not significant. The date

2157

# is relative to the Proleptic Gregorian Calendar. This can represent:

2158

#

2159

# * A full date, with non-zero year, month and day values

2160

# * A month and day value, with a zero year, e.g. an anniversary

2161

# * A year on its own, with zero month and day values

2162

# * A year and month value, with a zero day, e.g. a credit card expiration date

2163

#

2164

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2165

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2166

# a year.

2167

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2168

# month and day.

2169

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2170

# if specifying a year by itself or a year and month where the day is not

2171

# significant.

2172

},

2173

"stringValue": "A String", # string

2174

"integerValue": "A String", # integer

2175

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2176

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2177

# types are google.type.Date and `google.protobuf.Timestamp`.

2178

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2179

# to allow the value "24:00:00" for scenarios like business closing time.

2180

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2181

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2182

# allow the value 60 if it allows leap-seconds.

2183

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2184

},

2185

"booleanValue": True or False, # boolean

2186

"floatValue": 3.14, # float

2187

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2192

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

2193

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

2194

# output would be 'My phone number is '.

2195

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2196

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

2197

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

2198

# Note that for the purposes of inspection or transformation, the number

2199

# of bytes considered to comprise a 'Value' is based on its representation

2200

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2201

# 123456789, the number of bytes would be counted as 9, even though an

2202

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2203

"timestampValue": "A String", # timestamp

2204

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2205

# and time zone are either specified elsewhere or are not significant. The date

2206

# is relative to the Proleptic Gregorian Calendar. This can represent:

2207

#

2208

# * A full date, with non-zero year, month and day values

2209

# * A month and day value, with a zero year, e.g. an anniversary

2210

# * A year on its own, with zero month and day values

2211

# * A year and month value, with a zero day, e.g. a credit card expiration date

2212

#

2213

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2214

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2215

# a year.

2216

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2217

# month and day.

2218

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2219

# if specifying a year by itself or a year and month where the day is not

2220

# significant.

2221

},

2222

"stringValue": "A String", # string

2223

"integerValue": "A String", # integer

2224

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2225

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2226

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2227

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2228

# to allow the value "24:00:00" for scenarios like business closing time.

2229

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2230

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2231

# allow the value 60 if it allows leap-seconds.

2232

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2233

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2234

"booleanValue": True or False, # boolean

2235

"floatValue": 3.14, # float

2236

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2237

},

2238

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2239

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

2240

# Bucketing transformation can provide all of this functionality,

2241

# but requires more configuration. This message is provided as a convenience to

2242

# the user for simple bucketing strategies.

2243

#

2244

# The transformed value will be a hyphenated string of

2245

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

2246

# all values that are within this bucket will be replaced with "10-20".

2247

#

2248

# This can be used on data of type: double, long.

2249

#

2250

# If the bound Value type differs from the type of data

2251

# being transformed, we will first attempt converting the type of the data to

2252

# be transformed to match the type of the bound before comparing.

2253

#

2254

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2255

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

2256

# grouped together into a single bucket; for example if `upper_bound` = 89,

2257

# then all values greater than 89 are replaced with the value "89+".

2258

# Note that for the purposes of inspection or transformation, the number

2259

# of bytes considered to comprise a 'Value' is based on its representation

2260

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2261

# 123456789, the number of bytes would be counted as 9, even though an

2262

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2263

"timestampValue": "A String", # timestamp

2264

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2265

# and time zone are either specified elsewhere or are not significant. The date

2266

# is relative to the Proleptic Gregorian Calendar. This can represent:

2267

#

2268

# * A full date, with non-zero year, month and day values

2269

# * A month and day value, with a zero year, e.g. an anniversary

2270

# * A year on its own, with zero month and day values

2271

# * A year and month value, with a zero day, e.g. a credit card expiration date

2272

#

2273

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2274

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2275

# a year.

2276

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2277

# month and day.

2278

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2279

# if specifying a year by itself or a year and month where the day is not

2280

# significant.

2281

},

2282

"stringValue": "A String", # string

2283

"integerValue": "A String", # integer

2284

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2285

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2286

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2287

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2288

# to allow the value "24:00:00" for scenarios like business closing time.

2289

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2290

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2291

# allow the value 60 if it allows leap-seconds.

2292

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2293

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2294

"booleanValue": True or False, # boolean

2295

"floatValue": 3.14, # float

2296

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2297

},

2298

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

2299

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

2300

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

2301

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2302

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

2303

# grouped together into a single bucket; for example if `lower_bound` = 10,

2304

# then all values less than 10 are replaced with the value "-10".

2305

# Note that for the purposes of inspection or transformation, the number

2306

# of bytes considered to comprise a 'Value' is based on its representation

2307

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2308

# 123456789, the number of bytes would be counted as 9, even though an

2309

# int64 only holds up to 8 bytes of data.

2310

"timestampValue": "A String", # timestamp

2311

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2312

# and time zone are either specified elsewhere or are not significant. The date

2313

# is relative to the Proleptic Gregorian Calendar. This can represent:

2314

#

2315

# * A full date, with non-zero year, month and day values

2316

# * A month and day value, with a zero year, e.g. an anniversary

2317

# * A year on its own, with zero month and day values

2318

# * A year and month value, with a zero day, e.g. a credit card expiration date

2319

#

2320

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2321

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2322

# a year.

2323

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2324

# month and day.

2325

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2326

# if specifying a year by itself or a year and month where the day is not

2327

# significant.

2328

},

2329

"stringValue": "A String", # string

2330

"integerValue": "A String", # integer

2331

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2332

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2333

# types are google.type.Date and `google.protobuf.Timestamp`.

2334

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2335

# to allow the value "24:00:00" for scenarios like business closing time.

2336

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2337

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2338

# allow the value 60 if it allows leap-seconds.

2339

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2340

},

2341

"booleanValue": True or False, # boolean

2342

"floatValue": 3.14, # float

2343

"dayOfWeekValue": "A String", # day of week

2344

},

2345

},

2346

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

2347

# fixed character. Masking can start from the beginning or end of the string.

2348

# This can be used on data of any type (numbers, longs, and so on) and when

2349

# de-identifying structured data we'll attempt to preserve the original data's

2350

# type. (This allows you to take a long like 123 and modify it to a string like

2351

# **3.

2352

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

2353

# characters. For example, if the input string is `555-555-5555` and you

2354

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

2355

# returns `***-**5-5555`.

2356

{ # Characters to skip when doing deidentification of a value. These will be left

2357

# alone and skipped.

2358

"charactersToSkip": "A String", # Characters to not transform when masking.

2359

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

2364

# masked. Skipped characters do not count towards this tally.

2365

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

2366

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

2367

# code or credit card number. This string must have a length of 1. If not

2368

# supplied, this value defaults to `*` for strings, and `0` for digits.

2369

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

2370

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

2371

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

2372

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

2373

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2374

},

2375

},

2376

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

2377

# given `RecordCondition`. The conditions are allowed to reference fields

2378

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

2383

# column for the same record is within a specific range.

2384

# - Redact a field if the date of birth field is greater than 85.

2385

# a field.

2386

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

2387

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

2388

# only supported value is `AND`.

2389

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

2390

"conditions": [ # A collection of conditions.

2391

{ # The field type of `value` and `field` do not need to match to be

2392

# considered equal, but not all comparisons are possible.

2393

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

2394

# but all other comparisons are invalid with incompatible types.

2395

# A `value` of type:

2396

#

2397

# - `string` can be compared against all other types

2398

# - `boolean` can only be compared against other booleans

2399

# - `integer` can be compared against doubles or a string if the string value

2400

# can be parsed as an integer.

2401

# - `double` can be compared against integers or a string if the string can

2402

# be parsed as a double.

2403

# - `Timestamp` can be compared against strings in RFC 3339 date string

2404

# format.

2405

# - `TimeOfDay` can be compared against timestamps and strings in the format

2406

# of 'HH:mm:ss'.

2407

#

2408

# If we fail to compare do to type mismatch, a warning will be given and

2409

# the condition will evaluate to false.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2410

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

2411

# Note that for the purposes of inspection or transformation, the number

2412

# of bytes considered to comprise a 'Value' is based on its representation

2413

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2414

# 123456789, the number of bytes would be counted as 9, even though an

2415

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2416

"timestampValue": "A String", # timestamp

2417

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2418

# and time zone are either specified elsewhere or are not significant. The date

2419

# is relative to the Proleptic Gregorian Calendar. This can represent:

2420

#

2421

# * A full date, with non-zero year, month and day values

2422

# * A month and day value, with a zero year, e.g. an anniversary

2423

# * A year on its own, with zero month and day values

2424

# * A year and month value, with a zero day, e.g. a credit card expiration date

2425

#

2426

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2427

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2428

# a year.

2429

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2430

# month and day.

2431

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2432

# if specifying a year by itself or a year and month where the day is not

2433

# significant.

2434

},

2435

"stringValue": "A String", # string

2436

"integerValue": "A String", # integer

2437

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2438

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2439

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2440

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2441

# to allow the value "24:00:00" for scenarios like business closing time.

2442

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2443

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2444

# allow the value 60 if it allows leap-seconds.

2445

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2446

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2447

"booleanValue": True or False, # boolean

2448

"floatValue": 3.14, # float

2449

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2450

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2451

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

2452

"name": "A String", # Name describing the field.

2453

},

2454

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

},

},

],

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2462

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that

2463

# match any suppression rule are omitted from the output.

2464

{ # Configuration to suppress records whose suppression conditions evaluate to

2465

# true.

2466

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

2467

# evaluated to be suppressed from the transformed content.

2468

# a field.

2469

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

2470

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

2471

# only supported value is `AND`.

2472

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

2473

"conditions": [ # A collection of conditions.

2474

{ # The field type of `value` and `field` do not need to match to be

2475

# considered equal, but not all comparisons are possible.

2476

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

2477

# but all other comparisons are invalid with incompatible types.

2478

# A `value` of type:

2479

#

2480

# - `string` can be compared against all other types

2481

# - `boolean` can only be compared against other booleans

2482

# - `integer` can be compared against doubles or a string if the string value

2483

# can be parsed as an integer.

2484

# - `double` can be compared against integers or a string if the string can

2485

# be parsed as a double.

2486

# - `Timestamp` can be compared against strings in RFC 3339 date string

2487

# format.

2488

# - `TimeOfDay` can be compared against timestamps and strings in the format

2489

# of 'HH:mm:ss'.

2490

#

2491

# If we fail to compare do to type mismatch, a warning will be given and

2492

# the condition will evaluate to false.

2493

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

2494

# Note that for the purposes of inspection or transformation, the number

2495

# of bytes considered to comprise a 'Value' is based on its representation

2496

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2497

# 123456789, the number of bytes would be counted as 9, even though an

2498

# int64 only holds up to 8 bytes of data.

2499

"timestampValue": "A String", # timestamp

2500

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2501

# and time zone are either specified elsewhere or are not significant. The date

2502

# is relative to the Proleptic Gregorian Calendar. This can represent:

2503

#

2504

# * A full date, with non-zero year, month and day values

2505

# * A month and day value, with a zero year, e.g. an anniversary

2506

# * A year on its own, with zero month and day values

2507

# * A year and month value, with a zero day, e.g. a credit card expiration date

2508

#

2509

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2510

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2511

# a year.

2512

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2513

# month and day.

2514

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2515

# if specifying a year by itself or a year and month where the day is not

2516

# significant.

2517

},

2518

"stringValue": "A String", # string

2519

"integerValue": "A String", # integer

2520

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2521

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2522

# types are google.type.Date and `google.protobuf.Timestamp`.

2523

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2524

# to allow the value "24:00:00" for scenarios like business closing time.

2525

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2526

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2527

# allow the value 60 if it allows leap-seconds.

2528

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2529

},

2530

"booleanValue": True or False, # boolean

2531

"floatValue": 3.14, # float

2532

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2533

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2534

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

2535

"name": "A String", # Name describing the field.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2536

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2537

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2538

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2539

],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2540

},

2541

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

},

"locationId": "A String", # The geographic location to process de-identification. Reserved for future

# extensions.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2558

2559

{ # Results of de-identifying a ContentItem.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2560

"overview": { # Overview of the modifications that occurred. # An overview of the changes that were made on the `item`.

2561

"transformationSummaries": [ # Transformations applied to the dataset.

2562

{ # Summary of a single transformation.

2563

# Only one of 'transformation', 'field_transformation', or 'record_suppress'

2564

# will be set.

2565

"fieldTransformations": [ # The field transformation that was applied.

2566

# If multiple field transformations are requested for a single field,

2567

# this list will contain all of them; otherwise, only one is supplied.

2568

{ # The transformation to apply to the field.

2569

"fields": [ # Required. Input field(s) to apply the transformation to.

2570

{ # General identifier of a data field in a storage service.

2571

"name": "A String", # Name describing the field.

2572

},

2573

],

2574

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

2575

# transform content that matches an `InfoType`.

2576

# apply various `PrimitiveTransformation`s to each finding, where the

2577

# transformation is applied to only values that were identified as a specific

2578

# info_type.

2579

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

2580

# for a given infoType.

2581

{ # A transformation to apply to text that is identified as a specific

2582

# info_type.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2583

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

2584

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

2585

# portion of the value.

2586

"partToExtract": "A String", # The part of the time to keep.

2587

},

2588

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

2589

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

2590

# to learn more.

2591

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

2592

# If set, must also set cryptoKey. If set, shift will be consistent for the

2593

# given context.

2594

"name": "A String", # Name describing the field.

2595

},

2596

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

2597

# range (inclusive ends). Negative means shift to earlier in time. Must not

2598

# be more than 365250 days (1000 years) each direction.

2599

#

2600

# For example, 3 means shift date to at most 3 days into the future.

2601

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

2602

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

2603

# results in the same shift for the same context and crypto_key. If

2604

# set, must also set context. Can only be applied to table items.

2605

# a key encryption key (KEK) stored by KMS).

2606

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2607

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2608

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2609

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2610

# leaking the key. Choose another type of key if possible.

2611

"key": "A String", # Required. A 128/192/256 bit key.

2612

},

2613

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2614

# It will be discarded after the request finishes.

2615

"name": "A String", # Required. Name of the key.

2616

# This is an arbitrary string used to differentiate different keys.

2617

# A unique key is generated per name: two separate `TransientCryptoKey`

2618

# protos share the same generated key if their names are the same.

2619

# When the data crypto key is generated, this name is not used in any way

2620

# (repeating the api call will result in a different key being generated).

2621

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2622

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2623

# The wrapped key must be a 128/192/256 bit key.

2624

# Authorization requires the following IAM permissions when sending a request

2625

# to perform a crypto transformation using a kms-wrapped crypto key:

2626

# dlp.kms.encrypt

2627

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2628

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2629

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2630

},

2631

},

2632

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

2633

},

2634

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

2635

# Uses SHA-256.

2636

# The key size must be either 32 or 64 bytes.

2637

# Outputs a base64 encoded representation of the hashed output

2638

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

2639

# Currently, only string and integer values can be hashed.

2640

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

2641

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

2642

# a key encryption key (KEK) stored by KMS).

2643

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2644

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2645

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2646

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2647

# leaking the key. Choose another type of key if possible.

2648

"key": "A String", # Required. A 128/192/256 bit key.

2649

},

2650

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2651

# It will be discarded after the request finishes.

2652

"name": "A String", # Required. Name of the key.

2653

# This is an arbitrary string used to differentiate different keys.

2654

# A unique key is generated per name: two separate `TransientCryptoKey`

2655

# protos share the same generated key if their names are the same.

2656

# When the data crypto key is generated, this name is not used in any way

2657

# (repeating the api call will result in a different key being generated).

2658

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2659

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2660

# The wrapped key must be a 128/192/256 bit key.

2661

# Authorization requires the following IAM permissions when sending a request

2662

# to perform a crypto transformation using a kms-wrapped crypto key:

2663

# dlp.kms.encrypt

2664

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2665

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2666

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2667

},

2668

},

2669

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

2670

# (FPE) with the FFX mode of operation; however when used in the

2671

# `ReidentifyContent` API method, it serves the opposite function by reversing

2672

# the surrogate back into the original identifier. The identifier must be

2673

# encoded as ASCII. For a given crypto key and context, the same identifier

2674

# will be replaced with the same surrogate. Identifiers must be at least two

2675

# characters long. In the case that the identifier is the empty string, it will

2676

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

2677

# more.

2678

#

2679

# Note: We recommend using CryptoDeterministicConfig for all use cases which

2680

# do not require preserving the input alphabet space and size, plus warrant

2681

# referential integrity.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2682

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

2683

# This annotation will be applied to the surrogate by prefixing it with

2684

# the name of the custom infoType followed by the number of

2685

# characters comprising the surrogate. The following scheme defines the

2686

# format: info_type_name(surrogate_character_count):surrogate

2687

#

2688

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

2689

# the surrogate is 'abc', the full replacement value

2690

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

2691

#

2692

# This annotation identifies the surrogate when inspecting content using the

2693

# custom infoType

2694

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

2695

# This facilitates reversal of the surrogate when it occurs in free text.

2696

#

2697

# In order for inspection to work properly, the name of this infoType must

2698

# not occur naturally anywhere in your data; otherwise, inspection may

2699

# find a surrogate that does not correspond to an actual identifier.

2700

# Therefore, choose your custom infoType name carefully after considering

2701

# what your data looks like. One way to select a name that has a high chance

2702

# of yielding reliable detection is to include one or more unicode characters

2703

# that are highly improbable to exist in your data.

2704

# For example, assuming your data is entered from a regular ASCII keyboard,

2705

# the symbol with the hex code point 29DD might be used like so:

2706

# ⧝MY_TOKEN_TYPE

2707

"name": "A String", # Name of the information type. Either a name of your choosing when

2708

# creating a CustomInfoType, or one of the names listed

2709

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2710

# a built-in type. InfoType names should conform to the pattern

2711

# `[a-zA-Z0-9_]{1,64}`.

2712

},

2713

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

2714

# identifier in two different contexts won't be given the same surrogate. If

2715

# the context is not set, a default tweak will be used.

2716

#

2717

# If the context is set but:

2718

#

2719

# 1. there is no record present when transforming a given value or

2720

# 1. the field is not present when transforming a given value,

2721

#

2722

# a default tweak will be used.

2723

#

2724

# Note that case (1) is expected when an `InfoTypeTransformation` is

2725

# applied to both structured and non-structured `ContentItem`s.

2726

# Currently, the referenced field may be of value type integer or string.

2727

#

2728

# The tweak is constructed as a sequence of bytes in big endian byte order

2729

# such that:

2730

#

2731

# - a 64 bit integer is encoded followed by a single byte of value 1

2732

# - a string is encoded in UTF-8 format followed by a single byte of value 2

2733

"name": "A String", # Name describing the field.

2734

},

2735

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

2736

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

2737

# a key encryption key (KEK) stored by KMS).

2738

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2739

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2740

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2741

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2742

# leaking the key. Choose another type of key if possible.

2743

"key": "A String", # Required. A 128/192/256 bit key.

2744

},

2745

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2746

# It will be discarded after the request finishes.

2747

"name": "A String", # Required. Name of the key.

2748

# This is an arbitrary string used to differentiate different keys.

2749

# A unique key is generated per name: two separate `TransientCryptoKey`

2750

# protos share the same generated key if their names are the same.

2751

# When the data crypto key is generated, this name is not used in any way

2752

# (repeating the api call will result in a different key being generated).

2753

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2754

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2755

# The wrapped key must be a 128/192/256 bit key.

2756

# Authorization requires the following IAM permissions when sending a request

2757

# to perform a crypto transformation using a kms-wrapped crypto key:

2758

# dlp.kms.encrypt

2759

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2760

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2761

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2762

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2763

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

2764

# that the FFX mode natively supports. This happens before/after

2765

# encryption/decryption.

2766

# Each character listed must appear only once.

2767

# Number of characters must be in the range [2, 95].

2768

# This must be encoded as ASCII.

2769

# The order of characters does not matter.

2770

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2771

},

2772

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

2773

# input. Outputs a base64 encoded representation of the encrypted output.

2774

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

2775

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

2776

# This annotation will be applied to the surrogate by prefixing it with

2777

# the name of the custom info type followed by the number of

2778

# characters comprising the surrogate. The following scheme defines the

2779

# format: {info type name}({surrogate character count}):{surrogate}

2780

#

2781

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

2782

# the surrogate is 'abc', the full replacement value

2783

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

2784

#

2785

# This annotation identifies the surrogate when inspecting content using the

2786

# custom info type 'Surrogate'. This facilitates reversal of the

2787

# surrogate when it occurs in free text.

2788

#

2789

# Note: For record transformations where the entire cell in a table is being

2790

# transformed, surrogates are not mandatory. Surrogates are used to denote

2791

# the location of the token and are necessary for re-identification in free

2792

# form text.

2793

#

2794

# In order for inspection to work properly, the name of this info type must

2795

# not occur naturally anywhere in your data; otherwise, inspection may either

2796

#

2797

# - reverse a surrogate that does not correspond to an actual identifier

2798

# - be unable to parse the surrogate and result in an error

2799

#

2800

# Therefore, choose your custom info type name carefully after considering

2801

# what your data looks like. One way to select a name that has a high chance

2802

# of yielding reliable detection is to include one or more unicode characters

2803

# that are highly improbable to exist in your data.

2804

# For example, assuming your data is entered from a regular ASCII keyboard,

2805

# the symbol with the hex code point 29DD might be used like so:

2806

# ⧝MY_TOKEN_TYPE.

2807

"name": "A String", # Name of the information type. Either a name of your choosing when

2808

# creating a CustomInfoType, or one of the names listed

2809

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2810

# a built-in type. InfoType names should conform to the pattern

2811

# `[a-zA-Z0-9_]{1,64}`.

2812

},

2813

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

2814

# referential integrity such that the same identifier in two different

2815

# contexts will be given a distinct surrogate. The context is appended to

2816

# plaintext value being encrypted. On decryption the provided context is

2817

# validated against the value used during encryption. If a context was

2818

# provided during encryption, same context must be provided during decryption

2819

# as well.

2820

#

2821

# If the context is not set, plaintext would be used as is for encryption.

2822

# If the context is set but:

2823

#

2824

# 1. there is no record present when transforming a given value or

2825

# 2. the field is not present when transforming a given value,

2826

#

2827

# plaintext would be used as is for encryption.

2828

#

2829

# Note that case (1) is expected when an `InfoTypeTransformation` is

2830

# applied to both structured and non-structured `ContentItem`s.

2831

"name": "A String", # Name describing the field.

2832

},

2833

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

2834

# a key encryption key (KEK) stored by KMS).

2835

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2836

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2837

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2838

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2839

# leaking the key. Choose another type of key if possible.

2840

"key": "A String", # Required. A 128/192/256 bit key.

2841

},

2842

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2843

# It will be discarded after the request finishes.

2844

"name": "A String", # Required. Name of the key.

2845

# This is an arbitrary string used to differentiate different keys.

2846

# A unique key is generated per name: two separate `TransientCryptoKey`

2847

# protos share the same generated key if their names are the same.

2848

# When the data crypto key is generated, this name is not used in any way

2849

# (repeating the api call will result in a different key being generated).

2850

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2851

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2852

# The wrapped key must be a 128/192/256 bit key.

2853

# Authorization requires the following IAM permissions when sending a request

2854

# to perform a crypto transformation using a kms-wrapped crypto key:

2855

# dlp.kms.encrypt

2856

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2857

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2858

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2859

},

2860

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2861

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

2862

# replacement values are dynamically provided by the user for custom behavior,

2863

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

2864

# This can be used on

2865

# data of type: number, long, string, timestamp.

2866

# If the bound `Value` type differs from the type of data being transformed, we

2867

# will first attempt converting the type of the data to be transformed to match

2868

# the type of the bound before comparing.

2869

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

2870

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

2871

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2872

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

2873

# the default behavior will be to hyphenate the min-max range.

2874

# Note that for the purposes of inspection or transformation, the number

2875

# of bytes considered to comprise a 'Value' is based on its representation

2876

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2877

# 123456789, the number of bytes would be counted as 9, even though an

2878

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2879

"timestampValue": "A String", # timestamp

2880

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2881

# and time zone are either specified elsewhere or are not significant. The date

2882

# is relative to the Proleptic Gregorian Calendar. This can represent:

2883

#

2884

# * A full date, with non-zero year, month and day values

2885

# * A month and day value, with a zero year, e.g. an anniversary

2886

# * A year on its own, with zero month and day values

2887

# * A year and month value, with a zero day, e.g. a credit card expiration date

2888

#

2889

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2890

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2891

# a year.

2892

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2893

# month and day.

2894

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2895

# if specifying a year by itself or a year and month where the day is not

2896

# significant.

2897

},

2898

"stringValue": "A String", # string

2899

"integerValue": "A String", # integer

2900

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2901

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2902

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2903

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2904

# to allow the value "24:00:00" for scenarios like business closing time.

2905

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2906

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2907

# allow the value 60 if it allows leap-seconds.

2908

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

2909

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

2910

"booleanValue": True or False, # boolean

2911

"floatValue": 3.14, # float

2912

"dayOfWeekValue": "A String", # day of week

2913

},

2914

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

2915

# used.

2916

# Note that for the purposes of inspection or transformation, the number

2917

# of bytes considered to comprise a 'Value' is based on its representation

2918

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2919

# 123456789, the number of bytes would be counted as 9, even though an

2920

# int64 only holds up to 8 bytes of data.

2921

"timestampValue": "A String", # timestamp

2922

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2923

# and time zone are either specified elsewhere or are not significant. The date

2924

# is relative to the Proleptic Gregorian Calendar. This can represent:

2925

#

2926

# * A full date, with non-zero year, month and day values

2927

# * A month and day value, with a zero year, e.g. an anniversary

2928

# * A year on its own, with zero month and day values

2929

# * A year and month value, with a zero day, e.g. a credit card expiration date

2930

#

2931

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2932

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2933

# a year.

2934

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2935

# month and day.

2936

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2937

# if specifying a year by itself or a year and month where the day is not

2938

# significant.

2939

},

2940

"stringValue": "A String", # string

2941

"integerValue": "A String", # integer

2942

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2943

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2944

# types are google.type.Date and `google.protobuf.Timestamp`.

2945

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2946

# to allow the value "24:00:00" for scenarios like business closing time.

2947

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2948

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2949

# allow the value 60 if it allows leap-seconds.

2950

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2951

},

2952

"booleanValue": True or False, # boolean

2953

"floatValue": 3.14, # float

2954

"dayOfWeekValue": "A String", # day of week

2955

},

2956

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

2957

# Note that for the purposes of inspection or transformation, the number

2958

# of bytes considered to comprise a 'Value' is based on its representation

2959

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2960

# 123456789, the number of bytes would be counted as 9, even though an

2961

# int64 only holds up to 8 bytes of data.

2962

"timestampValue": "A String", # timestamp

2963

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2964

# and time zone are either specified elsewhere or are not significant. The date

2965

# is relative to the Proleptic Gregorian Calendar. This can represent:

2966

#

2967

# * A full date, with non-zero year, month and day values

2968

# * A month and day value, with a zero year, e.g. an anniversary

2969

# * A year on its own, with zero month and day values

2970

# * A year and month value, with a zero day, e.g. a credit card expiration date

2971

#

2972

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2973

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2974

# a year.

2975

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2976

# month and day.

2977

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2978

# if specifying a year by itself or a year and month where the day is not

2979

# significant.

2980

},

2981

"stringValue": "A String", # string

2982

"integerValue": "A String", # integer

2983

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2984

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2985

# types are google.type.Date and `google.protobuf.Timestamp`.

2986

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2987

# to allow the value "24:00:00" for scenarios like business closing time.

2988

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2989

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2990

# allow the value 60 if it allows leap-seconds.

2991

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2992

},

2993

"booleanValue": True or False, # boolean

2994

"floatValue": 3.14, # float

2995

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3000

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

3001

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

3002

# output would be 'My phone number is '.

3003

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3004

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3005

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

3006

# Note that for the purposes of inspection or transformation, the number

3007

# of bytes considered to comprise a 'Value' is based on its representation

3008

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3009

# 123456789, the number of bytes would be counted as 9, even though an

3010

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3011

"timestampValue": "A String", # timestamp

3012

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3013

# and time zone are either specified elsewhere or are not significant. The date

3014

# is relative to the Proleptic Gregorian Calendar. This can represent:

3015

#

3016

# * A full date, with non-zero year, month and day values

3017

# * A month and day value, with a zero year, e.g. an anniversary

3018

# * A year on its own, with zero month and day values

3019

# * A year and month value, with a zero day, e.g. a credit card expiration date

3020

#

3021

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3022

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3023

# a year.

3024

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3025

# month and day.

3026

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3027

# if specifying a year by itself or a year and month where the day is not

3028

# significant.

3029

},

3030

"stringValue": "A String", # string

3031

"integerValue": "A String", # integer

3032

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3033

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3034

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3035

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3036

# to allow the value "24:00:00" for scenarios like business closing time.

3037

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3038

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3039

# allow the value 60 if it allows leap-seconds.

3040

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3041

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3042

"booleanValue": True or False, # boolean

3043

"floatValue": 3.14, # float

3044

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3045

},

3046

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3047

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

3048

# Bucketing transformation can provide all of this functionality,

3049

# but requires more configuration. This message is provided as a convenience to

3050

# the user for simple bucketing strategies.

3051

#

3052

# The transformed value will be a hyphenated string of

3053

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

3054

# all values that are within this bucket will be replaced with "10-20".

3055

#

3056

# This can be used on data of type: double, long.

3057

#

3058

# If the bound Value type differs from the type of data

3059

# being transformed, we will first attempt converting the type of the data to

3060

# be transformed to match the type of the bound before comparing.

3061

#

3062

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3063

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

3064

# grouped together into a single bucket; for example if `upper_bound` = 89,

3065

# then all values greater than 89 are replaced with the value "89+".

3066

# Note that for the purposes of inspection or transformation, the number

3067

# of bytes considered to comprise a 'Value' is based on its representation

3068

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3069

# 123456789, the number of bytes would be counted as 9, even though an

3070

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3071

"timestampValue": "A String", # timestamp

3072

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3073

# and time zone are either specified elsewhere or are not significant. The date

3074

# is relative to the Proleptic Gregorian Calendar. This can represent:

3075

#

3076

# * A full date, with non-zero year, month and day values

3077

# * A month and day value, with a zero year, e.g. an anniversary

3078

# * A year on its own, with zero month and day values

3079

# * A year and month value, with a zero day, e.g. a credit card expiration date

3080

#

3081

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3082

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3083

# a year.

3084

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3085

# month and day.

3086

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3087

# if specifying a year by itself or a year and month where the day is not

3088

# significant.

3089

},

3090

"stringValue": "A String", # string

3091

"integerValue": "A String", # integer

3092

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3093

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3094

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3095

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3096

# to allow the value "24:00:00" for scenarios like business closing time.

3097

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3098

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3099

# allow the value 60 if it allows leap-seconds.

3100

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3101

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3102

"booleanValue": True or False, # boolean

3103

"floatValue": 3.14, # float

3104

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3105

},

3106

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

3107

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

3108

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

3109

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3110

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

3111

# grouped together into a single bucket; for example if `lower_bound` = 10,

3112

# then all values less than 10 are replaced with the value "-10".

3113

# Note that for the purposes of inspection or transformation, the number

3114

# of bytes considered to comprise a 'Value' is based on its representation

3115

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3116

# 123456789, the number of bytes would be counted as 9, even though an

3117

# int64 only holds up to 8 bytes of data.

3118

"timestampValue": "A String", # timestamp

3119

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3120

# and time zone are either specified elsewhere or are not significant. The date

3121

# is relative to the Proleptic Gregorian Calendar. This can represent:

3122

#

3123

# * A full date, with non-zero year, month and day values

3124

# * A month and day value, with a zero year, e.g. an anniversary

3125

# * A year on its own, with zero month and day values

3126

# * A year and month value, with a zero day, e.g. a credit card expiration date

3127

#

3128

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3129

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3130

# a year.

3131

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3132

# month and day.

3133

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3134

# if specifying a year by itself or a year and month where the day is not

3135

# significant.

3136

},

3137

"stringValue": "A String", # string

3138

"integerValue": "A String", # integer

3139

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3140

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3141

# types are google.type.Date and `google.protobuf.Timestamp`.

3142

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3143

# to allow the value "24:00:00" for scenarios like business closing time.

3144

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3145

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3146

# allow the value 60 if it allows leap-seconds.

3147

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3148

},

3149

"booleanValue": True or False, # boolean

3150

"floatValue": 3.14, # float

3151

"dayOfWeekValue": "A String", # day of week

3152

},

3153

},

3154

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

3155

# fixed character. Masking can start from the beginning or end of the string.

3156

# This can be used on data of any type (numbers, longs, and so on) and when

3157

# de-identifying structured data we'll attempt to preserve the original data's

3158

# type. (This allows you to take a long like 123 and modify it to a string like

3159

# **3.

3160

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

3161

# characters. For example, if the input string is `555-555-5555` and you

3162

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

3163

# returns `***-**5-5555`.

3164

{ # Characters to skip when doing deidentification of a value. These will be left

3165

# alone and skipped.

3166

"charactersToSkip": "A String", # Characters to not transform when masking.

3167

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

3172

# masked. Skipped characters do not count towards this tally.

3173

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

3174

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

3175

# code or credit card number. This string must have a length of 1. If not

3176

# supplied, this value defaults to `*` for strings, and `0` for digits.

3177

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

3178

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

3179

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

3180

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

3181

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3182

},

3183

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3184

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

3185

# this transformation to apply to all findings that correspond to

3186

# infoTypes that were requested in `InspectConfig`.

3187

{ # Type of information detected by the API.

3188

"name": "A String", # Name of the information type. Either a name of your choosing when

3189

# creating a CustomInfoType, or one of the names listed

3190

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

3191

# a built-in type. InfoType names should conform to the pattern

3192

# `[a-zA-Z0-9_]{1,64}`.

3193

},

3194

],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

3199

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

3200

# portion of the value.

3201

"partToExtract": "A String", # The part of the time to keep.

3202

},

3203

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

3204

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

3205

# to learn more.

3206

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

3207

# If set, must also set cryptoKey. If set, shift will be consistent for the

3208

# given context.

3209

"name": "A String", # Name describing the field.

3210

},

3211

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

3212

# range (inclusive ends). Negative means shift to earlier in time. Must not

3213

# be more than 365250 days (1000 years) each direction.

3214

#

3215

# For example, 3 means shift date to at most 3 days into the future.

3216

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3217

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

3218

# results in the same shift for the same context and crypto_key. If

3219

# set, must also set context. Can only be applied to table items.

3220

# a key encryption key (KEK) stored by KMS).

3221

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3222

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3223

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3224

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3225

# leaking the key. Choose another type of key if possible.

3226

"key": "A String", # Required. A 128/192/256 bit key.

3227

},

3228

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3229

# It will be discarded after the request finishes.

3230

"name": "A String", # Required. Name of the key.

3231

# This is an arbitrary string used to differentiate different keys.

3232

# A unique key is generated per name: two separate `TransientCryptoKey`

3233

# protos share the same generated key if their names are the same.

3234

# When the data crypto key is generated, this name is not used in any way

3235

# (repeating the api call will result in a different key being generated).

3236

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3237

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3238

# The wrapped key must be a 128/192/256 bit key.

3239

# Authorization requires the following IAM permissions when sending a request

3240

# to perform a crypto transformation using a kms-wrapped crypto key:

3241

# dlp.kms.encrypt

3242

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3243

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3244

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3245

},

3246

},

3247

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3248

},

3249

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

3250

# Uses SHA-256.

3251

# The key size must be either 32 or 64 bytes.

3252

# Outputs a base64 encoded representation of the hashed output

3253

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

3254

# Currently, only string and integer values can be hashed.

3255

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

3256

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

3257

# a key encryption key (KEK) stored by KMS).

3258

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3259

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3260

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3261

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3262

# leaking the key. Choose another type of key if possible.

3263

"key": "A String", # Required. A 128/192/256 bit key.

3264

},

3265

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3266

# It will be discarded after the request finishes.

3267

"name": "A String", # Required. Name of the key.

3268

# This is an arbitrary string used to differentiate different keys.

3269

# A unique key is generated per name: two separate `TransientCryptoKey`

3270

# protos share the same generated key if their names are the same.

3271

# When the data crypto key is generated, this name is not used in any way

3272

# (repeating the api call will result in a different key being generated).

3273

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3274

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3275

# The wrapped key must be a 128/192/256 bit key.

3276

# Authorization requires the following IAM permissions when sending a request

3277

# to perform a crypto transformation using a kms-wrapped crypto key:

3278

# dlp.kms.encrypt

3279

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3280

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3281

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3282

},

3283

},

3284

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

3285

# (FPE) with the FFX mode of operation; however when used in the

3286

# `ReidentifyContent` API method, it serves the opposite function by reversing

3287

# the surrogate back into the original identifier. The identifier must be

3288

# encoded as ASCII. For a given crypto key and context, the same identifier

3289

# will be replaced with the same surrogate. Identifiers must be at least two

3290

# characters long. In the case that the identifier is the empty string, it will

3291

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

3292

# more.

3293

#

3294

# Note: We recommend using CryptoDeterministicConfig for all use cases which

3295

# do not require preserving the input alphabet space and size, plus warrant

3296

# referential integrity.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3297

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

3298

# This annotation will be applied to the surrogate by prefixing it with

3299

# the name of the custom infoType followed by the number of

3300

# characters comprising the surrogate. The following scheme defines the

3301

# format: info_type_name(surrogate_character_count):surrogate

3302

#

3303

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

3304

# the surrogate is 'abc', the full replacement value

3305

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

3306

#

3307

# This annotation identifies the surrogate when inspecting content using the

3308

# custom infoType

3309

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

3310

# This facilitates reversal of the surrogate when it occurs in free text.

3311

#

3312

# In order for inspection to work properly, the name of this infoType must

3313

# not occur naturally anywhere in your data; otherwise, inspection may

3314

# find a surrogate that does not correspond to an actual identifier.

3315

# Therefore, choose your custom infoType name carefully after considering

3316

# what your data looks like. One way to select a name that has a high chance

3317

# of yielding reliable detection is to include one or more unicode characters

3318

# that are highly improbable to exist in your data.

3319

# For example, assuming your data is entered from a regular ASCII keyboard,

3320

# the symbol with the hex code point 29DD might be used like so:

3321

# ⧝MY_TOKEN_TYPE

3322

"name": "A String", # Name of the information type. Either a name of your choosing when

3323

# creating a CustomInfoType, or one of the names listed

3324

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

3325

# a built-in type. InfoType names should conform to the pattern

3326

# `[a-zA-Z0-9_]{1,64}`.

3327

},

3328

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

3329

# identifier in two different contexts won't be given the same surrogate. If

3330

# the context is not set, a default tweak will be used.

3331

#

3332

# If the context is set but:

3333

#

3334

# 1. there is no record present when transforming a given value or

3335

# 1. the field is not present when transforming a given value,

3336

#

3337

# a default tweak will be used.

3338

#

3339

# Note that case (1) is expected when an `InfoTypeTransformation` is

3340

# applied to both structured and non-structured `ContentItem`s.

3341

# Currently, the referenced field may be of value type integer or string.

3342

#

3343

# The tweak is constructed as a sequence of bytes in big endian byte order

3344

# such that:

3345

#

3346

# - a 64 bit integer is encoded followed by a single byte of value 1

3347

# - a string is encoded in UTF-8 format followed by a single byte of value 2

3348

"name": "A String", # Name describing the field.

3349

},

3350

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

3351

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

3352

# a key encryption key (KEK) stored by KMS).

3353

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3354

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3355

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3356

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3357

# leaking the key. Choose another type of key if possible.

3358

"key": "A String", # Required. A 128/192/256 bit key.

3359

},

3360

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3361

# It will be discarded after the request finishes.

3362

"name": "A String", # Required. Name of the key.

3363

# This is an arbitrary string used to differentiate different keys.

3364

# A unique key is generated per name: two separate `TransientCryptoKey`

3365

# protos share the same generated key if their names are the same.

3366

# When the data crypto key is generated, this name is not used in any way

3367

# (repeating the api call will result in a different key being generated).

3368

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3369

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3370

# The wrapped key must be a 128/192/256 bit key.

3371

# Authorization requires the following IAM permissions when sending a request

3372

# to perform a crypto transformation using a kms-wrapped crypto key:

3373

# dlp.kms.encrypt

3374

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3375

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3376

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3377

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3378

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

3379

# that the FFX mode natively supports. This happens before/after

3380

# encryption/decryption.

3381

# Each character listed must appear only once.

3382

# Number of characters must be in the range [2, 95].

3383

# This must be encoded as ASCII.

3384

# The order of characters does not matter.

3385

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3386

},

3387

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

3388

# input. Outputs a base64 encoded representation of the encrypted output.

3389

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

3390

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

3391

# This annotation will be applied to the surrogate by prefixing it with

3392

# the name of the custom info type followed by the number of

3393

# characters comprising the surrogate. The following scheme defines the

3394

# format: {info type name}({surrogate character count}):{surrogate}

3395

#

3396

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

3397

# the surrogate is 'abc', the full replacement value

3398

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

3399

#

3400

# This annotation identifies the surrogate when inspecting content using the

3401

# custom info type 'Surrogate'. This facilitates reversal of the

3402

# surrogate when it occurs in free text.

3403

#

3404

# Note: For record transformations where the entire cell in a table is being

3405

# transformed, surrogates are not mandatory. Surrogates are used to denote

3406

# the location of the token and are necessary for re-identification in free

3407

# form text.

3408

#

3409

# In order for inspection to work properly, the name of this info type must

3410

# not occur naturally anywhere in your data; otherwise, inspection may either

3411

#

3412

# - reverse a surrogate that does not correspond to an actual identifier

3413

# - be unable to parse the surrogate and result in an error

3414

#

3415

# Therefore, choose your custom info type name carefully after considering

3416

# what your data looks like. One way to select a name that has a high chance

3417

# of yielding reliable detection is to include one or more unicode characters

3418

# that are highly improbable to exist in your data.

3419

# For example, assuming your data is entered from a regular ASCII keyboard,

3420

# the symbol with the hex code point 29DD might be used like so:

3421

# ⧝MY_TOKEN_TYPE.

3422

"name": "A String", # Name of the information type. Either a name of your choosing when

3423

# creating a CustomInfoType, or one of the names listed

3424

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

3425

# a built-in type. InfoType names should conform to the pattern

3426

# `[a-zA-Z0-9_]{1,64}`.

3427

},

3428

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

3429

# referential integrity such that the same identifier in two different

3430

# contexts will be given a distinct surrogate. The context is appended to

3431

# plaintext value being encrypted. On decryption the provided context is

3432

# validated against the value used during encryption. If a context was

3433

# provided during encryption, same context must be provided during decryption

3434

# as well.

3435

#

3436

# If the context is not set, plaintext would be used as is for encryption.

3437

# If the context is set but:

3438

#

3439

# 1. there is no record present when transforming a given value or

3440

# 2. the field is not present when transforming a given value,

3441

#

3442

# plaintext would be used as is for encryption.

3443

#

3444

# Note that case (1) is expected when an `InfoTypeTransformation` is

3445

# applied to both structured and non-structured `ContentItem`s.

3446

"name": "A String", # Name describing the field.

3447

},

3448

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

3449

# a key encryption key (KEK) stored by KMS).

3450

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3451

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3452

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3453

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3454

# leaking the key. Choose another type of key if possible.

3455

"key": "A String", # Required. A 128/192/256 bit key.

3456

},

3457

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3458

# It will be discarded after the request finishes.

3459

"name": "A String", # Required. Name of the key.

3460

# This is an arbitrary string used to differentiate different keys.

3461

# A unique key is generated per name: two separate `TransientCryptoKey`

3462

# protos share the same generated key if their names are the same.

3463

# When the data crypto key is generated, this name is not used in any way

3464

# (repeating the api call will result in a different key being generated).

3465

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3466

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3467

# The wrapped key must be a 128/192/256 bit key.

3468

# Authorization requires the following IAM permissions when sending a request

3469

# to perform a crypto transformation using a kms-wrapped crypto key:

3470

# dlp.kms.encrypt

3471

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3472

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3473

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3474

},

3475

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3476

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

3477

# replacement values are dynamically provided by the user for custom behavior,

3478

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

3479

# This can be used on

3480

# data of type: number, long, string, timestamp.

3481

# If the bound `Value` type differs from the type of data being transformed, we

3482

# will first attempt converting the type of the data to be transformed to match

3483

# the type of the bound before comparing.

3484

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

3485

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

3486

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3487

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

3488

# the default behavior will be to hyphenate the min-max range.

3489

# Note that for the purposes of inspection or transformation, the number

3490

# of bytes considered to comprise a 'Value' is based on its representation

3491

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3492

# 123456789, the number of bytes would be counted as 9, even though an

3493

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3494

"timestampValue": "A String", # timestamp

3495

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3496

# and time zone are either specified elsewhere or are not significant. The date

3497

# is relative to the Proleptic Gregorian Calendar. This can represent:

3498

#

3499

# * A full date, with non-zero year, month and day values

3500

# * A month and day value, with a zero year, e.g. an anniversary

3501

# * A year on its own, with zero month and day values

3502

# * A year and month value, with a zero day, e.g. a credit card expiration date

3503

#

3504

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3505

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3506

# a year.

3507

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3508

# month and day.

3509

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3510

# if specifying a year by itself or a year and month where the day is not

3511

# significant.

3512

},

3513

"stringValue": "A String", # string

3514

"integerValue": "A String", # integer

3515

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3516

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3517

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3518

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3519

# to allow the value "24:00:00" for scenarios like business closing time.

3520

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3521

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3522

# allow the value 60 if it allows leap-seconds.

3523

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3524

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3525

"booleanValue": True or False, # boolean

3526

"floatValue": 3.14, # float

3527

"dayOfWeekValue": "A String", # day of week

3528

},

3529

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

3530

# used.

3531

# Note that for the purposes of inspection or transformation, the number

3532

# of bytes considered to comprise a 'Value' is based on its representation

3533

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3534

# 123456789, the number of bytes would be counted as 9, even though an

3535

# int64 only holds up to 8 bytes of data.

3536

"timestampValue": "A String", # timestamp

3537

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3538

# and time zone are either specified elsewhere or are not significant. The date

3539

# is relative to the Proleptic Gregorian Calendar. This can represent:

3540

#

3541

# * A full date, with non-zero year, month and day values

3542

# * A month and day value, with a zero year, e.g. an anniversary

3543

# * A year on its own, with zero month and day values

3544

# * A year and month value, with a zero day, e.g. a credit card expiration date

3545

#

3546

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3547

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3548

# a year.

3549

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3550

# month and day.

3551

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3552

# if specifying a year by itself or a year and month where the day is not

3553

# significant.

3554

},

3555

"stringValue": "A String", # string

3556

"integerValue": "A String", # integer

3557

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3558

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3559

# types are google.type.Date and `google.protobuf.Timestamp`.

3560

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3561

# to allow the value "24:00:00" for scenarios like business closing time.

3562

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3563

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3564

# allow the value 60 if it allows leap-seconds.

3565

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3566

},

3567

"booleanValue": True or False, # boolean

3568

"floatValue": 3.14, # float

3569

"dayOfWeekValue": "A String", # day of week

3570

},

3571

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

3572

# Note that for the purposes of inspection or transformation, the number

3573

# of bytes considered to comprise a 'Value' is based on its representation

3574

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3575

# 123456789, the number of bytes would be counted as 9, even though an

3576

# int64 only holds up to 8 bytes of data.

3577

"timestampValue": "A String", # timestamp

3578

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3579

# and time zone are either specified elsewhere or are not significant. The date

3580

# is relative to the Proleptic Gregorian Calendar. This can represent:

3581

#

3582

# * A full date, with non-zero year, month and day values

3583

# * A month and day value, with a zero year, e.g. an anniversary

3584

# * A year on its own, with zero month and day values

3585

# * A year and month value, with a zero day, e.g. a credit card expiration date

3586

#

3587

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3588

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3589

# a year.

3590

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3591

# month and day.

3592

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3593

# if specifying a year by itself or a year and month where the day is not

3594

# significant.

3595

},

3596

"stringValue": "A String", # string

3597

"integerValue": "A String", # integer

3598

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3599

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3600

# types are google.type.Date and `google.protobuf.Timestamp`.

3601

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3602

# to allow the value "24:00:00" for scenarios like business closing time.

3603

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3604

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3605

# allow the value 60 if it allows leap-seconds.

3606

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3607

},

3608

"booleanValue": True or False, # boolean

3609

"floatValue": 3.14, # float

3610

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3615

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

3616

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

3617

# output would be 'My phone number is '.

3618

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3619

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3620

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

3621

# Note that for the purposes of inspection or transformation, the number

3622

# of bytes considered to comprise a 'Value' is based on its representation

3623

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3624

# 123456789, the number of bytes would be counted as 9, even though an

3625

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3626

"timestampValue": "A String", # timestamp

3627

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3628

# and time zone are either specified elsewhere or are not significant. The date

3629

# is relative to the Proleptic Gregorian Calendar. This can represent:

3630

#

3631

# * A full date, with non-zero year, month and day values

3632

# * A month and day value, with a zero year, e.g. an anniversary

3633

# * A year on its own, with zero month and day values

3634

# * A year and month value, with a zero day, e.g. a credit card expiration date

3635

#

3636

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3637

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3638

# a year.

3639

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3640

# month and day.

3641

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3642

# if specifying a year by itself or a year and month where the day is not

3643

# significant.

3644

},

3645

"stringValue": "A String", # string

3646

"integerValue": "A String", # integer

3647

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3648

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3649

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3650

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3651

# to allow the value "24:00:00" for scenarios like business closing time.

3652

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3653

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3654

# allow the value 60 if it allows leap-seconds.

3655

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3656

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3657

"booleanValue": True or False, # boolean

3658

"floatValue": 3.14, # float

3659

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3660

},

3661

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3662

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

3663

# Bucketing transformation can provide all of this functionality,

3664

# but requires more configuration. This message is provided as a convenience to

3665

# the user for simple bucketing strategies.

3666

#

3667

# The transformed value will be a hyphenated string of

3668

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

3669

# all values that are within this bucket will be replaced with "10-20".

3670

#

3671

# This can be used on data of type: double, long.

3672

#

3673

# If the bound Value type differs from the type of data

3674

# being transformed, we will first attempt converting the type of the data to

3675

# be transformed to match the type of the bound before comparing.

3676

#

3677

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3678

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

3679

# grouped together into a single bucket; for example if `upper_bound` = 89,

3680

# then all values greater than 89 are replaced with the value "89+".

3681

# Note that for the purposes of inspection or transformation, the number

3682

# of bytes considered to comprise a 'Value' is based on its representation

3683

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3684

# 123456789, the number of bytes would be counted as 9, even though an

3685

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3686

"timestampValue": "A String", # timestamp

3687

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3688

# and time zone are either specified elsewhere or are not significant. The date

3689

# is relative to the Proleptic Gregorian Calendar. This can represent:

3690

#

3691

# * A full date, with non-zero year, month and day values

3692

# * A month and day value, with a zero year, e.g. an anniversary

3693

# * A year on its own, with zero month and day values

3694

# * A year and month value, with a zero day, e.g. a credit card expiration date

3695

#

3696

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3697

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3698

# a year.

3699

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3700

# month and day.

3701

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3702

# if specifying a year by itself or a year and month where the day is not

3703

# significant.

3704

},

3705

"stringValue": "A String", # string

3706

"integerValue": "A String", # integer

3707

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3708

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3709

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3710

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3711

# to allow the value "24:00:00" for scenarios like business closing time.

3712

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3713

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3714

# allow the value 60 if it allows leap-seconds.

3715

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3716

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3717

"booleanValue": True or False, # boolean

3718

"floatValue": 3.14, # float

3719

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3720

},

3721

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

3722

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

3723

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

3724

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3725

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

3726

# grouped together into a single bucket; for example if `lower_bound` = 10,

3727

# then all values less than 10 are replaced with the value "-10".

3728

# Note that for the purposes of inspection or transformation, the number

3729

# of bytes considered to comprise a 'Value' is based on its representation

3730

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3731

# 123456789, the number of bytes would be counted as 9, even though an

3732

# int64 only holds up to 8 bytes of data.

3733

"timestampValue": "A String", # timestamp

3734

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3735

# and time zone are either specified elsewhere or are not significant. The date

3736

# is relative to the Proleptic Gregorian Calendar. This can represent:

3737

#

3738

# * A full date, with non-zero year, month and day values

3739

# * A month and day value, with a zero year, e.g. an anniversary

3740

# * A year on its own, with zero month and day values

3741

# * A year and month value, with a zero day, e.g. a credit card expiration date

3742

#

3743

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3744

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3745

# a year.

3746

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3747

# month and day.

3748

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3749

# if specifying a year by itself or a year and month where the day is not

3750

# significant.

3751

},

3752

"stringValue": "A String", # string

3753

"integerValue": "A String", # integer

3754

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3755

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3756

# types are google.type.Date and `google.protobuf.Timestamp`.

3757

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3758

# to allow the value "24:00:00" for scenarios like business closing time.

3759

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3760

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3761

# allow the value 60 if it allows leap-seconds.

3762

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3763

},

3764

"booleanValue": True or False, # boolean

3765

"floatValue": 3.14, # float

3766

"dayOfWeekValue": "A String", # day of week

3767

},

3768

},

3769

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

3770

# fixed character. Masking can start from the beginning or end of the string.

3771

# This can be used on data of any type (numbers, longs, and so on) and when

3772

# de-identifying structured data we'll attempt to preserve the original data's

3773

# type. (This allows you to take a long like 123 and modify it to a string like

3774

# **3.

3775

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

3776

# characters. For example, if the input string is `555-555-5555` and you

3777

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

3778

# returns `***-**5-5555`.

3779

{ # Characters to skip when doing deidentification of a value. These will be left

3780

# alone and skipped.

3781

"charactersToSkip": "A String", # Characters to not transform when masking.

3782

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

3787

# masked. Skipped characters do not count towards this tally.

3788

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

3789

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

3790

# code or credit card number. This string must have a length of 1. If not

3791

# supplied, this value defaults to `*` for strings, and `0` for digits.

3792

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

3793

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

3794

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

3795

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

3796

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3797

},

3798

},

3799

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

3800

# given `RecordCondition`. The conditions are allowed to reference fields

3801

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

3806

# column for the same record is within a specific range.

3807

# - Redact a field if the date of birth field is greater than 85.

3808

# a field.

3809

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

3810

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

3811

# only supported value is `AND`.

3812

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

3813

"conditions": [ # A collection of conditions.

3814

{ # The field type of `value` and `field` do not need to match to be

3815

# considered equal, but not all comparisons are possible.

3816

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

3817

# but all other comparisons are invalid with incompatible types.

3818

# A `value` of type:

3819

#

3820

# - `string` can be compared against all other types

3821

# - `boolean` can only be compared against other booleans

3822

# - `integer` can be compared against doubles or a string if the string value

3823

# can be parsed as an integer.

3824

# - `double` can be compared against integers or a string if the string can

3825

# be parsed as a double.

3826

# - `Timestamp` can be compared against strings in RFC 3339 date string

3827

# format.

3828

# - `TimeOfDay` can be compared against timestamps and strings in the format

3829

# of 'HH:mm:ss'.

3830

#

3831

# If we fail to compare do to type mismatch, a warning will be given and

3832

# the condition will evaluate to false.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3833

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

3834

# Note that for the purposes of inspection or transformation, the number

3835

# of bytes considered to comprise a 'Value' is based on its representation

3836

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3837

# 123456789, the number of bytes would be counted as 9, even though an

3838

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3839

"timestampValue": "A String", # timestamp

3840

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3841

# and time zone are either specified elsewhere or are not significant. The date

3842

# is relative to the Proleptic Gregorian Calendar. This can represent:

3843

#

3844

# * A full date, with non-zero year, month and day values

3845

# * A month and day value, with a zero year, e.g. an anniversary

3846

# * A year on its own, with zero month and day values

3847

# * A year and month value, with a zero day, e.g. a credit card expiration date

3848

#

3849

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3850

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3851

# a year.

3852

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3853

# month and day.

3854

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3855

# if specifying a year by itself or a year and month where the day is not

3856

# significant.

3857

},

3858

"stringValue": "A String", # string

3859

"integerValue": "A String", # integer

3860

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3861

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3862

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3863

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3864

# to allow the value "24:00:00" for scenarios like business closing time.

3865

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3866

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3867

# allow the value 60 if it allows leap-seconds.

3868

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3869

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3870

"booleanValue": True or False, # boolean

3871

"floatValue": 3.14, # float

3872

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3873

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3874

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

3875

"name": "A String", # Name describing the field.

3876

},

3877

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

},

},

],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3885

"transformation": { # A rule for transforming a value. # The specific transformation these stats apply to.

3886

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

3887

# portion of the value.

3888

"partToExtract": "A String", # The part of the time to keep.

3889

},

3890

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

3891

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

3892

# to learn more.

3893

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

3894

# If set, must also set cryptoKey. If set, shift will be consistent for the

3895

# given context.

3896

"name": "A String", # Name describing the field.

3897

},

3898

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

3899

# range (inclusive ends). Negative means shift to earlier in time. Must not

3900

# be more than 365250 days (1000 years) each direction.

3901

#

3902

# For example, 3 means shift date to at most 3 days into the future.

3903

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3904

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

3905

# results in the same shift for the same context and crypto_key. If

3906

# set, must also set context. Can only be applied to table items.

3907

# a key encryption key (KEK) stored by KMS).

3908

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3909

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3910

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3911

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3912

# leaking the key. Choose another type of key if possible.

3913

"key": "A String", # Required. A 128/192/256 bit key.

3914

},

3915

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3916

# It will be discarded after the request finishes.

3917

"name": "A String", # Required. Name of the key.

3918

# This is an arbitrary string used to differentiate different keys.

3919

# A unique key is generated per name: two separate `TransientCryptoKey`

3920

# protos share the same generated key if their names are the same.

3921

# When the data crypto key is generated, this name is not used in any way

3922

# (repeating the api call will result in a different key being generated).

3923

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3924

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3925

# The wrapped key must be a 128/192/256 bit key.

3926

# Authorization requires the following IAM permissions when sending a request

3927

# to perform a crypto transformation using a kms-wrapped crypto key:

3928

# dlp.kms.encrypt

3929

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3930

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3931

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3932

},

3933

},

3934

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3935

},

3936

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

3937

# Uses SHA-256.

3938

# The key size must be either 32 or 64 bytes.

3939

# Outputs a base64 encoded representation of the hashed output

3940

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

3941

# Currently, only string and integer values can be hashed.

3942

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

3943

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

3944

# a key encryption key (KEK) stored by KMS).

3945

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3946

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3947

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3948

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3949

# leaking the key. Choose another type of key if possible.

3950

"key": "A String", # Required. A 128/192/256 bit key.

3951

},

3952

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3953

# It will be discarded after the request finishes.

3954

"name": "A String", # Required. Name of the key.

3955

# This is an arbitrary string used to differentiate different keys.

3956

# A unique key is generated per name: two separate `TransientCryptoKey`

3957

# protos share the same generated key if their names are the same.

3958

# When the data crypto key is generated, this name is not used in any way

3959

# (repeating the api call will result in a different key being generated).

3960

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

3961

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3962

# The wrapped key must be a 128/192/256 bit key.

3963

# Authorization requires the following IAM permissions when sending a request

3964

# to perform a crypto transformation using a kms-wrapped crypto key:

3965

# dlp.kms.encrypt

3966

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3967

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3968

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3969

},

3970

},

3971

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

3972

# (FPE) with the FFX mode of operation; however when used in the

3973

# `ReidentifyContent` API method, it serves the opposite function by reversing

3974

# the surrogate back into the original identifier. The identifier must be

3975

# encoded as ASCII. For a given crypto key and context, the same identifier

3976

# will be replaced with the same surrogate. Identifiers must be at least two

3977

# characters long. In the case that the identifier is the empty string, it will

3978

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

3979

# more.

3980

#

3981

# Note: We recommend using CryptoDeterministicConfig for all use cases which

3982

# do not require preserving the input alphabet space and size, plus warrant

3983

# referential integrity.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3984

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

3985

# This annotation will be applied to the surrogate by prefixing it with

3986

# the name of the custom infoType followed by the number of

3987

# characters comprising the surrogate. The following scheme defines the

3988

# format: info_type_name(surrogate_character_count):surrogate

3989

#

3990

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

3991

# the surrogate is 'abc', the full replacement value

3992

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

3993

#

3994

# This annotation identifies the surrogate when inspecting content using the

3995

# custom infoType

3996

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

3997

# This facilitates reversal of the surrogate when it occurs in free text.

3998

#

3999

# In order for inspection to work properly, the name of this infoType must

4000

# not occur naturally anywhere in your data; otherwise, inspection may

4001

# find a surrogate that does not correspond to an actual identifier.

4002

# Therefore, choose your custom infoType name carefully after considering

4003

# what your data looks like. One way to select a name that has a high chance

4004

# of yielding reliable detection is to include one or more unicode characters

4005

# that are highly improbable to exist in your data.

4006

# For example, assuming your data is entered from a regular ASCII keyboard,

4007

# the symbol with the hex code point 29DD might be used like so:

4008

# ⧝MY_TOKEN_TYPE

4009

"name": "A String", # Name of the information type. Either a name of your choosing when

4010

# creating a CustomInfoType, or one of the names listed

4011

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4012

# a built-in type. InfoType names should conform to the pattern

4013

# `[a-zA-Z0-9_]{1,64}`.

4014

},

4015

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

4016

# identifier in two different contexts won't be given the same surrogate. If

4017

# the context is not set, a default tweak will be used.

4018

#

4019

# If the context is set but:

4020

#

4021

# 1. there is no record present when transforming a given value or

4022

# 1. the field is not present when transforming a given value,

4023

#

4024

# a default tweak will be used.

4025

#

4026

# Note that case (1) is expected when an `InfoTypeTransformation` is

4027

# applied to both structured and non-structured `ContentItem`s.

4028

# Currently, the referenced field may be of value type integer or string.

4029

#

4030

# The tweak is constructed as a sequence of bytes in big endian byte order

4031

# such that:

4032

#

4033

# - a 64 bit integer is encoded followed by a single byte of value 1

4034

# - a string is encoded in UTF-8 format followed by a single byte of value 2

4035

"name": "A String", # Name describing the field.

4036

},

4037

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

4038

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

4039

# a key encryption key (KEK) stored by KMS).

4040

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

4041

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

4042

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4043

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

4044

# leaking the key. Choose another type of key if possible.

4045

"key": "A String", # Required. A 128/192/256 bit key.

4046

},

4047

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

4048

# It will be discarded after the request finishes.

4049

"name": "A String", # Required. Name of the key.

4050

# This is an arbitrary string used to differentiate different keys.

4051

# A unique key is generated per name: two separate `TransientCryptoKey`

4052

# protos share the same generated key if their names are the same.

4053

# When the data crypto key is generated, this name is not used in any way

4054

# (repeating the api call will result in a different key being generated).

4055

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4056

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

4057

# The wrapped key must be a 128/192/256 bit key.

4058

# Authorization requires the following IAM permissions when sending a request

4059

# to perform a crypto transformation using a kms-wrapped crypto key:

4060

# dlp.kms.encrypt

4061

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4062

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4063

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4064

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4065

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

4066

# that the FFX mode natively supports. This happens before/after

4067

# encryption/decryption.

4068

# Each character listed must appear only once.

4069

# Number of characters must be in the range [2, 95].

4070

# This must be encoded as ASCII.

4071

# The order of characters does not matter.

4072

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4073

},

4074

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

4075

# input. Outputs a base64 encoded representation of the encrypted output.

4076

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

4077

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

4078

# This annotation will be applied to the surrogate by prefixing it with

4079

# the name of the custom info type followed by the number of

4080

# characters comprising the surrogate. The following scheme defines the

4081

# format: {info type name}({surrogate character count}):{surrogate}

4082

#

4083

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

4084

# the surrogate is 'abc', the full replacement value

4085

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

4086

#

4087

# This annotation identifies the surrogate when inspecting content using the

4088

# custom info type 'Surrogate'. This facilitates reversal of the

4089

# surrogate when it occurs in free text.

4090

#

4091

# Note: For record transformations where the entire cell in a table is being

4092

# transformed, surrogates are not mandatory. Surrogates are used to denote

4093

# the location of the token and are necessary for re-identification in free

4094

# form text.

4095

#

4096

# In order for inspection to work properly, the name of this info type must

4097

# not occur naturally anywhere in your data; otherwise, inspection may either

4098

#

4099

# - reverse a surrogate that does not correspond to an actual identifier

4100

# - be unable to parse the surrogate and result in an error

4101

#

4102

# Therefore, choose your custom info type name carefully after considering

4103

# what your data looks like. One way to select a name that has a high chance

4104

# of yielding reliable detection is to include one or more unicode characters

4105

# that are highly improbable to exist in your data.

4106

# For example, assuming your data is entered from a regular ASCII keyboard,

4107

# the symbol with the hex code point 29DD might be used like so:

4108

# ⧝MY_TOKEN_TYPE.

4109

"name": "A String", # Name of the information type. Either a name of your choosing when

4110

# creating a CustomInfoType, or one of the names listed

4111

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4112

# a built-in type. InfoType names should conform to the pattern

4113

# `[a-zA-Z0-9_]{1,64}`.

4114

},

4115

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

4116

# referential integrity such that the same identifier in two different

4117

# contexts will be given a distinct surrogate. The context is appended to

4118

# plaintext value being encrypted. On decryption the provided context is

4119

# validated against the value used during encryption. If a context was

4120

# provided during encryption, same context must be provided during decryption

4121

# as well.

4122

#

4123

# If the context is not set, plaintext would be used as is for encryption.

4124

# If the context is set but:

4125

#

4126

# 1. there is no record present when transforming a given value or

4127

# 2. the field is not present when transforming a given value,

4128

#

4129

# plaintext would be used as is for encryption.

4130

#

4131

# Note that case (1) is expected when an `InfoTypeTransformation` is

4132

# applied to both structured and non-structured `ContentItem`s.

4133

"name": "A String", # Name describing the field.

4134

},

4135

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

4136

# a key encryption key (KEK) stored by KMS).

4137

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

4138

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

4139

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4140

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

4141

# leaking the key. Choose another type of key if possible.

4142

"key": "A String", # Required. A 128/192/256 bit key.

4143

},

4144

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

4145

# It will be discarded after the request finishes.

4146

"name": "A String", # Required. Name of the key.

4147

# This is an arbitrary string used to differentiate different keys.

4148

# A unique key is generated per name: two separate `TransientCryptoKey`

4149

# protos share the same generated key if their names are the same.

4150

# When the data crypto key is generated, this name is not used in any way

4151

# (repeating the api call will result in a different key being generated).

4152

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4153

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

4154

# The wrapped key must be a 128/192/256 bit key.

4155

# Authorization requires the following IAM permissions when sending a request

4156

# to perform a crypto transformation using a kms-wrapped crypto key:

4157

# dlp.kms.encrypt

4158

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4159

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4160

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4161

},

4162

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4163

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

4164

# replacement values are dynamically provided by the user for custom behavior,

4165

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

4166

# This can be used on

4167

# data of type: number, long, string, timestamp.

4168

# If the bound `Value` type differs from the type of data being transformed, we

4169

# will first attempt converting the type of the data to be transformed to match

4170

# the type of the bound before comparing.

4171

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

4172

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

4173

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4174

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

4175

# the default behavior will be to hyphenate the min-max range.

4176

# Note that for the purposes of inspection or transformation, the number

4177

# of bytes considered to comprise a 'Value' is based on its representation

4178

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4179

# 123456789, the number of bytes would be counted as 9, even though an

4180

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4181

"timestampValue": "A String", # timestamp

4182

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4183

# and time zone are either specified elsewhere or are not significant. The date

4184

# is relative to the Proleptic Gregorian Calendar. This can represent:

4185

#

4186

# * A full date, with non-zero year, month and day values

4187

# * A month and day value, with a zero year, e.g. an anniversary

4188

# * A year on its own, with zero month and day values

4189

# * A year and month value, with a zero day, e.g. a credit card expiration date

4190

#

4191

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4192

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4193

# a year.

4194

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4195

# month and day.

4196

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4197

# if specifying a year by itself or a year and month where the day is not

4198

# significant.

4199

},

4200

"stringValue": "A String", # string

4201

"integerValue": "A String", # integer

4202

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4203

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4204

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4205

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4206

# to allow the value "24:00:00" for scenarios like business closing time.

4207

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4208

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4209

# allow the value 60 if it allows leap-seconds.

4210

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4211

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4212

"booleanValue": True or False, # boolean

4213

"floatValue": 3.14, # float

4214

"dayOfWeekValue": "A String", # day of week

4215

},

4216

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

4217

# used.

4218

# Note that for the purposes of inspection or transformation, the number

4219

# of bytes considered to comprise a 'Value' is based on its representation

4220

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4221

# 123456789, the number of bytes would be counted as 9, even though an

4222

# int64 only holds up to 8 bytes of data.

4223

"timestampValue": "A String", # timestamp

4224

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4225

# and time zone are either specified elsewhere or are not significant. The date

4226

# is relative to the Proleptic Gregorian Calendar. This can represent:

4227

#

4228

# * A full date, with non-zero year, month and day values

4229

# * A month and day value, with a zero year, e.g. an anniversary

4230

# * A year on its own, with zero month and day values

4231

# * A year and month value, with a zero day, e.g. a credit card expiration date

4232

#

4233

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4234

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4235

# a year.

4236

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4237

# month and day.

4238

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4239

# if specifying a year by itself or a year and month where the day is not

4240

# significant.

4241

},

4242

"stringValue": "A String", # string

4243

"integerValue": "A String", # integer

4244

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4245

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4246

# types are google.type.Date and `google.protobuf.Timestamp`.

4247

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4248

# to allow the value "24:00:00" for scenarios like business closing time.

4249

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4250

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4251

# allow the value 60 if it allows leap-seconds.

4252

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4253

},

4254

"booleanValue": True or False, # boolean

4255

"floatValue": 3.14, # float

4256

"dayOfWeekValue": "A String", # day of week

4257

},

4258

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

4259

# Note that for the purposes of inspection or transformation, the number

4260

# of bytes considered to comprise a 'Value' is based on its representation

4261

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4262

# 123456789, the number of bytes would be counted as 9, even though an

4263

# int64 only holds up to 8 bytes of data.

4264

"timestampValue": "A String", # timestamp

4265

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4266

# and time zone are either specified elsewhere or are not significant. The date

4267

# is relative to the Proleptic Gregorian Calendar. This can represent:

4268

#

4269

# * A full date, with non-zero year, month and day values

4270

# * A month and day value, with a zero year, e.g. an anniversary

4271

# * A year on its own, with zero month and day values

4272

# * A year and month value, with a zero day, e.g. a credit card expiration date

4273

#

4274

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4275

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4276

# a year.

4277

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4278

# month and day.

4279

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4280

# if specifying a year by itself or a year and month where the day is not

4281

# significant.

4282

},

4283

"stringValue": "A String", # string

4284

"integerValue": "A String", # integer

4285

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4286

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4287

# types are google.type.Date and `google.protobuf.Timestamp`.

4288

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4289

# to allow the value "24:00:00" for scenarios like business closing time.

4290

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4291

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4292

# allow the value 60 if it allows leap-seconds.

4293

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4294

},

4295

"booleanValue": True or False, # boolean

4296

"floatValue": 3.14, # float

4297

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4302

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

4303

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

4304

# output would be 'My phone number is '.

4305

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4306

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

4307

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

4308

# Note that for the purposes of inspection or transformation, the number

4309

# of bytes considered to comprise a 'Value' is based on its representation

4310

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4311

# 123456789, the number of bytes would be counted as 9, even though an

4312

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4313

"timestampValue": "A String", # timestamp

4314

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4315

# and time zone are either specified elsewhere or are not significant. The date

4316

# is relative to the Proleptic Gregorian Calendar. This can represent:

4317

#

4318

# * A full date, with non-zero year, month and day values

4319

# * A month and day value, with a zero year, e.g. an anniversary

4320

# * A year on its own, with zero month and day values

4321

# * A year and month value, with a zero day, e.g. a credit card expiration date

4322

#

4323

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4324

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4325

# a year.

4326

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4327

# month and day.

4328

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4329

# if specifying a year by itself or a year and month where the day is not

4330

# significant.

4331

},

4332

"stringValue": "A String", # string

4333

"integerValue": "A String", # integer

4334

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4335

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4336

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4337

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4338

# to allow the value "24:00:00" for scenarios like business closing time.

4339

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4340

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4341

# allow the value 60 if it allows leap-seconds.

4342

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4343

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4344

"booleanValue": True or False, # boolean

4345

"floatValue": 3.14, # float

4346

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4347

},

4348

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4349

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

4350

# Bucketing transformation can provide all of this functionality,

4351

# but requires more configuration. This message is provided as a convenience to

4352

# the user for simple bucketing strategies.

4353

#

4354

# The transformed value will be a hyphenated string of

4355

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

4356

# all values that are within this bucket will be replaced with "10-20".

4357

#

4358

# This can be used on data of type: double, long.

4359

#

4360

# If the bound Value type differs from the type of data

4361

# being transformed, we will first attempt converting the type of the data to

4362

# be transformed to match the type of the bound before comparing.

4363

#

4364

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4365

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

4366

# grouped together into a single bucket; for example if `upper_bound` = 89,

4367

# then all values greater than 89 are replaced with the value "89+".

4368

# Note that for the purposes of inspection or transformation, the number

4369

# of bytes considered to comprise a 'Value' is based on its representation

4370

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4371

# 123456789, the number of bytes would be counted as 9, even though an

4372

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4373

"timestampValue": "A String", # timestamp

4374

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4375

# and time zone are either specified elsewhere or are not significant. The date

4376

# is relative to the Proleptic Gregorian Calendar. This can represent:

4377

#

4378

# * A full date, with non-zero year, month and day values

4379

# * A month and day value, with a zero year, e.g. an anniversary

4380

# * A year on its own, with zero month and day values

4381

# * A year and month value, with a zero day, e.g. a credit card expiration date

4382

#

4383

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4384

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4385

# a year.

4386

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4387

# month and day.

4388

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4389

# if specifying a year by itself or a year and month where the day is not

4390

# significant.

4391

},

4392

"stringValue": "A String", # string

4393

"integerValue": "A String", # integer

4394

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4395

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4396

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4397

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4398

# to allow the value "24:00:00" for scenarios like business closing time.

4399

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4400

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4401

# allow the value 60 if it allows leap-seconds.

4402

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4403

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4404

"booleanValue": True or False, # boolean

4405

"floatValue": 3.14, # float

4406

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4407

},

4408

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

4409

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

4410

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

4411

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4412

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

4413

# grouped together into a single bucket; for example if `lower_bound` = 10,

4414

# then all values less than 10 are replaced with the value "-10".

4415

# Note that for the purposes of inspection or transformation, the number

4416

# of bytes considered to comprise a 'Value' is based on its representation

4417

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4418

# 123456789, the number of bytes would be counted as 9, even though an

4419

# int64 only holds up to 8 bytes of data.

4420

"timestampValue": "A String", # timestamp

4421

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4422

# and time zone are either specified elsewhere or are not significant. The date

4423

# is relative to the Proleptic Gregorian Calendar. This can represent:

4424

#

4425

# * A full date, with non-zero year, month and day values

4426

# * A month and day value, with a zero year, e.g. an anniversary

4427

# * A year on its own, with zero month and day values

4428

# * A year and month value, with a zero day, e.g. a credit card expiration date

4429

#

4430

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4431

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4432

# a year.

4433

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4434

# month and day.

4435

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4436

# if specifying a year by itself or a year and month where the day is not

4437

# significant.

4438

},

4439

"stringValue": "A String", # string

4440

"integerValue": "A String", # integer

4441

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4442

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4443

# types are google.type.Date and `google.protobuf.Timestamp`.

4444

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4445

# to allow the value "24:00:00" for scenarios like business closing time.

4446

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4447

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4448

# allow the value 60 if it allows leap-seconds.

4449

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4450

},

4451

"booleanValue": True or False, # boolean

4452

"floatValue": 3.14, # float

4453

"dayOfWeekValue": "A String", # day of week

4454

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4455

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4456

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

4457

# fixed character. Masking can start from the beginning or end of the string.

4458

# This can be used on data of any type (numbers, longs, and so on) and when

4459

# de-identifying structured data we'll attempt to preserve the original data's

4460

# type. (This allows you to take a long like 123 and modify it to a string like

4461

# **3.

4462

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

4463

# characters. For example, if the input string is `555-555-5555` and you

4464

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

4465

# returns `***-**5-5555`.

4466

{ # Characters to skip when doing deidentification of a value. These will be left

4467

# alone and skipped.

4468

"charactersToSkip": "A String", # Characters to not transform when masking.

4469

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

4474

# masked. Skipped characters do not count towards this tally.

4475

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

4476

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

4477

# code or credit card number. This string must have a length of 1. If not

4478

# supplied, this value defaults to `*` for strings, and `0` for digits.

4479

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

4480

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

4481

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

4482

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

4483

# is `true`, then the string `12345` is masked as `12***`.

4484

},

4485

},

4486

"field": { # General identifier of a data field in a storage service. # Set if the transformation was limited to a specific FieldId.

4487

"name": "A String", # Name describing the field.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4488

},

4489

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

4490

"recordSuppress": { # Configuration to suppress records whose suppression conditions evaluate to # The specific suppression option these stats apply to.

4491

# true.

4492

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

4493

# evaluated to be suppressed from the transformed content.

4494

# a field.

4495

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

4496

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

4497

# only supported value is `AND`.

4498

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

4499

"conditions": [ # A collection of conditions.

4500

{ # The field type of `value` and `field` do not need to match to be

4501

# considered equal, but not all comparisons are possible.

4502

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

4503

# but all other comparisons are invalid with incompatible types.

4504

# A `value` of type:

4505

#

4506

# - `string` can be compared against all other types

4507

# - `boolean` can only be compared against other booleans

4508

# - `integer` can be compared against doubles or a string if the string value

4509

# can be parsed as an integer.

4510

# - `double` can be compared against integers or a string if the string can

4511

# be parsed as a double.

4512

# - `Timestamp` can be compared against strings in RFC 3339 date string

4513

# format.

4514

# - `TimeOfDay` can be compared against timestamps and strings in the format

4515

# of 'HH:mm:ss'.

4516

#

4517

# If we fail to compare do to type mismatch, a warning will be given and

4518

# the condition will evaluate to false.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4519

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

4520

# Note that for the purposes of inspection or transformation, the number

4521

# of bytes considered to comprise a 'Value' is based on its representation

4522

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4523

# 123456789, the number of bytes would be counted as 9, even though an

4524

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4525

"timestampValue": "A String", # timestamp

4526

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4527

# and time zone are either specified elsewhere or are not significant. The date

4528

# is relative to the Proleptic Gregorian Calendar. This can represent:

4529

#

4530

# * A full date, with non-zero year, month and day values

4531

# * A month and day value, with a zero year, e.g. an anniversary

4532

# * A year on its own, with zero month and day values

4533

# * A year and month value, with a zero day, e.g. a credit card expiration date

4534

#

4535

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4536

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4537

# a year.

4538

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4539

# month and day.

4540

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4541

# if specifying a year by itself or a year and month where the day is not

4542

# significant.

4543

},

4544

"stringValue": "A String", # string

4545

"integerValue": "A String", # integer

4546

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4547

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4548

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4549

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4550

# to allow the value "24:00:00" for scenarios like business closing time.

4551

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4552

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4553

# allow the value 60 if it allows leap-seconds.

4554

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4555

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4556

"booleanValue": True or False, # boolean

4557

"floatValue": 3.14, # float

4558

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4559

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4560

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

4561

"name": "A String", # Name describing the field.

4562

},

4563

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

},

},

"infoType": { # Type of information detected by the API. # Set if the transformation was limited to a specific InfoType.

4571

"name": "A String", # Name of the information type. Either a name of your choosing when

4572

# creating a CustomInfoType, or one of the names listed

4573

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4574

# a built-in type. InfoType names should conform to the pattern

4575

# `[a-zA-Z0-9_]{1,64}`.

4576

},

4577

"results": [ # Collection of all transformations that took place or had an error.

4578

{ # A collection that informs the user the number of times a particular

4579

# `TransformationResultCode` and error details occurred.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4580

"details": "A String", # A place for warnings or errors to show up if a transformation didn't

4581

# work as expected.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4582

"code": "A String", # Outcome of the transformation.

4583

"count": "A String", # Number of transformations counted by this result.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

],

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

4589

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4590

"item": { # Container structure for the content to inspect. # The de-identified item.

4591

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

4592

"data": "A String", # Content data to inspect or redact.

4593

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

4594

},

4595

"value": "A String", # String data to inspect or redact.

4596

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

4597

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

4598

# learn more.

4599

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

4600

# learn more.

4601

"rows": [ # Rows of the table.

4602

{ # Values of the row.

4603

"values": [ # Individual cells.

4604

{ # Set of primitive values supported by the system.

4605

# Note that for the purposes of inspection or transformation, the number

4606

# of bytes considered to comprise a 'Value' is based on its representation

4607

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4608

# 123456789, the number of bytes would be counted as 9, even though an

4609

# int64 only holds up to 8 bytes of data.

4610

"timestampValue": "A String", # timestamp

4611

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4612

# and time zone are either specified elsewhere or are not significant. The date

4613

# is relative to the Proleptic Gregorian Calendar. This can represent:

4614

#

4615

# * A full date, with non-zero year, month and day values

4616

# * A month and day value, with a zero year, e.g. an anniversary

4617

# * A year on its own, with zero month and day values

4618

# * A year and month value, with a zero day, e.g. a credit card expiration date

4619

#

4620

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4621

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4622

# a year.

4623

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4624

# month and day.

4625

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4626

# if specifying a year by itself or a year and month where the day is not

4627

# significant.

4628

},

4629

"stringValue": "A String", # string

4630

"integerValue": "A String", # integer

4631

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4632

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4633

# types are google.type.Date and `google.protobuf.Timestamp`.

4634

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4635

# to allow the value "24:00:00" for scenarios like business closing time.

4636

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4637

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4638

# allow the value 60 if it allows leap-seconds.

4639

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4640

},

4641

"booleanValue": True or False, # boolean

4642

"floatValue": 3.14, # float

4643

"dayOfWeekValue": "A String", # day of week

},

],

},

],

"headers": [ # Headers of the table.

4649

{ # General identifier of a data field in a storage service.

4650

"name": "A String", # Name describing the field.

},

],

},

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="inspect">inspect(parent, locationId, body=None, x__xgafv=None)</code>

4660

<pre>Finds potentially sensitive info in content.

4661

This method has limits on input size, processing time, and output size.

4662

4663

When no InfoTypes or CustomInfoTypes are specified in this request, the

4664

system will automatically choose what detectors to run. By default this may

4665

be all types, but may change over time as detectors are updated.

4666

4667

For how to guides, see https://cloud.google.com/dlp/docs/inspecting-images

4668

and https://cloud.google.com/dlp/docs/inspecting-text,

4669

4670

Args:

4671

parent: string, The parent resource name, for example projects/my-project-id. (required)

4672

locationId: string, The geographic location to process content inspection. Reserved for future

4673

extensions.

4674

When inspecting images location is restricted to 'global', 'us', 'asia',

4675

and 'europe'. (required)

4676

body: object, The request body.

4677

The object takes the form of:

4678

4679

{ # Request to search for potentially sensitive info in a ContentItem.

4680

"item": { # Container structure for the content to inspect. # The item to inspect.

4681

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4682

"data": "A String", # Content data to inspect or redact.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4683

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4684

},

4685

"value": "A String", # String data to inspect or redact.

4686

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

4687

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

4688

# learn more.

4689

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

4690

# learn more.

4691

"rows": [ # Rows of the table.

4692

{ # Values of the row.

4693

"values": [ # Individual cells.

4694

{ # Set of primitive values supported by the system.

4695

# Note that for the purposes of inspection or transformation, the number

4696

# of bytes considered to comprise a 'Value' is based on its representation

4697

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4698

# 123456789, the number of bytes would be counted as 9, even though an

4699

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4700

"timestampValue": "A String", # timestamp

4701

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4702

# and time zone are either specified elsewhere or are not significant. The date

4703

# is relative to the Proleptic Gregorian Calendar. This can represent:

4704

#

4705

# * A full date, with non-zero year, month and day values

4706

# * A month and day value, with a zero year, e.g. an anniversary

4707

# * A year on its own, with zero month and day values

4708

# * A year and month value, with a zero day, e.g. a credit card expiration date

4709

#

4710

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4711

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4712

# a year.

4713

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4714

# month and day.

4715

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4716

# if specifying a year by itself or a year and month where the day is not

4717

# significant.

4718

},

4719

"stringValue": "A String", # string

4720

"integerValue": "A String", # integer

4721

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4722

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4723

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4724

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4725

# to allow the value "24:00:00" for scenarios like business closing time.

4726

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4727

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4728

# allow the value 60 if it allows leap-seconds.

4729

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4730

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4731

"booleanValue": True or False, # boolean

4732

"floatValue": 3.14, # float

4733

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

],

"headers": [ # Headers of the table.

4739

{ # General identifier of a data field in a storage service.

4740

"name": "A String", # Name describing the field.

},

],

},

},

"inspectTemplateName": "A String", # Template to use. Any configuration directly specified in

4746

# inspect_config will override those set in the template. Singular fields

4747

# that are set in this request will replace their corresponding fields in the

4748

# template. Repeated fields are appended. Singular sub-messages and groups

4749

# are recursively merged.

4750

"inspectConfig": { # Configuration description of the scanning process. # Configuration for the inspector. What specified here will override

4751

# the template referenced by the inspect_template_name argument.

4752

# When used with redactContent only info_types and min_likelihood are currently

4753

# used.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

4754

"minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is

4755

# POSSIBLE.

4756

# See https://cloud.google.com/dlp/docs/likelihood to learn more.

4757

"contentOptions": [ # List of options defining data content to scan.

4758

# If empty, text, images, and other content will be included.

4759

"A String",

4760

],

4761

"infoTypes": [ # Restricts what info_types to look for. The values must correspond to

4762

# InfoType values returned by ListInfoTypes or listed at

4763

# https://cloud.google.com/dlp/docs/infotypes-reference.

4764

#

4765

# When no InfoTypes or CustomInfoTypes are specified in a request, the

4766

# system may automatically choose what detectors to run. By default this may

4767

# be all types, but may change over time as detectors are updated.

4768

#

4769

# If you need precise control and predictability as to what detectors are

4770

# run you should specify specific InfoTypes listed in the reference,

4771

# otherwise a default list will be used, which may change over time.

4772

{ # Type of information detected by the API.

4773

"name": "A String", # Name of the information type. Either a name of your choosing when

4774

# creating a CustomInfoType, or one of the names listed

4775

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4776

# a built-in type. InfoType names should conform to the pattern

4777

# `[a-zA-Z0-9_]{1,64}`.

4778

},

4779

],

4780

"excludeInfoTypes": True or False, # When true, excludes type information of the findings.

4781

"customInfoTypes": [ # CustomInfoTypes provided by the user. See

4782

# https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

4783

{ # Custom information type provided by the user. Used to find domain-specific

4784

# sensitive information configurable to the data in question.

4785

"surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that

4786

# support reversing.

4787

# such as

4788

# [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).

4789

# These types of transformations are

4790

# those that perform pseudonymization, thereby producing a "surrogate" as

4791

# output. This should be used in conjunction with a field on the

4792

# transformation such as `surrogate_info_type`. This CustomInfoType does

4793

# not support the use of `detection_rules`.

4794

},

4795

"likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be

4796

# altered by a detection rule if the finding meets the criteria specified by

4797

# the rule. Defaults to `VERY_LIKELY` if not specified.

4798

"infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in

4799

# infoType, when the name matches one of existing infoTypes and that infoType

4800

# is specified in `InspectContent.info_types` field. Specifying the latter

4801

# adds findings to the one detected by the system. If built-in info type is

4802

# not specified in `InspectContent.info_types` list then the name is treated

4803

# as a custom info type.

4804

"name": "A String", # Name of the information type. Either a name of your choosing when

4805

# creating a CustomInfoType, or one of the names listed

4806

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4807

# a built-in type. InfoType names should conform to the pattern

4808

# `[a-zA-Z0-9_]{1,64}`.

4809

},

4810

"regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.

4811

"groupIndexes": [ # The index of the submatch to extract as findings. When not

4812

# specified, the entire match is returned. No more than 3 may be included.

4813

42,

4814

],

4815

"pattern": "A String", # Pattern defining the regular expression. Its syntax

4816

# (https://github.com/google/re2/wiki/Syntax) can be found under the

4817

# google/re2 repository on GitHub.

4818

},

4819

"detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.

4820

# Rules are applied in order that they are specified. Not supported for the

4821

# `surrogate_type` CustomInfoType.

4822

{ # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a

4823

# `CustomInfoType` to alter behavior under certain circumstances, depending

4824

# on the specific details of the rule. Not supported for the `surrogate_type`

4825

# custom infoType.

4826

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

4827

# proximity of hotwords.

4828

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

4829

# part of a detection rule.

4830

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

4831

# levels. For example, if a finding would be `POSSIBLE` without the

4832

# detection rule and `relative_likelihood` is 1, then it is upgraded to

4833

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

4834

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

4835

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

4836

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

4837

# a final likelihood of `LIKELY`.

4838

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

4839

},

4840

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

4841

"groupIndexes": [ # The index of the submatch to extract as findings. When not

4842

# specified, the entire match is returned. No more than 3 may be included.

4843

42,

4844

],

4845

"pattern": "A String", # Pattern defining the regular expression. Its syntax

4846

# (https://github.com/google/re2/wiki/Syntax) can be found under the

4847

# google/re2 repository on GitHub.

4848

},

4849

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

4850

# The total length of the window cannot exceed 1000 characters. Note that

4851

# the finding itself will be included in the window, so that hotwords may

4852

# be used to match substrings of the finding itself. For example, the

4853

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

4854

# adjusted upwards if the area code is known to be the local area code of

4855

# a company office using the hotword regex "\(xxx\)", where "xxx"

4856

# is the area code in question.

4857

# rule.

4858

"windowBefore": 42, # Number of characters before the finding to consider.

4859

"windowAfter": 42, # Number of characters after the finding to consider.

},

},

},

],

"exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding

4865

# to be returned. It still can be used for rules matching.

4866

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.

4867

# be used to match sensitive information specific to the data, such as a list

4868

# of employee IDs or job titles.

4869

#

4870

# Dictionary words are case-insensitive and all characters other than letters

4871

# and digits in the unicode [Basic Multilingual

4872

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

4873

# will be replaced with whitespace when scanning for matches, so the

4874

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

4875

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

4876

# surrounding any match must be of a different type than the adjacent

4877

# characters within the word, so letters must be next to non-letters and

4878

# digits next to non-digits. For example, the dictionary word "jen" will

4879

# match the first three letters of the text "jen123" but will return no

4880

# matches for "jennifer".

4881

#

4882

# Dictionary words containing a large number of characters that are not

4883

# letters or digits may result in unexpected findings because such characters

4884

# are treated as whitespace. The

4885

# [limits](https://cloud.google.com/dlp/limits) page contains details about

4886

# the size limits of dictionaries. For dictionaries that do not fit within

4887

# these constraints, consider using `LargeCustomDictionaryConfig` in the

4888

# `StoredInfoType` API.

4889

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

4890

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

4891

# at least one phrase and every phrase must contain at least 2 characters

4892

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

4897

# is accepted.

4898

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

4899

# Example: gs://[BUCKET_NAME]/dictionary.txt

4900

},

4901

},

4902

"storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in

4903

# `InspectDataSource`. Not currently supported in `InspectContent`.

4904

"name": "A String", # Resource name of the requested `StoredInfoType`, for example

4905

# `organizations/433245324/storedInfoTypes/432452342` or

4906

# `projects/project-id/storedInfoTypes/432452342`.

4907

"createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for

4908

# inspection was created. Output-only field, populated by the system.

4909

},

4910

},

4911

],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

4912

"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is

4913

# included in the response; see Finding.quote.

4914

"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig.

4915

# Exclusion rules, contained in the set are executed in the end, other

4916

# rules are executed in the order they are specified for each info type.

4917

{ # Rule set for modifying a set of infoTypes to alter behavior under certain

4918

# circumstances, depending on the specific details of the rules within the set.

4919

"infoTypes": [ # List of infoTypes this rule set is applied to.

4920

{ # Type of information detected by the API.

4921

"name": "A String", # Name of the information type. Either a name of your choosing when

4922

# creating a CustomInfoType, or one of the names listed

4923

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4924

# a built-in type. InfoType names should conform to the pattern

4925

# `[a-zA-Z0-9_]{1,64}`.

4926

},

4927

],

4928

"rules": [ # Set of rules to be applied to infoTypes. The rules are applied in order.

4929

{ # A single inspection rule to be applied to infoTypes, specified in

4930

# `InspectionRuleSet`.

4931

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

4932

# proximity of hotwords.

4933

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

4934

# part of a detection rule.

4935

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

4936

# levels. For example, if a finding would be `POSSIBLE` without the

4937

# detection rule and `relative_likelihood` is 1, then it is upgraded to

4938

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

4939

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

4940

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

4941

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

4942

# a final likelihood of `LIKELY`.

4943

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

4944

},

4945

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

4946

"groupIndexes": [ # The index of the submatch to extract as findings. When not

4947

# specified, the entire match is returned. No more than 3 may be included.

4948

42,

4949

],

4950

"pattern": "A String", # Pattern defining the regular expression. Its syntax

4951

# (https://github.com/google/re2/wiki/Syntax) can be found under the

4952

# google/re2 repository on GitHub.

4953

},

4954

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

4955

# The total length of the window cannot exceed 1000 characters. Note that

4956

# the finding itself will be included in the window, so that hotwords may

4957

# be used to match substrings of the finding itself. For example, the

4958

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

4959

# adjusted upwards if the area code is known to be the local area code of

4960

# a company office using the hotword regex "\(xxx\)", where "xxx"

4961

# is the area code in question.

4962

# rule.

4963

"windowBefore": 42, # Number of characters before the finding to consider.

4964

"windowAfter": 42, # Number of characters after the finding to consider.

4965

},

4966

},

4967

"exclusionRule": { # The rule that specifies conditions when findings of infoTypes specified in # Exclusion rule.

4968

# `InspectionRuleSet` are removed from results.

4969

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # Dictionary which defines the rule.

4970

# be used to match sensitive information specific to the data, such as a list

4971

# of employee IDs or job titles.

4972

#

4973

# Dictionary words are case-insensitive and all characters other than letters

4974

# and digits in the unicode [Basic Multilingual

4975

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

4976

# will be replaced with whitespace when scanning for matches, so the

4977

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

4978

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

4979

# surrounding any match must be of a different type than the adjacent

4980

# characters within the word, so letters must be next to non-letters and

4981

# digits next to non-digits. For example, the dictionary word "jen" will

4982

# match the first three letters of the text "jen123" but will return no

4983

# matches for "jennifer".

4984

#

4985

# Dictionary words containing a large number of characters that are not

4986

# letters or digits may result in unexpected findings because such characters

4987

# are treated as whitespace. The

4988

# [limits](https://cloud.google.com/dlp/limits) page contains details about

4989

# the size limits of dictionaries. For dictionaries that do not fit within

4990

# these constraints, consider using `LargeCustomDictionaryConfig` in the

4991

# `StoredInfoType` API.

4992

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

4993

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

4994

# at least one phrase and every phrase must contain at least 2 characters

4995

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

5000

# is accepted.

5001

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

5002

# Example: gs://[BUCKET_NAME]/dictionary.txt

5003

},

5004

},

5005

"regex": { # Message defining a custom regular expression. # Regular expression which defines the rule.

5006

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5007

# specified, the entire match is returned. No more than 3 may be included.

5008

42,

5009

],

5010

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5011

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5012

# google/re2 repository on GitHub.

5013

},

5014

"excludeInfoTypes": { # List of exclude infoTypes. # Set of infoTypes for which findings would affect this rule.

5015

"infoTypes": [ # InfoType list in ExclusionRule rule drops a finding when it overlaps or

5016

# contained within with a finding of an infoType from this list. For

5017

# example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and

5018

# `exclusion_rule` containing `exclude_info_types.info_types` with

5019

# "EMAIL_ADDRESS" the phone number findings are dropped if they overlap

5020

# with EMAIL_ADDRESS finding.

5021

# That leads to "555-222-2222@example.org" to generate only a single

5022

# finding, namely email address.

5023

{ # Type of information detected by the API.

5024

"name": "A String", # Name of the information type. Either a name of your choosing when

5025

# creating a CustomInfoType, or one of the names listed

5026

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5027

# a built-in type. InfoType names should conform to the pattern

5028

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

"matchingType": "A String", # How the rule is applied, see MatchingType documentation for details.

},

},

],

},

],

"limits": { # Configuration to control the number of findings returned. # Configuration to control the number of findings returned.

5039

"maxFindingsPerItem": 42, # Max number of findings that will be returned for each item scanned.

5040

# When set within `InspectJobConfig`,

5041

# the maximum returned is 2000 regardless if this is set higher.

5042

# When set within `InspectContentRequest`, this field is ignored.

5043

"maxFindingsPerInfoType": [ # Configuration of findings limit given for specified infoTypes.

5044

{ # Max findings configuration per infoType, per content item or long

5045

# running DlpJob.

5046

"maxFindings": 42, # Max findings limit for the given infoType.

5047

"infoType": { # Type of information detected by the API. # Type of information the findings limit applies to. Only one limit per

5048

# info_type should be provided. If InfoTypeLimit does not have an

5049

# info_type, the DLP API applies the limit against all info_types that

5050

# are found but not specified in another InfoTypeLimit.

5051

"name": "A String", # Name of the information type. Either a name of your choosing when

5052

# creating a CustomInfoType, or one of the names listed

5053

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5054

# a built-in type. InfoType names should conform to the pattern

5055

# `[a-zA-Z0-9_]{1,64}`.

},

},

],

"maxFindingsPerRequest": 42, # Max number of findings that will be returned per request/job.

5060

# When set within `InspectContentRequest`, the maximum returned is 2000

5061

# regardless if this is set higher.

5062

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5063

},

5064

"locationId": "A String", # The geographic location to process content inspection. Reserved for future

5065

# extensions.

5066

# When inspecting images location is restricted to 'global', 'us', 'asia',

# and 'europe'.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

5077

5078

{ # Results of inspecting an item.

5079

"result": { # All the findings for a single scanned item. # The findings.

5080

"findings": [ # List of findings for an item.

5081

{ # Represents a piece of potentially sensitive content.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5082

"quoteInfo": { # Message for infoType-dependent details parsed from quote. # Contains data parsed from quotes. Only populated if include_quote was set

5083

# to true and a supported infoType was requested. Currently supported

5084

# infoTypes: DATE, DATE_OF_BIRTH and TIME.

5085

"dateTime": { # Message for a date time object. # The date time indicated by the quote.

5086

# e.g. 2018-01-01, 5th August.

5087

"date": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # One or more of the following must be set.

5088

# Must be a valid date or time value.

5089

# and time zone are either specified elsewhere or are not significant. The date

5090

# is relative to the Proleptic Gregorian Calendar. This can represent:

5091

#

5092

# * A full date, with non-zero year, month and day values

5093

# * A month and day value, with a zero year, e.g. an anniversary

5094

# * A year on its own, with zero month and day values

5095

# * A year and month value, with a zero day, e.g. a credit card expiration date

5096

#

5097

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

5098

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5099

# a year.

5100

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5101

# month and day.

5102

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5103

# if specifying a year by itself or a year and month where the day is not

5104

# significant.

5105

},

5106

"timeZone": { # Time zone of the date time object. # Time zone

5107

"offsetMinutes": 42, # Set only if the offset can be determined. Positive for time ahead of UTC.

5108

# E.g. For "UTC-9", this value is -540.

5109

},

5110

"dayOfWeek": "A String", # Day of week

5111

"time": { # Represents a time of day. The date and time zone are either not significant # Time of day

5112

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5113

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5114

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5115

# to allow the value "24:00:00" for scenarios like business closing time.

5116

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

5117

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5118

# allow the value 60 if it allows leap-seconds.

5119

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5120

},

5121

},

5122

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

5123

"infoType": { # Type of information detected by the API. # The type of content that might have been found.

5124

# Provided if `excluded_types` is false.

5125

"name": "A String", # Name of the information type. Either a name of your choosing when

5126

# creating a CustomInfoType, or one of the names listed

5127

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5128

# a built-in type. InfoType names should conform to the pattern

5129

# `[a-zA-Z0-9_]{1,64}`.

5130

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5131

"labels": { # The labels associated with this `Finding`.

5132

#

5133

# Label keys must be between 1 and 63 characters long and must conform

5134

# to the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?`.

5135

#

5136

# Label values must be between 0 and 63 characters long and must conform

5137

# to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`.

5138

#

5139

# No more than 10 labels can be associated with a given finding.

5140

#

5141

# Examples:

5142

# * `"environment" : "production"`

5143

# * `"pipeline" : "etl"`

5144

"a_key": "A String",

5145

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5146

"likelihood": "A String", # Confidence of how likely it is that the `info_type` is correct.

5147

"name": "A String", # Resource name in format

5148

# projects/{project}/locations/{location}/findings/{finding} Populated only

5149

# when viewing persisted findings.

5150

"location": { # Specifies the location of the finding. # Where the content was found.

5151

"codepointRange": { # Generic half-open interval [start, end) # Unicode character offsets delimiting the finding.

5152

# These are relative to the finding's containing element.

5153

# Provided when the content is text.

5154

"start": "A String", # Index of the first character of the range (inclusive).

5155

"end": "A String", # Index of the last character of the range (exclusive).

5156

},

5157

"byteRange": { # Generic half-open interval [start, end) # Zero-based byte offsets delimiting the finding.

5158

# These are relative to the finding's containing element.

5159

# Note that when the content is not textual, this references

5160

# the UTF-8 encoded textual representation of the content.

5161

# Omitted if content is an image.

5162

"start": "A String", # Index of the first character of the range (inclusive).

5163

"end": "A String", # Index of the last character of the range (exclusive).

5164

},

5165

"container": { # Represents a container that may contain DLP findings. # Information about the container where this finding occurred, if available.

5166

# Examples of a container include a file, table, or database record.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5167

"updateTime": "A String", # Findings container modification timestamp, if applicable.

5168

# For Google Cloud Storage contains last file modification timestamp.

5169

# For BigQuery table contains last_modified_time property.

5170

# For Datastore - not populated.

5171

"rootPath": "A String", # The root of the container.

5172

# Examples:

5173

# - For BigQuery table `project_id:dataset_id.table_id`, the root is

5174

# `dataset_id`

5175

# - For Google Cloud Storage file `gs://bucket/folder/filename.txt`, the root

5176

# is `gs://bucket`

5177

"projectId": "A String", # Project where the finding was found.

5178

# Can be different from the project that owns the finding.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

5179

"version": "A String", # Findings container version, if available

5180

# ("generation" for Google Cloud Storage).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5181

"relativePath": "A String", # The rest of the path after the root.

5182

# Examples:

5183

# - For BigQuery table `project_id:dataset_id.table_id`, the relative path is

5184

# `table_id`

5185

# - Google Cloud Storage file `gs://bucket/folder/filename.txt`, the relative

5186

# path is `folder/filename.txt`

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

5187

"fullPath": "A String", # A string representation of the full container name.

5188

# Examples:

5189

# - BigQuery: 'Project:DataSetId.TableId'

5190

# - Google Cloud Storage: 'gs://Bucket/folders/filename.txt'

5191

"type": "A String", # Container type, for example BigQuery or Google Cloud Storage.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5192

},

5193

"contentLocations": [ # List of nested objects pointing to the precise location of the finding

5194

# within the file or record.

5195

{ # Precise location of the finding within a document, record, image, or metadata

5196

# container.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

5197

"containerVersion": "A String", # Findings container version, if available

5198

# ("generation" for Google Cloud Storage).

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5199

"containerName": "A String", # Name of the container where the finding is located.

5200

# The top level name is the source file name or table name. Names of some

5201

# common storage containers are formatted as follows:

5202

#

5203

# * BigQuery tables: `{project_id}:{dataset_id}.{table_id}`

5204

# * Cloud Storage files: `gs://{bucket}/{path}`

5205

# * Datastore namespace: {namespace}

5206

#

5207

# Nested names could be absent if the embedded object has no string

5208

# identifier (for an example an image contained within a document).

5209

"documentLocation": { # Location of a finding within a document. # Location data for document files.

5210

"fileOffset": "A String", # Offset of the line, from the beginning of the file, where the finding

5211

# is located.

5212

},

5213

"recordLocation": { # Location of a finding within a row or record. # Location within a row or record of a database table.

5214

"fieldId": { # General identifier of a data field in a storage service. # Field id of the field containing the finding.

5215

"name": "A String", # Name describing the field.

5216

},

5217

"tableLocation": { # Location of a finding within a table. # Location within a `ContentItem.Table`.

5218

"rowIndex": "A String", # The zero-based index of the row where the finding is located. Only

5219

# populated for resources that have a natural ordering, not BigQuery. In

5220

# BigQuery, to identify the row a finding came from, populate

5221

# BigQueryOptions.identifying_fields with your primary key column names and

5222

# when you store the findings the value of those columns will be stored

5223

# inside of Finding.

5224

},

5225

"recordKey": { # Message for a unique key indicating a record that contains a finding. # Key of the finding.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5226

"datastoreKey": { # Record key for a finding in Cloud Datastore.

5227

"entityKey": { # A unique identifier for a Datastore entity. # Datastore entity key.

5228

# If a key's partition ID or any of its path kinds or names are

5229

# reserved/read-only, the key is reserved/read-only.

5230

# A reserved/read-only key is forbidden in certain documented contexts.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

5231

"partitionId": { # Datastore partition ID. # Entities are partitioned into subsets, currently identified by a project

5232

# ID and namespace ID.

5233

# Queries are scoped to a single partition.

5234

# A partition ID identifies a grouping of entities. The grouping is always

5235

# by project and namespace, however the namespace ID may be empty.

5236

#

5237

# A partition ID contains several dimensions:

5238

# project ID and namespace ID.

5239

"projectId": "A String", # The ID of the project to which the entities belong.

5240

"namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.

5241

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5242

"path": [ # The entity path.

5243

# An entity path consists of one or more elements composed of a kind and a

5244

# string or numerical identifier, which identify entities. The first

5245

# element identifies a _root entity_, the second element identifies

5246

# a _child_ of the root entity, the third element identifies a child of the

5247

# second entity, and so forth. The entities identified by all prefixes of

5248

# the path are called the element's _ancestors_.

5249

#

5250

# A path can never be empty, and a path can have at most 100 elements.

5251

{ # A (kind, ID/name) pair used to construct a key path.

5252

#

5253

# If either name or ID is set, the element is complete.

5254

# If neither is set, the element is incomplete.

5255

"kind": "A String", # The kind of the entity.

5256

# A kind matching regex `__.*__` is reserved/read-only.

5257

# A kind must not contain more than 1500 bytes when UTF-8 encoded.

5258

# Cannot be `""`.

5259

"id": "A String", # The auto-allocated ID of the entity.

5260

# Never equal to zero. Values less than zero are discouraged and may not

5261

# be supported in the future.

5262

"name": "A String", # The name of the entity.

5263

# A name matching regex `__.*__` is reserved/read-only.

5264

# A name must not be more than 1500 bytes when UTF-8 encoded.

5265

# Cannot be `""`.

5266

},

5267

],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5268

},

5269

},

5270

"bigQueryKey": { # Row key for identifying a record in BigQuery table.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

5271

"rowNumber": "A String", # Row number inferred at the time the table was scanned. This value is

5272

# nondeterministic, cannot be queried, and may be null for inspection

5273

# jobs. To locate findings within a table, specify

5274

# `inspect_job.storage_config.big_query_options.identifying_fields` in

5275

# `CreateDlpJobRequest`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5276

"tableReference": { # Message defining the location of a BigQuery table. A table is uniquely # Complete BigQuery table reference.

5277

# identified by its project_id, dataset_id, and table_name. Within a query

5278

# a table is often referenced with a string in the format of:

5279

# `<project_id>:<dataset_id>.<table_id>` or

5280

# `<project_id>.<dataset_id>.<table_id>`.

5281

"projectId": "A String", # The Google Cloud Platform project ID of the project containing the table.

5282

# If omitted, project ID is inferred from the API call.

5283

"datasetId": "A String", # Dataset ID of the table.

5284

"tableId": "A String", # Name of the table.

5285

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5286

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

5287

"idValues": [ # Values of identifying columns in the given row. Order of values matches

5288

# the order of `identifying_fields` specified in the scanning request.

5289

"A String",

5290

],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5291

},

5292

},

5293

"containerTimestamp": "A String", # Findings container modification timestamp, if applicable.

5294

# For Google Cloud Storage contains last file modification timestamp.

5295

# For BigQuery table contains last_modified_time property.

5296

# For Datastore - not populated.

5297

"metadataLocation": { # Metadata Location # Location within the metadata for inspected content.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

5298

"type": "A String", # Type of metadata containing the finding.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5299

"storageLabel": { # Storage metadata label to indicate which metadata entry contains findings. # Storage metadata.

5300

"key": "A String",

5301

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5302

},

5303

"imageLocation": { # Location of the finding within an image. # Location within an image's pixels.

5304

"boundingBoxes": [ # Bounding boxes locating the pixels within the image containing the finding.

5305

{ # Bounding box encompassing detected text within an image.

5306

"top": 42, # Top coordinate of the bounding box. (0,0) is upper left.

5307

"width": 42, # Width of the bounding box in pixels.

5308

"height": 42, # Height of the bounding box in pixels.

5309

"left": 42, # Left coordinate of the bounding box. (0,0) is upper left.

5310

},

5311

],

5312

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

"quote": "A String", # The content that was found. Even if the content is not textual, it

5317

# may be converted to a textual representation here.

5318

# Provided if `include_quote` is true and the finding is

5319

# less than or equal to 4096 bytes long. If the finding exceeds 4096 bytes

5320

# in length, the quote may be omitted.

5321

"createTime": "A String", # Timestamp when finding was detected.

5322

"jobName": "A String", # The job that stored the finding.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

5323

"jobCreateTime": "A String", # Time the job started that produced this finding.

5324

"triggerName": "A String", # Job trigger name, if applicable, for this finding.

5325

"resourceName": "A String", # The job that stored the finding.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5326

},

5327

],

5328

"findingsTruncated": True or False, # If true, then this item might have more findings than were returned,

5329

# and the findings returned are an arbitrary subset of all findings.

5330

# The findings list might be truncated because the input items were too

5331

# large, or because the server reached the maximum amount of resources

5332

# allowed for a single API call. For best results, divide the input into

# smaller batches.

},

}</pre>

</div>

<code class="details" id="reidentify">reidentify(parent, locationId, body=None, x__xgafv=None)</code>

5340

<pre>Re-identifies content that has been de-identified.

5341

See

5342

https://cloud.google.com/dlp/docs/pseudonymization#re-identification_in_free_text_code_example

to learn more.

Args:

parent: string, Required. The parent resource name. (required)

5347

locationId: string, The geographic location to process content reidentification. Reserved for

5348

future extensions. (required)

5349

body: object, The request body.

5350

The object takes the form of:

5351

5352

{ # Request to re-identify an item.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5353

"inspectConfig": { # Configuration description of the scanning process. # Configuration for the inspector.

5354

# When used with redactContent only info_types and min_likelihood are currently

5355

# used.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

5356

"minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is

5357

# POSSIBLE.

5358

# See https://cloud.google.com/dlp/docs/likelihood to learn more.

5359

"contentOptions": [ # List of options defining data content to scan.

5360

# If empty, text, images, and other content will be included.

5361

"A String",

5362

],

5363

"infoTypes": [ # Restricts what info_types to look for. The values must correspond to

5364

# InfoType values returned by ListInfoTypes or listed at

5365

# https://cloud.google.com/dlp/docs/infotypes-reference.

5366

#

5367

# When no InfoTypes or CustomInfoTypes are specified in a request, the

5368

# system may automatically choose what detectors to run. By default this may

5369

# be all types, but may change over time as detectors are updated.

5370

#

5371

# If you need precise control and predictability as to what detectors are

5372

# run you should specify specific InfoTypes listed in the reference,

5373

# otherwise a default list will be used, which may change over time.

5374

{ # Type of information detected by the API.

5375

"name": "A String", # Name of the information type. Either a name of your choosing when

5376

# creating a CustomInfoType, or one of the names listed

5377

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5378

# a built-in type. InfoType names should conform to the pattern

5379

# `[a-zA-Z0-9_]{1,64}`.

5380

},

5381

],

5382

"excludeInfoTypes": True or False, # When true, excludes type information of the findings.

5383

"customInfoTypes": [ # CustomInfoTypes provided by the user. See

5384

# https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

5385

{ # Custom information type provided by the user. Used to find domain-specific

5386

# sensitive information configurable to the data in question.

5387

"surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that

5388

# support reversing.

5389

# such as

5390

# [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).

5391

# These types of transformations are

5392

# those that perform pseudonymization, thereby producing a "surrogate" as

5393

# output. This should be used in conjunction with a field on the

5394

# transformation such as `surrogate_info_type`. This CustomInfoType does

5395

# not support the use of `detection_rules`.

5396

},

5397

"likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be

5398

# altered by a detection rule if the finding meets the criteria specified by

5399

# the rule. Defaults to `VERY_LIKELY` if not specified.

5400

"infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in

5401

# infoType, when the name matches one of existing infoTypes and that infoType

5402

# is specified in `InspectContent.info_types` field. Specifying the latter

5403

# adds findings to the one detected by the system. If built-in info type is

5404

# not specified in `InspectContent.info_types` list then the name is treated

5405

# as a custom info type.

5406

"name": "A String", # Name of the information type. Either a name of your choosing when

5407

# creating a CustomInfoType, or one of the names listed

5408

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5409

# a built-in type. InfoType names should conform to the pattern

5410

# `[a-zA-Z0-9_]{1,64}`.

5411

},

5412

"regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.

5413

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5414

# specified, the entire match is returned. No more than 3 may be included.

5415

42,

5416

],

5417

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5418

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5419

# google/re2 repository on GitHub.

5420

},

5421

"detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.

5422

# Rules are applied in order that they are specified. Not supported for the

5423

# `surrogate_type` CustomInfoType.

5424

{ # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a

5425

# `CustomInfoType` to alter behavior under certain circumstances, depending

5426

# on the specific details of the rule. Not supported for the `surrogate_type`

5427

# custom infoType.

5428

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

5429

# proximity of hotwords.

5430

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

5431

# part of a detection rule.

5432

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

5433

# levels. For example, if a finding would be `POSSIBLE` without the

5434

# detection rule and `relative_likelihood` is 1, then it is upgraded to

5435

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

5436

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

5437

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

5438

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

5439

# a final likelihood of `LIKELY`.

5440

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

5441

},

5442

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

5443

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5444

# specified, the entire match is returned. No more than 3 may be included.

5445

42,

5446

],

5447

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5448

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5449

# google/re2 repository on GitHub.

5450

},

5451

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

5452

# The total length of the window cannot exceed 1000 characters. Note that

5453

# the finding itself will be included in the window, so that hotwords may

5454

# be used to match substrings of the finding itself. For example, the

5455

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

5456

# adjusted upwards if the area code is known to be the local area code of

5457

# a company office using the hotword regex "\(xxx\)", where "xxx"

5458

# is the area code in question.

5459

# rule.

5460

"windowBefore": 42, # Number of characters before the finding to consider.

5461

"windowAfter": 42, # Number of characters after the finding to consider.

},

},

},

],

"exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding

5467

# to be returned. It still can be used for rules matching.

5468

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.

5469

# be used to match sensitive information specific to the data, such as a list

5470

# of employee IDs or job titles.

5471

#

5472

# Dictionary words are case-insensitive and all characters other than letters

5473

# and digits in the unicode [Basic Multilingual

5474

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

5475

# will be replaced with whitespace when scanning for matches, so the

5476

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

5477

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

5478

# surrounding any match must be of a different type than the adjacent

5479

# characters within the word, so letters must be next to non-letters and

5480

# digits next to non-digits. For example, the dictionary word "jen" will

5481

# match the first three letters of the text "jen123" but will return no

5482

# matches for "jennifer".

5483

#

5484

# Dictionary words containing a large number of characters that are not

5485

# letters or digits may result in unexpected findings because such characters

5486

# are treated as whitespace. The

5487

# [limits](https://cloud.google.com/dlp/limits) page contains details about

5488

# the size limits of dictionaries. For dictionaries that do not fit within

5489

# these constraints, consider using `LargeCustomDictionaryConfig` in the

5490

# `StoredInfoType` API.

5491

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

5492

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

5493

# at least one phrase and every phrase must contain at least 2 characters

5494

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

5499

# is accepted.

5500

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

5501

# Example: gs://[BUCKET_NAME]/dictionary.txt

5502

},

5503

},

5504

"storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in

5505

# `InspectDataSource`. Not currently supported in `InspectContent`.

5506

"name": "A String", # Resource name of the requested `StoredInfoType`, for example

5507

# `organizations/433245324/storedInfoTypes/432452342` or

5508

# `projects/project-id/storedInfoTypes/432452342`.

5509

"createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for

5510

# inspection was created. Output-only field, populated by the system.

5511

},

5512

},

5513

],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5514

"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is

5515

# included in the response; see Finding.quote.

5516

"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig.

5517

# Exclusion rules, contained in the set are executed in the end, other

5518

# rules are executed in the order they are specified for each info type.

5519

{ # Rule set for modifying a set of infoTypes to alter behavior under certain

5520

# circumstances, depending on the specific details of the rules within the set.

5521

"infoTypes": [ # List of infoTypes this rule set is applied to.

5522

{ # Type of information detected by the API.

5523

"name": "A String", # Name of the information type. Either a name of your choosing when

5524

# creating a CustomInfoType, or one of the names listed

5525

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5526

# a built-in type. InfoType names should conform to the pattern

5527

# `[a-zA-Z0-9_]{1,64}`.

5528

},

5529

],

5530

"rules": [ # Set of rules to be applied to infoTypes. The rules are applied in order.

5531

{ # A single inspection rule to be applied to infoTypes, specified in

5532

# `InspectionRuleSet`.

5533

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

5534

# proximity of hotwords.

5535

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

5536

# part of a detection rule.

5537

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

5538

# levels. For example, if a finding would be `POSSIBLE` without the

5539

# detection rule and `relative_likelihood` is 1, then it is upgraded to

5540

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

5541

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

5542

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

5543

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

5544

# a final likelihood of `LIKELY`.

5545

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

5546

},

5547

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

5548

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5549

# specified, the entire match is returned. No more than 3 may be included.

5550

42,

5551

],

5552

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5553

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5554

# google/re2 repository on GitHub.

5555

},

5556

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

5557

# The total length of the window cannot exceed 1000 characters. Note that

5558

# the finding itself will be included in the window, so that hotwords may

5559

# be used to match substrings of the finding itself. For example, the

5560

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

5561

# adjusted upwards if the area code is known to be the local area code of

5562

# a company office using the hotword regex "\(xxx\)", where "xxx"

5563

# is the area code in question.

5564

# rule.

5565

"windowBefore": 42, # Number of characters before the finding to consider.

5566

"windowAfter": 42, # Number of characters after the finding to consider.

5567

},

5568

},

5569

"exclusionRule": { # The rule that specifies conditions when findings of infoTypes specified in # Exclusion rule.

5570

# `InspectionRuleSet` are removed from results.

5571

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # Dictionary which defines the rule.

5572

# be used to match sensitive information specific to the data, such as a list

5573

# of employee IDs or job titles.

5574

#

5575

# Dictionary words are case-insensitive and all characters other than letters

5576

# and digits in the unicode [Basic Multilingual

5577

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

5578

# will be replaced with whitespace when scanning for matches, so the

5579

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

5580

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

5581

# surrounding any match must be of a different type than the adjacent

5582

# characters within the word, so letters must be next to non-letters and

5583

# digits next to non-digits. For example, the dictionary word "jen" will

5584

# match the first three letters of the text "jen123" but will return no

5585

# matches for "jennifer".

5586

#

5587

# Dictionary words containing a large number of characters that are not

5588

# letters or digits may result in unexpected findings because such characters

5589

# are treated as whitespace. The

5590

# [limits](https://cloud.google.com/dlp/limits) page contains details about

5591

# the size limits of dictionaries. For dictionaries that do not fit within

5592

# these constraints, consider using `LargeCustomDictionaryConfig` in the

5593

# `StoredInfoType` API.

5594

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

5595

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

5596

# at least one phrase and every phrase must contain at least 2 characters

5597

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

5602

# is accepted.

5603

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

5604

# Example: gs://[BUCKET_NAME]/dictionary.txt

5605

},

5606

},

5607

"regex": { # Message defining a custom regular expression. # Regular expression which defines the rule.

5608

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5609

# specified, the entire match is returned. No more than 3 may be included.

5610

42,

5611

],

5612

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5613

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5614

# google/re2 repository on GitHub.

5615

},

5616

"excludeInfoTypes": { # List of exclude infoTypes. # Set of infoTypes for which findings would affect this rule.

5617

"infoTypes": [ # InfoType list in ExclusionRule rule drops a finding when it overlaps or

5618

# contained within with a finding of an infoType from this list. For

5619

# example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and

5620

# `exclusion_rule` containing `exclude_info_types.info_types` with

5621

# "EMAIL_ADDRESS" the phone number findings are dropped if they overlap

5622

# with EMAIL_ADDRESS finding.

5623

# That leads to "555-222-2222@example.org" to generate only a single

5624

# finding, namely email address.

5625

{ # Type of information detected by the API.

5626

"name": "A String", # Name of the information type. Either a name of your choosing when

5627

# creating a CustomInfoType, or one of the names listed

5628

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5629

# a built-in type. InfoType names should conform to the pattern

5630

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

"matchingType": "A String", # How the rule is applied, see MatchingType documentation for details.

},

},

],

},

],

"limits": { # Configuration to control the number of findings returned. # Configuration to control the number of findings returned.

5641

"maxFindingsPerItem": 42, # Max number of findings that will be returned for each item scanned.

5642

# When set within `InspectJobConfig`,

5643

# the maximum returned is 2000 regardless if this is set higher.

5644

# When set within `InspectContentRequest`, this field is ignored.

5645

"maxFindingsPerInfoType": [ # Configuration of findings limit given for specified infoTypes.

5646

{ # Max findings configuration per infoType, per content item or long

5647

# running DlpJob.

5648

"maxFindings": 42, # Max findings limit for the given infoType.

5649

"infoType": { # Type of information detected by the API. # Type of information the findings limit applies to. Only one limit per

5650

# info_type should be provided. If InfoTypeLimit does not have an

5651

# info_type, the DLP API applies the limit against all info_types that

5652

# are found but not specified in another InfoTypeLimit.

5653

"name": "A String", # Name of the information type. Either a name of your choosing when

5654

# creating a CustomInfoType, or one of the names listed

5655

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5656

# a built-in type. InfoType names should conform to the pattern

5657

# `[a-zA-Z0-9_]{1,64}`.

},

},

],

"maxFindingsPerRequest": 42, # Max number of findings that will be returned per request/job.

5662

# When set within `InspectContentRequest`, the maximum returned is 2000

5663

# regardless if this is set higher.

5664

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

5665

},

5666

"locationId": "A String", # The geographic location to process content reidentification. Reserved for

5667

# future extensions.

5668

"reidentifyTemplateName": "A String", # Template to use. References an instance of `DeidentifyTemplate`.

5669

# Any configuration directly specified in `reidentify_config` or

5670

# `inspect_config` will override those set in the template. Singular fields

5671

# that are set in this request will replace their corresponding fields in the

5672

# template. Repeated fields are appended. Singular sub-messages and groups

5673

# are recursively merged.

5674

"reidentifyConfig": { # The configuration that controls how the data will change. # Configuration for the re-identification of the content item.

5675

# This field shares the same proto message type that is used for

5676

# de-identification, however its usage here is for the reversal of the

5677

# previous de-identification. Re-identification is performed by examining

5678

# the transformations used to de-identify the items and executing the

5679

# reverse. This requires that only reversible transformations

5680

# be provided here. The reversible transformations are:

5681

#

5682

# - `CryptoDeterministicConfig`

5683

# - `CryptoReplaceFfxFpeConfig`

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

5684

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text

5685

# transformation everywhere.

5686

# apply various `PrimitiveTransformation`s to each finding, where the

5687

# transformation is applied to only values that were identified as a specific

5688

# info_type.

5689

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

5690

# for a given infoType.

5691

{ # A transformation to apply to text that is identified as a specific

5692

# info_type.

5693

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

5694

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

5695

# portion of the value.

5696

"partToExtract": "A String", # The part of the time to keep.

5697

},

5698

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

5699

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

5700

# to learn more.

5701

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

5702

# If set, must also set cryptoKey. If set, shift will be consistent for the

5703

# given context.

5704

"name": "A String", # Name describing the field.

5705

},

5706

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

5707

# range (inclusive ends). Negative means shift to earlier in time. Must not

5708

# be more than 365250 days (1000 years) each direction.

5709

#

5710

# For example, 3 means shift date to at most 3 days into the future.

5711

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

5712

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

5713

# results in the same shift for the same context and crypto_key. If

5714

# set, must also set context. Can only be applied to table items.

5715

# a key encryption key (KEK) stored by KMS).

5716

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5717

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5718

# unwrap the data crypto key.

5719

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5720

# leaking the key. Choose another type of key if possible.

5721

"key": "A String", # Required. A 128/192/256 bit key.

5722

},

5723

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5724

# It will be discarded after the request finishes.

5725

"name": "A String", # Required. Name of the key.

5726

# This is an arbitrary string used to differentiate different keys.

5727

# A unique key is generated per name: two separate `TransientCryptoKey`

5728

# protos share the same generated key if their names are the same.

5729

# When the data crypto key is generated, this name is not used in any way

5730

# (repeating the api call will result in a different key being generated).

5731

},

5732

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5733

# The wrapped key must be a 128/192/256 bit key.

5734

# Authorization requires the following IAM permissions when sending a request

5735

# to perform a crypto transformation using a kms-wrapped crypto key:

5736

# dlp.kms.encrypt

5737

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5738

"wrappedKey": "A String", # Required. The wrapped data crypto key.

},

},

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

5743

},

5744

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

5745

# Uses SHA-256.

5746

# The key size must be either 32 or 64 bytes.

5747

# Outputs a base64 encoded representation of the hashed output

5748

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

5749

# Currently, only string and integer values can be hashed.

5750

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

5751

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

5752

# a key encryption key (KEK) stored by KMS).

5753

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5754

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5755

# unwrap the data crypto key.

5756

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5757

# leaking the key. Choose another type of key if possible.

5758

"key": "A String", # Required. A 128/192/256 bit key.

5759

},

5760

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5761

# It will be discarded after the request finishes.

5762

"name": "A String", # Required. Name of the key.

5763

# This is an arbitrary string used to differentiate different keys.

5764

# A unique key is generated per name: two separate `TransientCryptoKey`

5765

# protos share the same generated key if their names are the same.

5766

# When the data crypto key is generated, this name is not used in any way

5767

# (repeating the api call will result in a different key being generated).

5768

},

5769

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5770

# The wrapped key must be a 128/192/256 bit key.

5771

# Authorization requires the following IAM permissions when sending a request

5772

# to perform a crypto transformation using a kms-wrapped crypto key:

5773

# dlp.kms.encrypt

5774

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5775

"wrappedKey": "A String", # Required. The wrapped data crypto key.

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

5780

# (FPE) with the FFX mode of operation; however when used in the

5781

# `ReidentifyContent` API method, it serves the opposite function by reversing

5782

# the surrogate back into the original identifier. The identifier must be

5783

# encoded as ASCII. For a given crypto key and context, the same identifier

5784

# will be replaced with the same surrogate. Identifiers must be at least two

5785

# characters long. In the case that the identifier is the empty string, it will

5786

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

5787

# more.

5788

#

5789

# Note: We recommend using CryptoDeterministicConfig for all use cases which

5790

# do not require preserving the input alphabet space and size, plus warrant

5791

# referential integrity.

5792

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

5793

# This annotation will be applied to the surrogate by prefixing it with

5794

# the name of the custom infoType followed by the number of

5795

# characters comprising the surrogate. The following scheme defines the

5796

# format: info_type_name(surrogate_character_count):surrogate

5797

#

5798

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

5799

# the surrogate is 'abc', the full replacement value

5800

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

5801

#

5802

# This annotation identifies the surrogate when inspecting content using the

5803

# custom infoType

5804

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

5805

# This facilitates reversal of the surrogate when it occurs in free text.

5806

#

5807

# In order for inspection to work properly, the name of this infoType must

5808

# not occur naturally anywhere in your data; otherwise, inspection may

5809

# find a surrogate that does not correspond to an actual identifier.

5810

# Therefore, choose your custom infoType name carefully after considering

5811

# what your data looks like. One way to select a name that has a high chance

5812

# of yielding reliable detection is to include one or more unicode characters

5813

# that are highly improbable to exist in your data.

5814

# For example, assuming your data is entered from a regular ASCII keyboard,

5815

# the symbol with the hex code point 29DD might be used like so:

5816

# ⧝MY_TOKEN_TYPE

5817

"name": "A String", # Name of the information type. Either a name of your choosing when

5818

# creating a CustomInfoType, or one of the names listed

5819

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5820

# a built-in type. InfoType names should conform to the pattern

5821

# `[a-zA-Z0-9_]{1,64}`.

5822

},

5823

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

5824

# identifier in two different contexts won't be given the same surrogate. If

5825

# the context is not set, a default tweak will be used.

5826

#

5827

# If the context is set but:

5828

#

5829

# 1. there is no record present when transforming a given value or

5830

# 1. the field is not present when transforming a given value,

5831

#

5832

# a default tweak will be used.

5833

#

5834

# Note that case (1) is expected when an `InfoTypeTransformation` is

5835

# applied to both structured and non-structured `ContentItem`s.

5836

# Currently, the referenced field may be of value type integer or string.

5837

#

5838

# The tweak is constructed as a sequence of bytes in big endian byte order

5839

# such that:

5840

#

5841

# - a 64 bit integer is encoded followed by a single byte of value 1

5842

# - a string is encoded in UTF-8 format followed by a single byte of value 2

5843

"name": "A String", # Name describing the field.

5844

},

5845

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

5846

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

5847

# a key encryption key (KEK) stored by KMS).

5848

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5849

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5850

# unwrap the data crypto key.

5851

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5852

# leaking the key. Choose another type of key if possible.

5853

"key": "A String", # Required. A 128/192/256 bit key.

5854

},

5855

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5856

# It will be discarded after the request finishes.

5857

"name": "A String", # Required. Name of the key.

5858

# This is an arbitrary string used to differentiate different keys.

5859

# A unique key is generated per name: two separate `TransientCryptoKey`

5860

# protos share the same generated key if their names are the same.

5861

# When the data crypto key is generated, this name is not used in any way

5862

# (repeating the api call will result in a different key being generated).

5863

},

5864

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5865

# The wrapped key must be a 128/192/256 bit key.

5866

# Authorization requires the following IAM permissions when sending a request

5867

# to perform a crypto transformation using a kms-wrapped crypto key:

5868

# dlp.kms.encrypt

5869

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5870

"wrappedKey": "A String", # Required. The wrapped data crypto key.

5871

},

5872

},

5873

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

5874

# that the FFX mode natively supports. This happens before/after

5875

# encryption/decryption.

5876

# Each character listed must appear only once.

5877

# Number of characters must be in the range [2, 95].

5878

# This must be encoded as ASCII.

5879

# The order of characters does not matter.

5880

"commonAlphabet": "A String", # Common alphabets.

5881

},

5882

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

5883

# input. Outputs a base64 encoded representation of the encrypted output.

5884

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

5885

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

5886

# This annotation will be applied to the surrogate by prefixing it with

5887

# the name of the custom info type followed by the number of

5888

# characters comprising the surrogate. The following scheme defines the

5889

# format: {info type name}({surrogate character count}):{surrogate}

5890

#

5891

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

5892

# the surrogate is 'abc', the full replacement value

5893

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

5894

#

5895

# This annotation identifies the surrogate when inspecting content using the

5896

# custom info type 'Surrogate'. This facilitates reversal of the

5897

# surrogate when it occurs in free text.

5898

#

5899

# Note: For record transformations where the entire cell in a table is being

5900

# transformed, surrogates are not mandatory. Surrogates are used to denote

5901

# the location of the token and are necessary for re-identification in free

5902

# form text.

5903

#

5904

# In order for inspection to work properly, the name of this info type must

5905

# not occur naturally anywhere in your data; otherwise, inspection may either

5906

#

5907

# - reverse a surrogate that does not correspond to an actual identifier

5908

# - be unable to parse the surrogate and result in an error

5909

#

5910

# Therefore, choose your custom info type name carefully after considering

5911

# what your data looks like. One way to select a name that has a high chance

5912

# of yielding reliable detection is to include one or more unicode characters

5913

# that are highly improbable to exist in your data.

5914

# For example, assuming your data is entered from a regular ASCII keyboard,

5915

# the symbol with the hex code point 29DD might be used like so:

5916

# ⧝MY_TOKEN_TYPE.

5917

"name": "A String", # Name of the information type. Either a name of your choosing when

5918

# creating a CustomInfoType, or one of the names listed

5919

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5920

# a built-in type. InfoType names should conform to the pattern

5921

# `[a-zA-Z0-9_]{1,64}`.

5922

},

5923

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

5924

# referential integrity such that the same identifier in two different

5925

# contexts will be given a distinct surrogate. The context is appended to

5926

# plaintext value being encrypted. On decryption the provided context is

5927

# validated against the value used during encryption. If a context was

5928

# provided during encryption, same context must be provided during decryption

5929

# as well.

5930

#

5931

# If the context is not set, plaintext would be used as is for encryption.

5932

# If the context is set but:

5933

#

5934

# 1. there is no record present when transforming a given value or

5935

# 2. the field is not present when transforming a given value,

5936

#

5937

# plaintext would be used as is for encryption.

5938

#

5939

# Note that case (1) is expected when an `InfoTypeTransformation` is

5940

# applied to both structured and non-structured `ContentItem`s.

5941

"name": "A String", # Name describing the field.

5942

},

5943

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

5944

# a key encryption key (KEK) stored by KMS).

5945

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5946

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5947

# unwrap the data crypto key.

5948

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5949

# leaking the key. Choose another type of key if possible.

5950

"key": "A String", # Required. A 128/192/256 bit key.

5951

},

5952

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5953

# It will be discarded after the request finishes.

5954

"name": "A String", # Required. Name of the key.

5955

# This is an arbitrary string used to differentiate different keys.

5956

# A unique key is generated per name: two separate `TransientCryptoKey`

5957

# protos share the same generated key if their names are the same.

5958

# When the data crypto key is generated, this name is not used in any way

5959

# (repeating the api call will result in a different key being generated).

5960

},

5961

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5962

# The wrapped key must be a 128/192/256 bit key.

5963

# Authorization requires the following IAM permissions when sending a request

5964

# to perform a crypto transformation using a kms-wrapped crypto key:

5965

# dlp.kms.encrypt

5966

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5967

"wrappedKey": "A String", # Required. The wrapped data crypto key.

},

},

},

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

5972

# replacement values are dynamically provided by the user for custom behavior,

5973

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

5974

# This can be used on

5975

# data of type: number, long, string, timestamp.

5976

# If the bound `Value` type differs from the type of data being transformed, we

5977

# will first attempt converting the type of the data to be transformed to match

5978

# the type of the bound before comparing.

5979

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

5980

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

5981

{ # Bucket is represented as a range, along with replacement values.

5982

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

5983

# the default behavior will be to hyphenate the min-max range.

5984

# Note that for the purposes of inspection or transformation, the number

5985

# of bytes considered to comprise a 'Value' is based on its representation

5986

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5987

# 123456789, the number of bytes would be counted as 9, even though an

5988

# int64 only holds up to 8 bytes of data.

5989

"timestampValue": "A String", # timestamp

5990

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5991

# and time zone are either specified elsewhere or are not significant. The date

5992

# is relative to the Proleptic Gregorian Calendar. This can represent:

5993

#

5994

# * A full date, with non-zero year, month and day values

5995

# * A month and day value, with a zero year, e.g. an anniversary

5996

# * A year on its own, with zero month and day values

5997

# * A year and month value, with a zero day, e.g. a credit card expiration date

5998

#

5999

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6000

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6001

# a year.

6002

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6003

# month and day.

6004

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6005

# if specifying a year by itself or a year and month where the day is not

6006

# significant.

6007

},

6008

"stringValue": "A String", # string

6009

"integerValue": "A String", # integer

6010

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6011

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6012

# types are google.type.Date and `google.protobuf.Timestamp`.

6013

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6014

# to allow the value "24:00:00" for scenarios like business closing time.

6015

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6016

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6017

# allow the value 60 if it allows leap-seconds.

6018

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6019

},

6020

"booleanValue": True or False, # boolean

6021

"floatValue": 3.14, # float

6022

"dayOfWeekValue": "A String", # day of week

6023

},

6024

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

6025

# used.

6026

# Note that for the purposes of inspection or transformation, the number

6027

# of bytes considered to comprise a 'Value' is based on its representation

6028

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6029

# 123456789, the number of bytes would be counted as 9, even though an

6030

# int64 only holds up to 8 bytes of data.

6031

"timestampValue": "A String", # timestamp

6032

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6033

# and time zone are either specified elsewhere or are not significant. The date

6034

# is relative to the Proleptic Gregorian Calendar. This can represent:

6035

#

6036

# * A full date, with non-zero year, month and day values

6037

# * A month and day value, with a zero year, e.g. an anniversary

6038

# * A year on its own, with zero month and day values

6039

# * A year and month value, with a zero day, e.g. a credit card expiration date

6040

#

6041

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6042

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6043

# a year.

6044

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6045

# month and day.

6046

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6047

# if specifying a year by itself or a year and month where the day is not

6048

# significant.

6049

},

6050

"stringValue": "A String", # string

6051

"integerValue": "A String", # integer

6052

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6053

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6054

# types are google.type.Date and `google.protobuf.Timestamp`.

6055

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6056

# to allow the value "24:00:00" for scenarios like business closing time.

6057

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6058

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6059

# allow the value 60 if it allows leap-seconds.

6060

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6061

},

6062

"booleanValue": True or False, # boolean

6063

"floatValue": 3.14, # float

6064

"dayOfWeekValue": "A String", # day of week

6065

},

6066

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

6067

# Note that for the purposes of inspection or transformation, the number

6068

# of bytes considered to comprise a 'Value' is based on its representation

6069

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6070

# 123456789, the number of bytes would be counted as 9, even though an

6071

# int64 only holds up to 8 bytes of data.

6072

"timestampValue": "A String", # timestamp

6073

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6074

# and time zone are either specified elsewhere or are not significant. The date

6075

# is relative to the Proleptic Gregorian Calendar. This can represent:

6076

#

6077

# * A full date, with non-zero year, month and day values

6078

# * A month and day value, with a zero year, e.g. an anniversary

6079

# * A year on its own, with zero month and day values

6080

# * A year and month value, with a zero day, e.g. a credit card expiration date

6081

#

6082

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6083

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6084

# a year.

6085

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6086

# month and day.

6087

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6088

# if specifying a year by itself or a year and month where the day is not

6089

# significant.

6090

},

6091

"stringValue": "A String", # string

6092

"integerValue": "A String", # integer

6093

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6094

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6095

# types are google.type.Date and `google.protobuf.Timestamp`.

6096

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6097

# to allow the value "24:00:00" for scenarios like business closing time.

6098

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6099

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6100

# allow the value 60 if it allows leap-seconds.

6101

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6102

},

6103

"booleanValue": True or False, # boolean

6104

"floatValue": 3.14, # float

6105

"dayOfWeekValue": "A String", # day of week

},

},

],

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

6111

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

6112

# output would be 'My phone number is '.

6113

},

6114

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

6115

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

6116

# Note that for the purposes of inspection or transformation, the number

6117

# of bytes considered to comprise a 'Value' is based on its representation

6118

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6119

# 123456789, the number of bytes would be counted as 9, even though an

6120

# int64 only holds up to 8 bytes of data.

6121

"timestampValue": "A String", # timestamp

6122

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6123

# and time zone are either specified elsewhere or are not significant. The date

6124

# is relative to the Proleptic Gregorian Calendar. This can represent:

6125

#

6126

# * A full date, with non-zero year, month and day values

6127

# * A month and day value, with a zero year, e.g. an anniversary

6128

# * A year on its own, with zero month and day values

6129

# * A year and month value, with a zero day, e.g. a credit card expiration date

6130

#

6131

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6132

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6133

# a year.

6134

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6135

# month and day.

6136

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6137

# if specifying a year by itself or a year and month where the day is not

6138

# significant.

6139

},

6140

"stringValue": "A String", # string

6141

"integerValue": "A String", # integer

6142

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6143

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6144

# types are google.type.Date and `google.protobuf.Timestamp`.

6145

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6146

# to allow the value "24:00:00" for scenarios like business closing time.

6147

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6148

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6149

# allow the value 60 if it allows leap-seconds.

6150

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6151

},

6152

"booleanValue": True or False, # boolean

6153

"floatValue": 3.14, # float

6154

"dayOfWeekValue": "A String", # day of week

6155

},

6156

},

6157

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

6158

# Bucketing transformation can provide all of this functionality,

6159

# but requires more configuration. This message is provided as a convenience to

6160

# the user for simple bucketing strategies.

6161

#

6162

# The transformed value will be a hyphenated string of

6163

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

6164

# all values that are within this bucket will be replaced with "10-20".

6165

#

6166

# This can be used on data of type: double, long.

6167

#

6168

# If the bound Value type differs from the type of data

6169

# being transformed, we will first attempt converting the type of the data to

6170

# be transformed to match the type of the bound before comparing.

6171

#

6172

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

6173

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

6174

# grouped together into a single bucket; for example if `upper_bound` = 89,

6175

# then all values greater than 89 are replaced with the value "89+".

6176

# Note that for the purposes of inspection or transformation, the number

6177

# of bytes considered to comprise a 'Value' is based on its representation

6178

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6179

# 123456789, the number of bytes would be counted as 9, even though an

6180

# int64 only holds up to 8 bytes of data.

6181

"timestampValue": "A String", # timestamp

6182

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6183

# and time zone are either specified elsewhere or are not significant. The date

6184

# is relative to the Proleptic Gregorian Calendar. This can represent:

6185

#

6186

# * A full date, with non-zero year, month and day values

6187

# * A month and day value, with a zero year, e.g. an anniversary

6188

# * A year on its own, with zero month and day values

6189

# * A year and month value, with a zero day, e.g. a credit card expiration date

6190

#

6191

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6192

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6193

# a year.

6194

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6195

# month and day.

6196

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6197

# if specifying a year by itself or a year and month where the day is not

6198

# significant.

6199

},

6200

"stringValue": "A String", # string

6201

"integerValue": "A String", # integer

6202

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6203

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6204

# types are google.type.Date and `google.protobuf.Timestamp`.

6205

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6206

# to allow the value "24:00:00" for scenarios like business closing time.

6207

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6208

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6209

# allow the value 60 if it allows leap-seconds.

6210

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6211

},

6212

"booleanValue": True or False, # boolean

6213

"floatValue": 3.14, # float

6214

"dayOfWeekValue": "A String", # day of week

6215

},

6216

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

6217

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

6218

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

6219

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

6220

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

6221

# grouped together into a single bucket; for example if `lower_bound` = 10,

6222

# then all values less than 10 are replaced with the value "-10".

6223

# Note that for the purposes of inspection or transformation, the number

6224

# of bytes considered to comprise a 'Value' is based on its representation

6225

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6226

# 123456789, the number of bytes would be counted as 9, even though an

6227

# int64 only holds up to 8 bytes of data.

6228

"timestampValue": "A String", # timestamp

6229

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6230

# and time zone are either specified elsewhere or are not significant. The date

6231

# is relative to the Proleptic Gregorian Calendar. This can represent:

6232

#

6233

# * A full date, with non-zero year, month and day values

6234

# * A month and day value, with a zero year, e.g. an anniversary

6235

# * A year on its own, with zero month and day values

6236

# * A year and month value, with a zero day, e.g. a credit card expiration date

6237

#

6238

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6239

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6240

# a year.

6241

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6242

# month and day.

6243

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6244

# if specifying a year by itself or a year and month where the day is not

6245

# significant.

6246

},

6247

"stringValue": "A String", # string

6248

"integerValue": "A String", # integer

6249

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6250

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6251

# types are google.type.Date and `google.protobuf.Timestamp`.

6252

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6253

# to allow the value "24:00:00" for scenarios like business closing time.

6254

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6255

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6256

# allow the value 60 if it allows leap-seconds.

6257

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6258

},

6259

"booleanValue": True or False, # boolean

6260

"floatValue": 3.14, # float

6261

"dayOfWeekValue": "A String", # day of week

6262

},

6263

},

6264

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

6265

# fixed character. Masking can start from the beginning or end of the string.

6266

# This can be used on data of any type (numbers, longs, and so on) and when

6267

# de-identifying structured data we'll attempt to preserve the original data's

6268

# type. (This allows you to take a long like 123 and modify it to a string like

6269

# **3.

6270

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

6271

# characters. For example, if the input string is `555-555-5555` and you

6272

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

6273

# returns `***-**5-5555`.

6274

{ # Characters to skip when doing deidentification of a value. These will be left

6275

# alone and skipped.

6276

"charactersToSkip": "A String", # Characters to not transform when masking.

6277

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

6282

# masked. Skipped characters do not count towards this tally.

6283

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

6284

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

6285

# code or credit card number. This string must have a length of 1. If not

6286

# supplied, this value defaults to `*` for strings, and `0` for digits.

6287

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

6288

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

6289

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

6290

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

6291

# is `true`, then the string `12345` is masked as `12***`.

6292

},

6293

},

6294

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

6295

# this transformation to apply to all findings that correspond to

6296

# infoTypes that were requested in `InspectConfig`.

6297

{ # Type of information detected by the API.

6298

"name": "A String", # Name of the information type. Either a name of your choosing when

6299

# creating a CustomInfoType, or one of the names listed

6300

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6301

# a built-in type. InfoType names should conform to the pattern

6302

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

],

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6308

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default

6309

# mode is `TransformationErrorHandling.ThrowError`.

6310

# transformation error occurs when the requested transformation is incompatible

6311

# with the data. For example, trying to de-identify an IP address using a

6312

# `DateShift` transformation would result in a transformation error, since date

6313

# info cannot be extracted from an IP address.

6314

# Information about any incompatible transformations, and how they were

6315

# handled, is returned in the response as part of the

6316

# `TransformationOverviews`.

6317

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

6318

},

6319

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would # Ignore errors

6320

# cause an error. For example, if a `DateShift` transformation were applied

6321

# an an IP address, this mode would leave the IP address unchanged in the

# response.

},

},

"recordTransformations": { # A type of transformation that is applied over structured data such as a # Treat the dataset as structured. Transformations can be applied to

6326

# specific locations within structured datasets, such as transforming

6327

# a column within a table.

6328

# table.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6329

"fieldTransformations": [ # Transform the record by applying various field transformations.

6330

{ # The transformation to apply to the field.

6331

"fields": [ # Required. Input field(s) to apply the transformation to.

6332

{ # General identifier of a data field in a storage service.

6333

"name": "A String", # Name describing the field.

6334

},

6335

],

6336

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

6337

# transform content that matches an `InfoType`.

6338

# apply various `PrimitiveTransformation`s to each finding, where the

6339

# transformation is applied to only values that were identified as a specific

6340

# info_type.

6341

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

6342

# for a given infoType.

6343

{ # A transformation to apply to text that is identified as a specific

6344

# info_type.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6345

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

6346

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

6347

# portion of the value.

6348

"partToExtract": "A String", # The part of the time to keep.

6349

},

6350

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

6351

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

6352

# to learn more.

6353

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

6354

# If set, must also set cryptoKey. If set, shift will be consistent for the

6355

# given context.

6356

"name": "A String", # Name describing the field.

6357

},

6358

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

6359

# range (inclusive ends). Negative means shift to earlier in time. Must not

6360

# be more than 365250 days (1000 years) each direction.

6361

#

6362

# For example, 3 means shift date to at most 3 days into the future.

6363

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

6364

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

6365

# results in the same shift for the same context and crypto_key. If

6366

# set, must also set context. Can only be applied to table items.

6367

# a key encryption key (KEK) stored by KMS).

6368

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6369

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6370

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6371

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6372

# leaking the key. Choose another type of key if possible.

6373

"key": "A String", # Required. A 128/192/256 bit key.

6374

},

6375

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6376

# It will be discarded after the request finishes.

6377

"name": "A String", # Required. Name of the key.

6378

# This is an arbitrary string used to differentiate different keys.

6379

# A unique key is generated per name: two separate `TransientCryptoKey`

6380

# protos share the same generated key if their names are the same.

6381

# When the data crypto key is generated, this name is not used in any way

6382

# (repeating the api call will result in a different key being generated).

6383

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6384

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6385

# The wrapped key must be a 128/192/256 bit key.

6386

# Authorization requires the following IAM permissions when sending a request

6387

# to perform a crypto transformation using a kms-wrapped crypto key:

6388

# dlp.kms.encrypt

6389

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6390

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6391

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6392

},

6393

},

6394

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

6395

},

6396

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

6397

# Uses SHA-256.

6398

# The key size must be either 32 or 64 bytes.

6399

# Outputs a base64 encoded representation of the hashed output

6400

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

6401

# Currently, only string and integer values can be hashed.

6402

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

6403

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

6404

# a key encryption key (KEK) stored by KMS).

6405

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6406

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6407

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6408

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6409

# leaking the key. Choose another type of key if possible.

6410

"key": "A String", # Required. A 128/192/256 bit key.

6411

},

6412

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6413

# It will be discarded after the request finishes.

6414

"name": "A String", # Required. Name of the key.

6415

# This is an arbitrary string used to differentiate different keys.

6416

# A unique key is generated per name: two separate `TransientCryptoKey`

6417

# protos share the same generated key if their names are the same.

6418

# When the data crypto key is generated, this name is not used in any way

6419

# (repeating the api call will result in a different key being generated).

6420

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6421

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6422

# The wrapped key must be a 128/192/256 bit key.

6423

# Authorization requires the following IAM permissions when sending a request

6424

# to perform a crypto transformation using a kms-wrapped crypto key:

6425

# dlp.kms.encrypt

6426

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6427

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6428

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6429

},

6430

},

6431

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

6432

# (FPE) with the FFX mode of operation; however when used in the

6433

# `ReidentifyContent` API method, it serves the opposite function by reversing

6434

# the surrogate back into the original identifier. The identifier must be

6435

# encoded as ASCII. For a given crypto key and context, the same identifier

6436

# will be replaced with the same surrogate. Identifiers must be at least two

6437

# characters long. In the case that the identifier is the empty string, it will

6438

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

6439

# more.

6440

#

6441

# Note: We recommend using CryptoDeterministicConfig for all use cases which

6442

# do not require preserving the input alphabet space and size, plus warrant

6443

# referential integrity.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6444

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

6445

# This annotation will be applied to the surrogate by prefixing it with

6446

# the name of the custom infoType followed by the number of

6447

# characters comprising the surrogate. The following scheme defines the

6448

# format: info_type_name(surrogate_character_count):surrogate

6449

#

6450

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

6451

# the surrogate is 'abc', the full replacement value

6452

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

6453

#

6454

# This annotation identifies the surrogate when inspecting content using the

6455

# custom infoType

6456

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

6457

# This facilitates reversal of the surrogate when it occurs in free text.

6458

#

6459

# In order for inspection to work properly, the name of this infoType must

6460

# not occur naturally anywhere in your data; otherwise, inspection may

6461

# find a surrogate that does not correspond to an actual identifier.

6462

# Therefore, choose your custom infoType name carefully after considering

6463

# what your data looks like. One way to select a name that has a high chance

6464

# of yielding reliable detection is to include one or more unicode characters

6465

# that are highly improbable to exist in your data.

6466

# For example, assuming your data is entered from a regular ASCII keyboard,

6467

# the symbol with the hex code point 29DD might be used like so:

6468

# ⧝MY_TOKEN_TYPE

6469

"name": "A String", # Name of the information type. Either a name of your choosing when

6470

# creating a CustomInfoType, or one of the names listed

6471

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6472

# a built-in type. InfoType names should conform to the pattern

6473

# `[a-zA-Z0-9_]{1,64}`.

6474

},

6475

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

6476

# identifier in two different contexts won't be given the same surrogate. If

6477

# the context is not set, a default tweak will be used.

6478

#

6479

# If the context is set but:

6480

#

6481

# 1. there is no record present when transforming a given value or

6482

# 1. the field is not present when transforming a given value,

6483

#

6484

# a default tweak will be used.

6485

#

6486

# Note that case (1) is expected when an `InfoTypeTransformation` is

6487

# applied to both structured and non-structured `ContentItem`s.

6488

# Currently, the referenced field may be of value type integer or string.

6489

#

6490

# The tweak is constructed as a sequence of bytes in big endian byte order

6491

# such that:

6492

#

6493

# - a 64 bit integer is encoded followed by a single byte of value 1

6494

# - a string is encoded in UTF-8 format followed by a single byte of value 2

6495

"name": "A String", # Name describing the field.

6496

},

6497

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

6498

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

6499

# a key encryption key (KEK) stored by KMS).

6500

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6501

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6502

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6503

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6504

# leaking the key. Choose another type of key if possible.

6505

"key": "A String", # Required. A 128/192/256 bit key.

6506

},

6507

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6508

# It will be discarded after the request finishes.

6509

"name": "A String", # Required. Name of the key.

6510

# This is an arbitrary string used to differentiate different keys.

6511

# A unique key is generated per name: two separate `TransientCryptoKey`

6512

# protos share the same generated key if their names are the same.

6513

# When the data crypto key is generated, this name is not used in any way

6514

# (repeating the api call will result in a different key being generated).

6515

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6516

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6517

# The wrapped key must be a 128/192/256 bit key.

6518

# Authorization requires the following IAM permissions when sending a request

6519

# to perform a crypto transformation using a kms-wrapped crypto key:

6520

# dlp.kms.encrypt

6521

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6522

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6523

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6524

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6525

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

6526

# that the FFX mode natively supports. This happens before/after

6527

# encryption/decryption.

6528

# Each character listed must appear only once.

6529

# Number of characters must be in the range [2, 95].

6530

# This must be encoded as ASCII.

6531

# The order of characters does not matter.

6532

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6533

},

6534

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

6535

# input. Outputs a base64 encoded representation of the encrypted output.

6536

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

6537

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

6538

# This annotation will be applied to the surrogate by prefixing it with

6539

# the name of the custom info type followed by the number of

6540

# characters comprising the surrogate. The following scheme defines the

6541

# format: {info type name}({surrogate character count}):{surrogate}

6542

#

6543

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

6544

# the surrogate is 'abc', the full replacement value

6545

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

6546

#

6547

# This annotation identifies the surrogate when inspecting content using the

6548

# custom info type 'Surrogate'. This facilitates reversal of the

6549

# surrogate when it occurs in free text.

6550

#

6551

# Note: For record transformations where the entire cell in a table is being

6552

# transformed, surrogates are not mandatory. Surrogates are used to denote

6553

# the location of the token and are necessary for re-identification in free

6554

# form text.

6555

#

6556

# In order for inspection to work properly, the name of this info type must

6557

# not occur naturally anywhere in your data; otherwise, inspection may either

6558

#

6559

# - reverse a surrogate that does not correspond to an actual identifier

6560

# - be unable to parse the surrogate and result in an error

6561

#

6562

# Therefore, choose your custom info type name carefully after considering

6563

# what your data looks like. One way to select a name that has a high chance

6564

# of yielding reliable detection is to include one or more unicode characters

6565

# that are highly improbable to exist in your data.

6566

# For example, assuming your data is entered from a regular ASCII keyboard,

6567

# the symbol with the hex code point 29DD might be used like so:

6568

# ⧝MY_TOKEN_TYPE.

6569

"name": "A String", # Name of the information type. Either a name of your choosing when

6570

# creating a CustomInfoType, or one of the names listed

6571

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6572

# a built-in type. InfoType names should conform to the pattern

6573

# `[a-zA-Z0-9_]{1,64}`.

6574

},

6575

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

6576

# referential integrity such that the same identifier in two different

6577

# contexts will be given a distinct surrogate. The context is appended to

6578

# plaintext value being encrypted. On decryption the provided context is

6579

# validated against the value used during encryption. If a context was

6580

# provided during encryption, same context must be provided during decryption

6581

# as well.

6582

#

6583

# If the context is not set, plaintext would be used as is for encryption.

6584

# If the context is set but:

6585

#

6586

# 1. there is no record present when transforming a given value or

6587

# 2. the field is not present when transforming a given value,

6588

#

6589

# plaintext would be used as is for encryption.

6590

#

6591

# Note that case (1) is expected when an `InfoTypeTransformation` is

6592

# applied to both structured and non-structured `ContentItem`s.

6593

"name": "A String", # Name describing the field.

6594

},

6595

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

6596

# a key encryption key (KEK) stored by KMS).

6597

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6598

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6599

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6600

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6601

# leaking the key. Choose another type of key if possible.

6602

"key": "A String", # Required. A 128/192/256 bit key.

6603

},

6604

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6605

# It will be discarded after the request finishes.

6606

"name": "A String", # Required. Name of the key.

6607

# This is an arbitrary string used to differentiate different keys.

6608

# A unique key is generated per name: two separate `TransientCryptoKey`

6609

# protos share the same generated key if their names are the same.

6610

# When the data crypto key is generated, this name is not used in any way

6611

# (repeating the api call will result in a different key being generated).

6612

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6613

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6614

# The wrapped key must be a 128/192/256 bit key.

6615

# Authorization requires the following IAM permissions when sending a request

6616

# to perform a crypto transformation using a kms-wrapped crypto key:

6617

# dlp.kms.encrypt

6618

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6619

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6620

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6621

},

6622

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6623

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

6624

# replacement values are dynamically provided by the user for custom behavior,

6625

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

6626

# This can be used on

6627

# data of type: number, long, string, timestamp.

6628

# If the bound `Value` type differs from the type of data being transformed, we

6629

# will first attempt converting the type of the data to be transformed to match

6630

# the type of the bound before comparing.

6631

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

6632

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

6633

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6634

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

6635

# the default behavior will be to hyphenate the min-max range.

6636

# Note that for the purposes of inspection or transformation, the number

6637

# of bytes considered to comprise a 'Value' is based on its representation

6638

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6639

# 123456789, the number of bytes would be counted as 9, even though an

6640

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6641

"timestampValue": "A String", # timestamp

6642

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6643

# and time zone are either specified elsewhere or are not significant. The date

6644

# is relative to the Proleptic Gregorian Calendar. This can represent:

6645

#

6646

# * A full date, with non-zero year, month and day values

6647

# * A month and day value, with a zero year, e.g. an anniversary

6648

# * A year on its own, with zero month and day values

6649

# * A year and month value, with a zero day, e.g. a credit card expiration date

6650

#

6651

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6652

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6653

# a year.

6654

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6655

# month and day.

6656

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6657

# if specifying a year by itself or a year and month where the day is not

6658

# significant.

6659

},

6660

"stringValue": "A String", # string

6661

"integerValue": "A String", # integer

6662

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6663

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6664

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6665

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6666

# to allow the value "24:00:00" for scenarios like business closing time.

6667

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6668

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6669

# allow the value 60 if it allows leap-seconds.

6670

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6671

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6672

"booleanValue": True or False, # boolean

6673

"floatValue": 3.14, # float

6674

"dayOfWeekValue": "A String", # day of week

6675

},

6676

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

6677

# used.

6678

# Note that for the purposes of inspection or transformation, the number

6679

# of bytes considered to comprise a 'Value' is based on its representation

6680

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6681

# 123456789, the number of bytes would be counted as 9, even though an

6682

# int64 only holds up to 8 bytes of data.

6683

"timestampValue": "A String", # timestamp

6684

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6685

# and time zone are either specified elsewhere or are not significant. The date

6686

# is relative to the Proleptic Gregorian Calendar. This can represent:

6687

#

6688

# * A full date, with non-zero year, month and day values

6689

# * A month and day value, with a zero year, e.g. an anniversary

6690

# * A year on its own, with zero month and day values

6691

# * A year and month value, with a zero day, e.g. a credit card expiration date

6692

#

6693

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6694

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6695

# a year.

6696

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6697

# month and day.

6698

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6699

# if specifying a year by itself or a year and month where the day is not

6700

# significant.

6701

},

6702

"stringValue": "A String", # string

6703

"integerValue": "A String", # integer

6704

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6705

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6706

# types are google.type.Date and `google.protobuf.Timestamp`.

6707

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6708

# to allow the value "24:00:00" for scenarios like business closing time.

6709

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6710

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6711

# allow the value 60 if it allows leap-seconds.

6712

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6713

},

6714

"booleanValue": True or False, # boolean

6715

"floatValue": 3.14, # float

6716

"dayOfWeekValue": "A String", # day of week

6717

},

6718

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

6719

# Note that for the purposes of inspection or transformation, the number

6720

# of bytes considered to comprise a 'Value' is based on its representation

6721

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6722

# 123456789, the number of bytes would be counted as 9, even though an

6723

# int64 only holds up to 8 bytes of data.

6724

"timestampValue": "A String", # timestamp

6725

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6726

# and time zone are either specified elsewhere or are not significant. The date

6727

# is relative to the Proleptic Gregorian Calendar. This can represent:

6728

#

6729

# * A full date, with non-zero year, month and day values

6730

# * A month and day value, with a zero year, e.g. an anniversary

6731

# * A year on its own, with zero month and day values

6732

# * A year and month value, with a zero day, e.g. a credit card expiration date

6733

#

6734

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6735

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6736

# a year.

6737

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6738

# month and day.

6739

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6740

# if specifying a year by itself or a year and month where the day is not

6741

# significant.

6742

},

6743

"stringValue": "A String", # string

6744

"integerValue": "A String", # integer

6745

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6746

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6747

# types are google.type.Date and `google.protobuf.Timestamp`.

6748

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6749

# to allow the value "24:00:00" for scenarios like business closing time.

6750

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6751

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6752

# allow the value 60 if it allows leap-seconds.

6753

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6754

},

6755

"booleanValue": True or False, # boolean

6756

"floatValue": 3.14, # float

6757

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6762

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

6763

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

6764

# output would be 'My phone number is '.

6765

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6766

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

6767

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

6768

# Note that for the purposes of inspection or transformation, the number

6769

# of bytes considered to comprise a 'Value' is based on its representation

6770

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6771

# 123456789, the number of bytes would be counted as 9, even though an

6772

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6773

"timestampValue": "A String", # timestamp

6774

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6775

# and time zone are either specified elsewhere or are not significant. The date

6776

# is relative to the Proleptic Gregorian Calendar. This can represent:

6777

#

6778

# * A full date, with non-zero year, month and day values

6779

# * A month and day value, with a zero year, e.g. an anniversary

6780

# * A year on its own, with zero month and day values

6781

# * A year and month value, with a zero day, e.g. a credit card expiration date

6782

#

6783

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6784

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6785

# a year.

6786

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6787

# month and day.

6788

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6789

# if specifying a year by itself or a year and month where the day is not

6790

# significant.

6791

},

6792

"stringValue": "A String", # string

6793

"integerValue": "A String", # integer

6794

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6795

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6796

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6797

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6798

# to allow the value "24:00:00" for scenarios like business closing time.

6799

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6800

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6801

# allow the value 60 if it allows leap-seconds.

6802

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6803

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6804

"booleanValue": True or False, # boolean

6805

"floatValue": 3.14, # float

6806

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6807

},

6808

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6809

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

6810

# Bucketing transformation can provide all of this functionality,

6811

# but requires more configuration. This message is provided as a convenience to

6812

# the user for simple bucketing strategies.

6813

#

6814

# The transformed value will be a hyphenated string of

6815

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

6816

# all values that are within this bucket will be replaced with "10-20".

6817

#

6818

# This can be used on data of type: double, long.

6819

#

6820

# If the bound Value type differs from the type of data

6821

# being transformed, we will first attempt converting the type of the data to

6822

# be transformed to match the type of the bound before comparing.

6823

#

6824

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6825

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

6826

# grouped together into a single bucket; for example if `upper_bound` = 89,

6827

# then all values greater than 89 are replaced with the value "89+".

6828

# Note that for the purposes of inspection or transformation, the number

6829

# of bytes considered to comprise a 'Value' is based on its representation

6830

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6831

# 123456789, the number of bytes would be counted as 9, even though an

6832

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6833

"timestampValue": "A String", # timestamp

6834

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6835

# and time zone are either specified elsewhere or are not significant. The date

6836

# is relative to the Proleptic Gregorian Calendar. This can represent:

6837

#

6838

# * A full date, with non-zero year, month and day values

6839

# * A month and day value, with a zero year, e.g. an anniversary

6840

# * A year on its own, with zero month and day values

6841

# * A year and month value, with a zero day, e.g. a credit card expiration date

6842

#

6843

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6844

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6845

# a year.

6846

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6847

# month and day.

6848

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6849

# if specifying a year by itself or a year and month where the day is not

6850

# significant.

6851

},

6852

"stringValue": "A String", # string

6853

"integerValue": "A String", # integer

6854

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6855

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6856

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6857

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6858

# to allow the value "24:00:00" for scenarios like business closing time.

6859

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6860

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6861

# allow the value 60 if it allows leap-seconds.

6862

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6863

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6864

"booleanValue": True or False, # boolean

6865

"floatValue": 3.14, # float

6866

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6867

},

6868

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

6869

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

6870

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

6871

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6872

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

6873

# grouped together into a single bucket; for example if `lower_bound` = 10,

6874

# then all values less than 10 are replaced with the value "-10".

6875

# Note that for the purposes of inspection or transformation, the number

6876

# of bytes considered to comprise a 'Value' is based on its representation

6877

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6878

# 123456789, the number of bytes would be counted as 9, even though an

6879

# int64 only holds up to 8 bytes of data.

6880

"timestampValue": "A String", # timestamp

6881

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6882

# and time zone are either specified elsewhere or are not significant. The date

6883

# is relative to the Proleptic Gregorian Calendar. This can represent:

6884

#

6885

# * A full date, with non-zero year, month and day values

6886

# * A month and day value, with a zero year, e.g. an anniversary

6887

# * A year on its own, with zero month and day values

6888

# * A year and month value, with a zero day, e.g. a credit card expiration date

6889

#

6890

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6891

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6892

# a year.

6893

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6894

# month and day.

6895

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6896

# if specifying a year by itself or a year and month where the day is not

6897

# significant.

6898

},

6899

"stringValue": "A String", # string

6900

"integerValue": "A String", # integer

6901

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6902

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6903

# types are google.type.Date and `google.protobuf.Timestamp`.

6904

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6905

# to allow the value "24:00:00" for scenarios like business closing time.

6906

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6907

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6908

# allow the value 60 if it allows leap-seconds.

6909

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6910

},

6911

"booleanValue": True or False, # boolean

6912

"floatValue": 3.14, # float

6913

"dayOfWeekValue": "A String", # day of week

6914

},

6915

},

6916

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

6917

# fixed character. Masking can start from the beginning or end of the string.

6918

# This can be used on data of any type (numbers, longs, and so on) and when

6919

# de-identifying structured data we'll attempt to preserve the original data's

6920

# type. (This allows you to take a long like 123 and modify it to a string like

6921

# **3.

6922

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

6923

# characters. For example, if the input string is `555-555-5555` and you

6924

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

6925

# returns `***-**5-5555`.

6926

{ # Characters to skip when doing deidentification of a value. These will be left

6927

# alone and skipped.

6928

"charactersToSkip": "A String", # Characters to not transform when masking.

6929

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

6934

# masked. Skipped characters do not count towards this tally.

6935

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

6936

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

6937

# code or credit card number. This string must have a length of 1. If not

6938

# supplied, this value defaults to `*` for strings, and `0` for digits.

6939

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

6940

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

6941

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

6942

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

6943

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6944

},

6945

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6946

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

6947

# this transformation to apply to all findings that correspond to

6948

# infoTypes that were requested in `InspectConfig`.

6949

{ # Type of information detected by the API.

6950

"name": "A String", # Name of the information type. Either a name of your choosing when

6951

# creating a CustomInfoType, or one of the names listed

6952

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6953

# a built-in type. InfoType names should conform to the pattern

6954

# `[a-zA-Z0-9_]{1,64}`.

6955

},

6956

],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

6961

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

6962

# portion of the value.

6963

"partToExtract": "A String", # The part of the time to keep.

6964

},

6965

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

6966

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

6967

# to learn more.

6968

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

6969

# If set, must also set cryptoKey. If set, shift will be consistent for the

6970

# given context.

6971

"name": "A String", # Name describing the field.

6972

},

6973

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

6974

# range (inclusive ends). Negative means shift to earlier in time. Must not

6975

# be more than 365250 days (1000 years) each direction.

6976

#

6977

# For example, 3 means shift date to at most 3 days into the future.

6978

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

6979

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

6980

# results in the same shift for the same context and crypto_key. If

6981

# set, must also set context. Can only be applied to table items.

6982

# a key encryption key (KEK) stored by KMS).

6983

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6984

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6985

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

6986

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6987

# leaking the key. Choose another type of key if possible.

6988

"key": "A String", # Required. A 128/192/256 bit key.

6989

},

6990

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6991

# It will be discarded after the request finishes.

6992

"name": "A String", # Required. Name of the key.

6993

# This is an arbitrary string used to differentiate different keys.

6994

# A unique key is generated per name: two separate `TransientCryptoKey`

6995

# protos share the same generated key if their names are the same.

6996

# When the data crypto key is generated, this name is not used in any way

6997

# (repeating the api call will result in a different key being generated).

6998

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

6999

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7000

# The wrapped key must be a 128/192/256 bit key.

7001

# Authorization requires the following IAM permissions when sending a request

7002

# to perform a crypto transformation using a kms-wrapped crypto key:

7003

# dlp.kms.encrypt

7004

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7005

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7006

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7007

},

7008

},

7009

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

7010

},

7011

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

7012

# Uses SHA-256.

7013

# The key size must be either 32 or 64 bytes.

7014

# Outputs a base64 encoded representation of the hashed output

7015

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

7016

# Currently, only string and integer values can be hashed.

7017

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

7018

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

7019

# a key encryption key (KEK) stored by KMS).

7020

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7021

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7022

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7023

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7024

# leaking the key. Choose another type of key if possible.

7025

"key": "A String", # Required. A 128/192/256 bit key.

7026

},

7027

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7028

# It will be discarded after the request finishes.

7029

"name": "A String", # Required. Name of the key.

7030

# This is an arbitrary string used to differentiate different keys.

7031

# A unique key is generated per name: two separate `TransientCryptoKey`

7032

# protos share the same generated key if their names are the same.

7033

# When the data crypto key is generated, this name is not used in any way

7034

# (repeating the api call will result in a different key being generated).

7035

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7036

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7037

# The wrapped key must be a 128/192/256 bit key.

7038

# Authorization requires the following IAM permissions when sending a request

7039

# to perform a crypto transformation using a kms-wrapped crypto key:

7040

# dlp.kms.encrypt

7041

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7042

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7043

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7044

},

7045

},

7046

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

7047

# (FPE) with the FFX mode of operation; however when used in the

7048

# `ReidentifyContent` API method, it serves the opposite function by reversing

7049

# the surrogate back into the original identifier. The identifier must be

7050

# encoded as ASCII. For a given crypto key and context, the same identifier

7051

# will be replaced with the same surrogate. Identifiers must be at least two

7052

# characters long. In the case that the identifier is the empty string, it will

7053

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

7054

# more.

7055

#

7056

# Note: We recommend using CryptoDeterministicConfig for all use cases which

7057

# do not require preserving the input alphabet space and size, plus warrant

7058

# referential integrity.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7059

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

7060

# This annotation will be applied to the surrogate by prefixing it with

7061

# the name of the custom infoType followed by the number of

7062

# characters comprising the surrogate. The following scheme defines the

7063

# format: info_type_name(surrogate_character_count):surrogate

7064

#

7065

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

7066

# the surrogate is 'abc', the full replacement value

7067

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

7068

#

7069

# This annotation identifies the surrogate when inspecting content using the

7070

# custom infoType

7071

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

7072

# This facilitates reversal of the surrogate when it occurs in free text.

7073

#

7074

# In order for inspection to work properly, the name of this infoType must

7075

# not occur naturally anywhere in your data; otherwise, inspection may

7076

# find a surrogate that does not correspond to an actual identifier.

7077

# Therefore, choose your custom infoType name carefully after considering

7078

# what your data looks like. One way to select a name that has a high chance

7079

# of yielding reliable detection is to include one or more unicode characters

7080

# that are highly improbable to exist in your data.

7081

# For example, assuming your data is entered from a regular ASCII keyboard,

7082

# the symbol with the hex code point 29DD might be used like so:

7083

# ⧝MY_TOKEN_TYPE

7084

"name": "A String", # Name of the information type. Either a name of your choosing when

7085

# creating a CustomInfoType, or one of the names listed

7086

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

7087

# a built-in type. InfoType names should conform to the pattern

7088

# `[a-zA-Z0-9_]{1,64}`.

7089

},

7090

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

7091

# identifier in two different contexts won't be given the same surrogate. If

7092

# the context is not set, a default tweak will be used.

7093

#

7094

# If the context is set but:

7095

#

7096

# 1. there is no record present when transforming a given value or

7097

# 1. the field is not present when transforming a given value,

7098

#

7099

# a default tweak will be used.

7100

#

7101

# Note that case (1) is expected when an `InfoTypeTransformation` is

7102

# applied to both structured and non-structured `ContentItem`s.

7103

# Currently, the referenced field may be of value type integer or string.

7104

#

7105

# The tweak is constructed as a sequence of bytes in big endian byte order

7106

# such that:

7107

#

7108

# - a 64 bit integer is encoded followed by a single byte of value 1

7109

# - a string is encoded in UTF-8 format followed by a single byte of value 2

7110

"name": "A String", # Name describing the field.

7111

},

7112

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

7113

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

7114

# a key encryption key (KEK) stored by KMS).

7115

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7116

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7117

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7118

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7119

# leaking the key. Choose another type of key if possible.

7120

"key": "A String", # Required. A 128/192/256 bit key.

7121

},

7122

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7123

# It will be discarded after the request finishes.

7124

"name": "A String", # Required. Name of the key.

7125

# This is an arbitrary string used to differentiate different keys.

7126

# A unique key is generated per name: two separate `TransientCryptoKey`

7127

# protos share the same generated key if their names are the same.

7128

# When the data crypto key is generated, this name is not used in any way

7129

# (repeating the api call will result in a different key being generated).

7130

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7131

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7132

# The wrapped key must be a 128/192/256 bit key.

7133

# Authorization requires the following IAM permissions when sending a request

7134

# to perform a crypto transformation using a kms-wrapped crypto key:

7135

# dlp.kms.encrypt

7136

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7137

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7138

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7139

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7140

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

7141

# that the FFX mode natively supports. This happens before/after

7142

# encryption/decryption.

7143

# Each character listed must appear only once.

7144

# Number of characters must be in the range [2, 95].

7145

# This must be encoded as ASCII.

7146

# The order of characters does not matter.

7147

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7148

},

7149

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

7150

# input. Outputs a base64 encoded representation of the encrypted output.

7151

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

7152

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

7153

# This annotation will be applied to the surrogate by prefixing it with

7154

# the name of the custom info type followed by the number of

7155

# characters comprising the surrogate. The following scheme defines the

7156

# format: {info type name}({surrogate character count}):{surrogate}

7157

#

7158

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

7159

# the surrogate is 'abc', the full replacement value

7160

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

7161

#

7162

# This annotation identifies the surrogate when inspecting content using the

7163

# custom info type 'Surrogate'. This facilitates reversal of the

7164

# surrogate when it occurs in free text.

7165

#

7166

# Note: For record transformations where the entire cell in a table is being

7167

# transformed, surrogates are not mandatory. Surrogates are used to denote

7168

# the location of the token and are necessary for re-identification in free

7169

# form text.

7170

#

7171

# In order for inspection to work properly, the name of this info type must

7172

# not occur naturally anywhere in your data; otherwise, inspection may either

7173

#

7174

# - reverse a surrogate that does not correspond to an actual identifier

7175

# - be unable to parse the surrogate and result in an error

7176

#

7177

# Therefore, choose your custom info type name carefully after considering

7178

# what your data looks like. One way to select a name that has a high chance

7179

# of yielding reliable detection is to include one or more unicode characters

7180

# that are highly improbable to exist in your data.

7181

# For example, assuming your data is entered from a regular ASCII keyboard,

7182

# the symbol with the hex code point 29DD might be used like so:

7183

# ⧝MY_TOKEN_TYPE.

7184

"name": "A String", # Name of the information type. Either a name of your choosing when

7185

# creating a CustomInfoType, or one of the names listed

7186

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

7187

# a built-in type. InfoType names should conform to the pattern

7188

# `[a-zA-Z0-9_]{1,64}`.

7189

},

7190

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

7191

# referential integrity such that the same identifier in two different

7192

# contexts will be given a distinct surrogate. The context is appended to

7193

# plaintext value being encrypted. On decryption the provided context is

7194

# validated against the value used during encryption. If a context was

7195

# provided during encryption, same context must be provided during decryption

7196

# as well.

7197

#

7198

# If the context is not set, plaintext would be used as is for encryption.

7199

# If the context is set but:

7200

#

7201

# 1. there is no record present when transforming a given value or

7202

# 2. the field is not present when transforming a given value,

7203

#

7204

# plaintext would be used as is for encryption.

7205

#

7206

# Note that case (1) is expected when an `InfoTypeTransformation` is

7207

# applied to both structured and non-structured `ContentItem`s.

7208

"name": "A String", # Name describing the field.

7209

},

7210

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

7211

# a key encryption key (KEK) stored by KMS).

7212

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7213

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7214

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7215

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7216

# leaking the key. Choose another type of key if possible.

7217

"key": "A String", # Required. A 128/192/256 bit key.

7218

},

7219

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7220

# It will be discarded after the request finishes.

7221

"name": "A String", # Required. Name of the key.

7222

# This is an arbitrary string used to differentiate different keys.

7223

# A unique key is generated per name: two separate `TransientCryptoKey`

7224

# protos share the same generated key if their names are the same.

7225

# When the data crypto key is generated, this name is not used in any way

7226

# (repeating the api call will result in a different key being generated).

7227

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7228

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7229

# The wrapped key must be a 128/192/256 bit key.

7230

# Authorization requires the following IAM permissions when sending a request

7231

# to perform a crypto transformation using a kms-wrapped crypto key:

7232

# dlp.kms.encrypt

7233

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7234

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7235

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7236

},

7237

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7238

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

7239

# replacement values are dynamically provided by the user for custom behavior,

7240

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

7241

# This can be used on

7242

# data of type: number, long, string, timestamp.

7243

# If the bound `Value` type differs from the type of data being transformed, we

7244

# will first attempt converting the type of the data to be transformed to match

7245

# the type of the bound before comparing.

7246

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

7247

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

7248

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7249

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

7250

# the default behavior will be to hyphenate the min-max range.

7251

# Note that for the purposes of inspection or transformation, the number

7252

# of bytes considered to comprise a 'Value' is based on its representation

7253

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7254

# 123456789, the number of bytes would be counted as 9, even though an

7255

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7256

"timestampValue": "A String", # timestamp

7257

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7258

# and time zone are either specified elsewhere or are not significant. The date

7259

# is relative to the Proleptic Gregorian Calendar. This can represent:

7260

#

7261

# * A full date, with non-zero year, month and day values

7262

# * A month and day value, with a zero year, e.g. an anniversary

7263

# * A year on its own, with zero month and day values

7264

# * A year and month value, with a zero day, e.g. a credit card expiration date

7265

#

7266

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7267

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7268

# a year.

7269

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7270

# month and day.

7271

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7272

# if specifying a year by itself or a year and month where the day is not

7273

# significant.

7274

},

7275

"stringValue": "A String", # string

7276

"integerValue": "A String", # integer

7277

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7278

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7279

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7280

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7281

# to allow the value "24:00:00" for scenarios like business closing time.

7282

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7283

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7284

# allow the value 60 if it allows leap-seconds.

7285

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7286

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7287

"booleanValue": True or False, # boolean

7288

"floatValue": 3.14, # float

7289

"dayOfWeekValue": "A String", # day of week

7290

},

7291

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

7292

# used.

7293

# Note that for the purposes of inspection or transformation, the number

7294

# of bytes considered to comprise a 'Value' is based on its representation

7295

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7296

# 123456789, the number of bytes would be counted as 9, even though an

7297

# int64 only holds up to 8 bytes of data.

7298

"timestampValue": "A String", # timestamp

7299

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7300

# and time zone are either specified elsewhere or are not significant. The date

7301

# is relative to the Proleptic Gregorian Calendar. This can represent:

7302

#

7303

# * A full date, with non-zero year, month and day values

7304

# * A month and day value, with a zero year, e.g. an anniversary

7305

# * A year on its own, with zero month and day values

7306

# * A year and month value, with a zero day, e.g. a credit card expiration date

7307

#

7308

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7309

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7310

# a year.

7311

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7312

# month and day.

7313

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7314

# if specifying a year by itself or a year and month where the day is not

7315

# significant.

7316

},

7317

"stringValue": "A String", # string

7318

"integerValue": "A String", # integer

7319

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7320

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7321

# types are google.type.Date and `google.protobuf.Timestamp`.

7322

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7323

# to allow the value "24:00:00" for scenarios like business closing time.

7324

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7325

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7326

# allow the value 60 if it allows leap-seconds.

7327

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7328

},

7329

"booleanValue": True or False, # boolean

7330

"floatValue": 3.14, # float

7331

"dayOfWeekValue": "A String", # day of week

7332

},

7333

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

7334

# Note that for the purposes of inspection or transformation, the number

7335

# of bytes considered to comprise a 'Value' is based on its representation

7336

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7337

# 123456789, the number of bytes would be counted as 9, even though an

7338

# int64 only holds up to 8 bytes of data.

7339

"timestampValue": "A String", # timestamp

7340

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7341

# and time zone are either specified elsewhere or are not significant. The date

7342

# is relative to the Proleptic Gregorian Calendar. This can represent:

7343

#

7344

# * A full date, with non-zero year, month and day values

7345

# * A month and day value, with a zero year, e.g. an anniversary

7346

# * A year on its own, with zero month and day values

7347

# * A year and month value, with a zero day, e.g. a credit card expiration date

7348

#

7349

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7350

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7351

# a year.

7352

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7353

# month and day.

7354

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7355

# if specifying a year by itself or a year and month where the day is not

7356

# significant.

7357

},

7358

"stringValue": "A String", # string

7359

"integerValue": "A String", # integer

7360

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7361

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7362

# types are google.type.Date and `google.protobuf.Timestamp`.

7363

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7364

# to allow the value "24:00:00" for scenarios like business closing time.

7365

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7366

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7367

# allow the value 60 if it allows leap-seconds.

7368

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7369

},

7370

"booleanValue": True or False, # boolean

7371

"floatValue": 3.14, # float

7372

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7377

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

7378

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

7379

# output would be 'My phone number is '.

7380

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7381

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

7382

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

7383

# Note that for the purposes of inspection or transformation, the number

7384

# of bytes considered to comprise a 'Value' is based on its representation

7385

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7386

# 123456789, the number of bytes would be counted as 9, even though an

7387

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7388

"timestampValue": "A String", # timestamp

7389

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7390

# and time zone are either specified elsewhere or are not significant. The date

7391

# is relative to the Proleptic Gregorian Calendar. This can represent:

7392

#

7393

# * A full date, with non-zero year, month and day values

7394

# * A month and day value, with a zero year, e.g. an anniversary

7395

# * A year on its own, with zero month and day values

7396

# * A year and month value, with a zero day, e.g. a credit card expiration date

7397

#

7398

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7399

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7400

# a year.

7401

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7402

# month and day.

7403

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7404

# if specifying a year by itself or a year and month where the day is not

7405

# significant.

7406

},

7407

"stringValue": "A String", # string

7408

"integerValue": "A String", # integer

7409

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7410

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7411

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7412

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7413

# to allow the value "24:00:00" for scenarios like business closing time.

7414

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7415

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7416

# allow the value 60 if it allows leap-seconds.

7417

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7418

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7419

"booleanValue": True or False, # boolean

7420

"floatValue": 3.14, # float

7421

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7422

},

7423

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7424

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

7425

# Bucketing transformation can provide all of this functionality,

7426

# but requires more configuration. This message is provided as a convenience to

7427

# the user for simple bucketing strategies.

7428

#

7429

# The transformed value will be a hyphenated string of

7430

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

7431

# all values that are within this bucket will be replaced with "10-20".

7432

#

7433

# This can be used on data of type: double, long.

7434

#

7435

# If the bound Value type differs from the type of data

7436

# being transformed, we will first attempt converting the type of the data to

7437

# be transformed to match the type of the bound before comparing.

7438

#

7439

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7440

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

7441

# grouped together into a single bucket; for example if `upper_bound` = 89,

7442

# then all values greater than 89 are replaced with the value "89+".

7443

# Note that for the purposes of inspection or transformation, the number

7444

# of bytes considered to comprise a 'Value' is based on its representation

7445

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7446

# 123456789, the number of bytes would be counted as 9, even though an

7447

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7448

"timestampValue": "A String", # timestamp

7449

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7450

# and time zone are either specified elsewhere or are not significant. The date

7451

# is relative to the Proleptic Gregorian Calendar. This can represent:

7452

#

7453

# * A full date, with non-zero year, month and day values

7454

# * A month and day value, with a zero year, e.g. an anniversary

7455

# * A year on its own, with zero month and day values

7456

# * A year and month value, with a zero day, e.g. a credit card expiration date

7457

#

7458

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7459

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7460

# a year.

7461

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7462

# month and day.

7463

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7464

# if specifying a year by itself or a year and month where the day is not

7465

# significant.

7466

},

7467

"stringValue": "A String", # string

7468

"integerValue": "A String", # integer

7469

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7470

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7471

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7472

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7473

# to allow the value "24:00:00" for scenarios like business closing time.

7474

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7475

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7476

# allow the value 60 if it allows leap-seconds.

7477

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7478

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7479

"booleanValue": True or False, # boolean

7480

"floatValue": 3.14, # float

7481

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7482

},

7483

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

7484

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

7485

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

7486

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7487

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

7488

# grouped together into a single bucket; for example if `lower_bound` = 10,

7489

# then all values less than 10 are replaced with the value "-10".

7490

# Note that for the purposes of inspection or transformation, the number

7491

# of bytes considered to comprise a 'Value' is based on its representation

7492

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7493

# 123456789, the number of bytes would be counted as 9, even though an

7494

# int64 only holds up to 8 bytes of data.

7495

"timestampValue": "A String", # timestamp

7496

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7497

# and time zone are either specified elsewhere or are not significant. The date

7498

# is relative to the Proleptic Gregorian Calendar. This can represent:

7499

#

7500

# * A full date, with non-zero year, month and day values

7501

# * A month and day value, with a zero year, e.g. an anniversary

7502

# * A year on its own, with zero month and day values

7503

# * A year and month value, with a zero day, e.g. a credit card expiration date

7504

#

7505

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7506

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7507

# a year.

7508

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7509

# month and day.

7510

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7511

# if specifying a year by itself or a year and month where the day is not

7512

# significant.

7513

},

7514

"stringValue": "A String", # string

7515

"integerValue": "A String", # integer

7516

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7517

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7518

# types are google.type.Date and `google.protobuf.Timestamp`.

7519

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7520

# to allow the value "24:00:00" for scenarios like business closing time.

7521

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7522

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7523

# allow the value 60 if it allows leap-seconds.

7524

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7525

},

7526

"booleanValue": True or False, # boolean

7527

"floatValue": 3.14, # float

7528

"dayOfWeekValue": "A String", # day of week

7529

},

7530

},

7531

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

7532

# fixed character. Masking can start from the beginning or end of the string.

7533

# This can be used on data of any type (numbers, longs, and so on) and when

7534

# de-identifying structured data we'll attempt to preserve the original data's

7535

# type. (This allows you to take a long like 123 and modify it to a string like

7536

# **3.

7537

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

7538

# characters. For example, if the input string is `555-555-5555` and you

7539

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

7540

# returns `***-**5-5555`.

7541

{ # Characters to skip when doing deidentification of a value. These will be left

7542

# alone and skipped.

7543

"charactersToSkip": "A String", # Characters to not transform when masking.

7544

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

7549

# masked. Skipped characters do not count towards this tally.

7550

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

7551

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

7552

# code or credit card number. This string must have a length of 1. If not

7553

# supplied, this value defaults to `*` for strings, and `0` for digits.

7554

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

7555

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

7556

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

7557

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

7558

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7559

},

7560

},

7561

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

7562

# given `RecordCondition`. The conditions are allowed to reference fields

7563

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

7568

# column for the same record is within a specific range.

7569

# - Redact a field if the date of birth field is greater than 85.

7570

# a field.

7571

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

7572

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

7573

# only supported value is `AND`.

7574

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

7575

"conditions": [ # A collection of conditions.

7576

{ # The field type of `value` and `field` do not need to match to be

7577

# considered equal, but not all comparisons are possible.

7578

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

7579

# but all other comparisons are invalid with incompatible types.

7580

# A `value` of type:

7581

#

7582

# - `string` can be compared against all other types

7583

# - `boolean` can only be compared against other booleans

7584

# - `integer` can be compared against doubles or a string if the string value

7585

# can be parsed as an integer.

7586

# - `double` can be compared against integers or a string if the string can

7587

# be parsed as a double.

7588

# - `Timestamp` can be compared against strings in RFC 3339 date string

7589

# format.

7590

# - `TimeOfDay` can be compared against timestamps and strings in the format

7591

# of 'HH:mm:ss'.

7592

#

7593

# If we fail to compare do to type mismatch, a warning will be given and

7594

# the condition will evaluate to false.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7595

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

7596

# Note that for the purposes of inspection or transformation, the number

7597

# of bytes considered to comprise a 'Value' is based on its representation

7598

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7599

# 123456789, the number of bytes would be counted as 9, even though an

7600

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7601

"timestampValue": "A String", # timestamp

7602

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7603

# and time zone are either specified elsewhere or are not significant. The date

7604

# is relative to the Proleptic Gregorian Calendar. This can represent:

7605

#

7606

# * A full date, with non-zero year, month and day values

7607

# * A month and day value, with a zero year, e.g. an anniversary

7608

# * A year on its own, with zero month and day values

7609

# * A year and month value, with a zero day, e.g. a credit card expiration date

7610

#

7611

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7612

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7613

# a year.

7614

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7615

# month and day.

7616

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7617

# if specifying a year by itself or a year and month where the day is not

7618

# significant.

7619

},

7620

"stringValue": "A String", # string

7621

"integerValue": "A String", # integer

7622

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7623

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7624

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7625

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7626

# to allow the value "24:00:00" for scenarios like business closing time.

7627

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7628

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7629

# allow the value 60 if it allows leap-seconds.

7630

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7631

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7632

"booleanValue": True or False, # boolean

7633

"floatValue": 3.14, # float

7634

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7635

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7636

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

7637

"name": "A String", # Name describing the field.

7638

},

7639

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

},

],

},

},

},

},

],

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that

7648

# match any suppression rule are omitted from the output.

7649

{ # Configuration to suppress records whose suppression conditions evaluate to

7650

# true.

7651

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

7652

# evaluated to be suppressed from the transformed content.

7653

# a field.

7654

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

7655

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

7656

# only supported value is `AND`.

7657

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

7658

"conditions": [ # A collection of conditions.

7659

{ # The field type of `value` and `field` do not need to match to be

7660

# considered equal, but not all comparisons are possible.

7661

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

7662

# but all other comparisons are invalid with incompatible types.

7663

# A `value` of type:

7664

#

7665

# - `string` can be compared against all other types

7666

# - `boolean` can only be compared against other booleans

7667

# - `integer` can be compared against doubles or a string if the string value

7668

# can be parsed as an integer.

7669

# - `double` can be compared against integers or a string if the string can

7670

# be parsed as a double.

7671

# - `Timestamp` can be compared against strings in RFC 3339 date string

7672

# format.

7673

# - `TimeOfDay` can be compared against timestamps and strings in the format

7674

# of 'HH:mm:ss'.

7675

#

7676

# If we fail to compare do to type mismatch, a warning will be given and

7677

# the condition will evaluate to false.

7678

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

7679

# Note that for the purposes of inspection or transformation, the number

7680

# of bytes considered to comprise a 'Value' is based on its representation

7681

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7682

# 123456789, the number of bytes would be counted as 9, even though an

7683

# int64 only holds up to 8 bytes of data.

7684

"timestampValue": "A String", # timestamp

7685

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7686

# and time zone are either specified elsewhere or are not significant. The date

7687

# is relative to the Proleptic Gregorian Calendar. This can represent:

7688

#

7689

# * A full date, with non-zero year, month and day values

7690

# * A month and day value, with a zero year, e.g. an anniversary

7691

# * A year on its own, with zero month and day values

7692

# * A year and month value, with a zero day, e.g. a credit card expiration date

7693

#

7694

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7695

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7696

# a year.

7697

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7698

# month and day.

7699

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7700

# if specifying a year by itself or a year and month where the day is not

7701

# significant.

7702

},

7703

"stringValue": "A String", # string

7704

"integerValue": "A String", # integer

7705

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7706

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7707

# types are google.type.Date and `google.protobuf.Timestamp`.

7708

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7709

# to allow the value "24:00:00" for scenarios like business closing time.

7710

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7711

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7712

# allow the value 60 if it allows leap-seconds.

7713

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7714

},

7715

"booleanValue": True or False, # boolean

7716

"floatValue": 3.14, # float

7717

"dayOfWeekValue": "A String", # day of week

7718

},

7719

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

7720

"name": "A String", # Name describing the field.

7721

},

7722

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

},

},

],

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7731

},

7732

"item": { # Container structure for the content to inspect. # The item to re-identify. Will be treated as text.

7733

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

7734

"data": "A String", # Content data to inspect or redact.

7735

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

7736

},

7737

"value": "A String", # String data to inspect or redact.

7738

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

7739

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

7740

# learn more.

7741

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

7742

# learn more.

7743

"rows": [ # Rows of the table.

7744

{ # Values of the row.

7745

"values": [ # Individual cells.

7746

{ # Set of primitive values supported by the system.

7747

# Note that for the purposes of inspection or transformation, the number

7748

# of bytes considered to comprise a 'Value' is based on its representation

7749

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7750

# 123456789, the number of bytes would be counted as 9, even though an

7751

# int64 only holds up to 8 bytes of data.

7752

"timestampValue": "A String", # timestamp

7753

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7754

# and time zone are either specified elsewhere or are not significant. The date

7755

# is relative to the Proleptic Gregorian Calendar. This can represent:

7756

#

7757

# * A full date, with non-zero year, month and day values

7758

# * A month and day value, with a zero year, e.g. an anniversary

7759

# * A year on its own, with zero month and day values

7760

# * A year and month value, with a zero day, e.g. a credit card expiration date

7761

#

7762

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7763

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7764

# a year.

7765

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7766

# month and day.

7767

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7768

# if specifying a year by itself or a year and month where the day is not

7769

# significant.

7770

},

7771

"stringValue": "A String", # string

7772

"integerValue": "A String", # integer

7773

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7774

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7775

# types are google.type.Date and `google.protobuf.Timestamp`.

7776

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7777

# to allow the value "24:00:00" for scenarios like business closing time.

7778

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7779

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7780

# allow the value 60 if it allows leap-seconds.

7781

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7782

},

7783

"booleanValue": True or False, # boolean

7784

"floatValue": 3.14, # float

7785

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7786

},

7787

],

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7788

},

7789

],

7790

"headers": [ # Headers of the table.

7791

{ # General identifier of a data field in a storage service.

7792

"name": "A String", # Name describing the field.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7797

"inspectTemplateName": "A String", # Template to use. Any configuration directly specified in

7798

# `inspect_config` will override those set in the template. Singular fields

7799

# that are set in this request will replace their corresponding fields in the

7800

# template. Repeated fields are appended. Singular sub-messages and groups

7801

# are recursively merged.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7802

}

7803

7804

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

7811

7812

{ # Results of re-identifying a item.

7813

"overview": { # Overview of the modifications that occurred. # An overview of the changes that were made to the `item`.

7814

"transformationSummaries": [ # Transformations applied to the dataset.

7815

{ # Summary of a single transformation.

7816

# Only one of 'transformation', 'field_transformation', or 'record_suppress'

7817

# will be set.

7818

"fieldTransformations": [ # The field transformation that was applied.

7819

# If multiple field transformations are requested for a single field,

7820

# this list will contain all of them; otherwise, only one is supplied.

7821

{ # The transformation to apply to the field.

7822

"fields": [ # Required. Input field(s) to apply the transformation to.

7823

{ # General identifier of a data field in a storage service.

7824

"name": "A String", # Name describing the field.

7825

},

7826

],

7827

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

7828

# transform content that matches an `InfoType`.

7829

# apply various `PrimitiveTransformation`s to each finding, where the

7830

# transformation is applied to only values that were identified as a specific

7831

# info_type.

7832

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

7833

# for a given infoType.

7834

{ # A transformation to apply to text that is identified as a specific

7835

# info_type.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7836

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

7837

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

7838

# portion of the value.

7839

"partToExtract": "A String", # The part of the time to keep.

7840

},

7841

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

7842

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

7843

# to learn more.

7844

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

7845

# If set, must also set cryptoKey. If set, shift will be consistent for the

7846

# given context.

7847

"name": "A String", # Name describing the field.

7848

},

7849

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

7850

# range (inclusive ends). Negative means shift to earlier in time. Must not

7851

# be more than 365250 days (1000 years) each direction.

7852

#

7853

# For example, 3 means shift date to at most 3 days into the future.

7854

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

7855

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

7856

# results in the same shift for the same context and crypto_key. If

7857

# set, must also set context. Can only be applied to table items.

7858

# a key encryption key (KEK) stored by KMS).

7859

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7860

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7861

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7862

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7863

# leaking the key. Choose another type of key if possible.

7864

"key": "A String", # Required. A 128/192/256 bit key.

7865

},

7866

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7867

# It will be discarded after the request finishes.

7868

"name": "A String", # Required. Name of the key.

7869

# This is an arbitrary string used to differentiate different keys.

7870

# A unique key is generated per name: two separate `TransientCryptoKey`

7871

# protos share the same generated key if their names are the same.

7872

# When the data crypto key is generated, this name is not used in any way

7873

# (repeating the api call will result in a different key being generated).

7874

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7875

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7876

# The wrapped key must be a 128/192/256 bit key.

7877

# Authorization requires the following IAM permissions when sending a request

7878

# to perform a crypto transformation using a kms-wrapped crypto key:

7879

# dlp.kms.encrypt

7880

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7881

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7882

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7883

},

7884

},

7885

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

7886

},

7887

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

7888

# Uses SHA-256.

7889

# The key size must be either 32 or 64 bytes.

7890

# Outputs a base64 encoded representation of the hashed output

7891

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

7892

# Currently, only string and integer values can be hashed.

7893

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

7894

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

7895

# a key encryption key (KEK) stored by KMS).

7896

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7897

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7898

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7899

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7900

# leaking the key. Choose another type of key if possible.

7901

"key": "A String", # Required. A 128/192/256 bit key.

7902

},

7903

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7904

# It will be discarded after the request finishes.

7905

"name": "A String", # Required. Name of the key.

7906

# This is an arbitrary string used to differentiate different keys.

7907

# A unique key is generated per name: two separate `TransientCryptoKey`

7908

# protos share the same generated key if their names are the same.

7909

# When the data crypto key is generated, this name is not used in any way

7910

# (repeating the api call will result in a different key being generated).

7911

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

7912

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7913

# The wrapped key must be a 128/192/256 bit key.

7914

# Authorization requires the following IAM permissions when sending a request

7915

# to perform a crypto transformation using a kms-wrapped crypto key:

7916

# dlp.kms.encrypt

7917

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7918

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7919

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7920

},

7921

},

7922

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

7923

# (FPE) with the FFX mode of operation; however when used in the

7924

# `ReidentifyContent` API method, it serves the opposite function by reversing

7925

# the surrogate back into the original identifier. The identifier must be

7926

# encoded as ASCII. For a given crypto key and context, the same identifier

7927

# will be replaced with the same surrogate. Identifiers must be at least two

7928

# characters long. In the case that the identifier is the empty string, it will

7929

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

7930

# more.

7931

#

7932

# Note: We recommend using CryptoDeterministicConfig for all use cases which

7933

# do not require preserving the input alphabet space and size, plus warrant

7934

# referential integrity.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7935

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

7936

# This annotation will be applied to the surrogate by prefixing it with

7937

# the name of the custom infoType followed by the number of

7938

# characters comprising the surrogate. The following scheme defines the

7939

# format: info_type_name(surrogate_character_count):surrogate

7940

#

7941

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

7942

# the surrogate is 'abc', the full replacement value

7943

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

7944

#

7945

# This annotation identifies the surrogate when inspecting content using the

7946

# custom infoType

7947

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

7948

# This facilitates reversal of the surrogate when it occurs in free text.

7949

#

7950

# In order for inspection to work properly, the name of this infoType must

7951

# not occur naturally anywhere in your data; otherwise, inspection may

7952

# find a surrogate that does not correspond to an actual identifier.

7953

# Therefore, choose your custom infoType name carefully after considering

7954

# what your data looks like. One way to select a name that has a high chance

7955

# of yielding reliable detection is to include one or more unicode characters

7956

# that are highly improbable to exist in your data.

7957

# For example, assuming your data is entered from a regular ASCII keyboard,

7958

# the symbol with the hex code point 29DD might be used like so:

7959

# ⧝MY_TOKEN_TYPE

7960

"name": "A String", # Name of the information type. Either a name of your choosing when

7961

# creating a CustomInfoType, or one of the names listed

7962

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

7963

# a built-in type. InfoType names should conform to the pattern

7964

# `[a-zA-Z0-9_]{1,64}`.

7965

},

7966

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

7967

# identifier in two different contexts won't be given the same surrogate. If

7968

# the context is not set, a default tweak will be used.

7969

#

7970

# If the context is set but:

7971

#

7972

# 1. there is no record present when transforming a given value or

7973

# 1. the field is not present when transforming a given value,

7974

#

7975

# a default tweak will be used.

7976

#

7977

# Note that case (1) is expected when an `InfoTypeTransformation` is

7978

# applied to both structured and non-structured `ContentItem`s.

7979

# Currently, the referenced field may be of value type integer or string.

7980

#

7981

# The tweak is constructed as a sequence of bytes in big endian byte order

7982

# such that:

7983

#

7984

# - a 64 bit integer is encoded followed by a single byte of value 1

7985

# - a string is encoded in UTF-8 format followed by a single byte of value 2

7986

"name": "A String", # Name describing the field.

7987

},

7988

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

7989

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

7990

# a key encryption key (KEK) stored by KMS).

7991

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7992

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7993

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

7994

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7995

# leaking the key. Choose another type of key if possible.

7996

"key": "A String", # Required. A 128/192/256 bit key.

7997

},

7998

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7999

# It will be discarded after the request finishes.

8000

"name": "A String", # Required. Name of the key.

8001

# This is an arbitrary string used to differentiate different keys.

8002

# A unique key is generated per name: two separate `TransientCryptoKey`

8003

# protos share the same generated key if their names are the same.

8004

# When the data crypto key is generated, this name is not used in any way

8005

# (repeating the api call will result in a different key being generated).

8006

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8007

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8008

# The wrapped key must be a 128/192/256 bit key.

8009

# Authorization requires the following IAM permissions when sending a request

8010

# to perform a crypto transformation using a kms-wrapped crypto key:

8011

# dlp.kms.encrypt

8012

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8013

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8014

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8015

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8016

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

8017

# that the FFX mode natively supports. This happens before/after

8018

# encryption/decryption.

8019

# Each character listed must appear only once.

8020

# Number of characters must be in the range [2, 95].

8021

# This must be encoded as ASCII.

8022

# The order of characters does not matter.

8023

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8024

},

8025

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

8026

# input. Outputs a base64 encoded representation of the encrypted output.

8027

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

8028

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

8029

# This annotation will be applied to the surrogate by prefixing it with

8030

# the name of the custom info type followed by the number of

8031

# characters comprising the surrogate. The following scheme defines the

8032

# format: {info type name}({surrogate character count}):{surrogate}

8033

#

8034

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

8035

# the surrogate is 'abc', the full replacement value

8036

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

8037

#

8038

# This annotation identifies the surrogate when inspecting content using the

8039

# custom info type 'Surrogate'. This facilitates reversal of the

8040

# surrogate when it occurs in free text.

8041

#

8042

# Note: For record transformations where the entire cell in a table is being

8043

# transformed, surrogates are not mandatory. Surrogates are used to denote

8044

# the location of the token and are necessary for re-identification in free

8045

# form text.

8046

#

8047

# In order for inspection to work properly, the name of this info type must

8048

# not occur naturally anywhere in your data; otherwise, inspection may either

8049

#

8050

# - reverse a surrogate that does not correspond to an actual identifier

8051

# - be unable to parse the surrogate and result in an error

8052

#

8053

# Therefore, choose your custom info type name carefully after considering

8054

# what your data looks like. One way to select a name that has a high chance

8055

# of yielding reliable detection is to include one or more unicode characters

8056

# that are highly improbable to exist in your data.

8057

# For example, assuming your data is entered from a regular ASCII keyboard,

8058

# the symbol with the hex code point 29DD might be used like so:

8059

# ⧝MY_TOKEN_TYPE.

8060

"name": "A String", # Name of the information type. Either a name of your choosing when

8061

# creating a CustomInfoType, or one of the names listed

8062

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

8063

# a built-in type. InfoType names should conform to the pattern

8064

# `[a-zA-Z0-9_]{1,64}`.

8065

},

8066

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

8067

# referential integrity such that the same identifier in two different

8068

# contexts will be given a distinct surrogate. The context is appended to

8069

# plaintext value being encrypted. On decryption the provided context is

8070

# validated against the value used during encryption. If a context was

8071

# provided during encryption, same context must be provided during decryption

8072

# as well.

8073

#

8074

# If the context is not set, plaintext would be used as is for encryption.

8075

# If the context is set but:

8076

#

8077

# 1. there is no record present when transforming a given value or

8078

# 2. the field is not present when transforming a given value,

8079

#

8080

# plaintext would be used as is for encryption.

8081

#

8082

# Note that case (1) is expected when an `InfoTypeTransformation` is

8083

# applied to both structured and non-structured `ContentItem`s.

8084

"name": "A String", # Name describing the field.

8085

},

8086

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

8087

# a key encryption key (KEK) stored by KMS).

8088

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8089

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8090

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8091

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8092

# leaking the key. Choose another type of key if possible.

8093

"key": "A String", # Required. A 128/192/256 bit key.

8094

},

8095

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8096

# It will be discarded after the request finishes.

8097

"name": "A String", # Required. Name of the key.

8098

# This is an arbitrary string used to differentiate different keys.

8099

# A unique key is generated per name: two separate `TransientCryptoKey`

8100

# protos share the same generated key if their names are the same.

8101

# When the data crypto key is generated, this name is not used in any way

8102

# (repeating the api call will result in a different key being generated).

8103

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8104

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8105

# The wrapped key must be a 128/192/256 bit key.

8106

# Authorization requires the following IAM permissions when sending a request

8107

# to perform a crypto transformation using a kms-wrapped crypto key:

8108

# dlp.kms.encrypt

8109

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8110

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8111

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8112

},

8113

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8114

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

8115

# replacement values are dynamically provided by the user for custom behavior,

8116

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

8117

# This can be used on

8118

# data of type: number, long, string, timestamp.

8119

# If the bound `Value` type differs from the type of data being transformed, we

8120

# will first attempt converting the type of the data to be transformed to match

8121

# the type of the bound before comparing.

8122

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

8123

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

8124

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8125

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

8126

# the default behavior will be to hyphenate the min-max range.

8127

# Note that for the purposes of inspection or transformation, the number

8128

# of bytes considered to comprise a 'Value' is based on its representation

8129

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8130

# 123456789, the number of bytes would be counted as 9, even though an

8131

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8132

"timestampValue": "A String", # timestamp

8133

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8134

# and time zone are either specified elsewhere or are not significant. The date

8135

# is relative to the Proleptic Gregorian Calendar. This can represent:

8136

#

8137

# * A full date, with non-zero year, month and day values

8138

# * A month and day value, with a zero year, e.g. an anniversary

8139

# * A year on its own, with zero month and day values

8140

# * A year and month value, with a zero day, e.g. a credit card expiration date

8141

#

8142

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8143

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8144

# a year.

8145

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8146

# month and day.

8147

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8148

# if specifying a year by itself or a year and month where the day is not

8149

# significant.

8150

},

8151

"stringValue": "A String", # string

8152

"integerValue": "A String", # integer

8153

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8154

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8155

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8156

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8157

# to allow the value "24:00:00" for scenarios like business closing time.

8158

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8159

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8160

# allow the value 60 if it allows leap-seconds.

8161

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8162

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8163

"booleanValue": True or False, # boolean

8164

"floatValue": 3.14, # float

8165

"dayOfWeekValue": "A String", # day of week

8166

},

8167

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

8168

# used.

8169

# Note that for the purposes of inspection or transformation, the number

8170

# of bytes considered to comprise a 'Value' is based on its representation

8171

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8172

# 123456789, the number of bytes would be counted as 9, even though an

8173

# int64 only holds up to 8 bytes of data.

8174

"timestampValue": "A String", # timestamp

8175

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8176

# and time zone are either specified elsewhere or are not significant. The date

8177

# is relative to the Proleptic Gregorian Calendar. This can represent:

8178

#

8179

# * A full date, with non-zero year, month and day values

8180

# * A month and day value, with a zero year, e.g. an anniversary

8181

# * A year on its own, with zero month and day values

8182

# * A year and month value, with a zero day, e.g. a credit card expiration date

8183

#

8184

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8185

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8186

# a year.

8187

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8188

# month and day.

8189

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8190

# if specifying a year by itself or a year and month where the day is not

8191

# significant.

8192

},

8193

"stringValue": "A String", # string

8194

"integerValue": "A String", # integer

8195

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8196

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8197

# types are google.type.Date and `google.protobuf.Timestamp`.

8198

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8199

# to allow the value "24:00:00" for scenarios like business closing time.

8200

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8201

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8202

# allow the value 60 if it allows leap-seconds.

8203

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8204

},

8205

"booleanValue": True or False, # boolean

8206

"floatValue": 3.14, # float

8207

"dayOfWeekValue": "A String", # day of week

8208

},

8209

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

8210

# Note that for the purposes of inspection or transformation, the number

8211

# of bytes considered to comprise a 'Value' is based on its representation

8212

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8213

# 123456789, the number of bytes would be counted as 9, even though an

8214

# int64 only holds up to 8 bytes of data.

8215

"timestampValue": "A String", # timestamp

8216

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8217

# and time zone are either specified elsewhere or are not significant. The date

8218

# is relative to the Proleptic Gregorian Calendar. This can represent:

8219

#

8220

# * A full date, with non-zero year, month and day values

8221

# * A month and day value, with a zero year, e.g. an anniversary

8222

# * A year on its own, with zero month and day values

8223

# * A year and month value, with a zero day, e.g. a credit card expiration date

8224

#

8225

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8226

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8227

# a year.

8228

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8229

# month and day.

8230

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8231

# if specifying a year by itself or a year and month where the day is not

8232

# significant.

8233

},

8234

"stringValue": "A String", # string

8235

"integerValue": "A String", # integer

8236

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8237

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8238

# types are google.type.Date and `google.protobuf.Timestamp`.

8239

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8240

# to allow the value "24:00:00" for scenarios like business closing time.

8241

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8242

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8243

# allow the value 60 if it allows leap-seconds.

8244

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8245

},

8246

"booleanValue": True or False, # boolean

8247

"floatValue": 3.14, # float

8248

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8253

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

8254

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

8255

# output would be 'My phone number is '.

8256

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8257

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

8258

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

8259

# Note that for the purposes of inspection or transformation, the number

8260

# of bytes considered to comprise a 'Value' is based on its representation

8261

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8262

# 123456789, the number of bytes would be counted as 9, even though an

8263

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8264

"timestampValue": "A String", # timestamp

8265

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8266

# and time zone are either specified elsewhere or are not significant. The date

8267

# is relative to the Proleptic Gregorian Calendar. This can represent:

8268

#

8269

# * A full date, with non-zero year, month and day values

8270

# * A month and day value, with a zero year, e.g. an anniversary

8271

# * A year on its own, with zero month and day values

8272

# * A year and month value, with a zero day, e.g. a credit card expiration date

8273

#

8274

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8275

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8276

# a year.

8277

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8278

# month and day.

8279

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8280

# if specifying a year by itself or a year and month where the day is not

8281

# significant.

8282

},

8283

"stringValue": "A String", # string

8284

"integerValue": "A String", # integer

8285

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8286

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8287

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8288

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8289

# to allow the value "24:00:00" for scenarios like business closing time.

8290

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8291

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8292

# allow the value 60 if it allows leap-seconds.

8293

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8294

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8295

"booleanValue": True or False, # boolean

8296

"floatValue": 3.14, # float

8297

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8298

},

8299

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8300

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

8301

# Bucketing transformation can provide all of this functionality,

8302

# but requires more configuration. This message is provided as a convenience to

8303

# the user for simple bucketing strategies.

8304

#

8305

# The transformed value will be a hyphenated string of

8306

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

8307

# all values that are within this bucket will be replaced with "10-20".

8308

#

8309

# This can be used on data of type: double, long.

8310

#

8311

# If the bound Value type differs from the type of data

8312

# being transformed, we will first attempt converting the type of the data to

8313

# be transformed to match the type of the bound before comparing.

8314

#

8315

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8316

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

8317

# grouped together into a single bucket; for example if `upper_bound` = 89,

8318

# then all values greater than 89 are replaced with the value "89+".

8319

# Note that for the purposes of inspection or transformation, the number

8320

# of bytes considered to comprise a 'Value' is based on its representation

8321

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8322

# 123456789, the number of bytes would be counted as 9, even though an

8323

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8324

"timestampValue": "A String", # timestamp

8325

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8326

# and time zone are either specified elsewhere or are not significant. The date

8327

# is relative to the Proleptic Gregorian Calendar. This can represent:

8328

#

8329

# * A full date, with non-zero year, month and day values

8330

# * A month and day value, with a zero year, e.g. an anniversary

8331

# * A year on its own, with zero month and day values

8332

# * A year and month value, with a zero day, e.g. a credit card expiration date

8333

#

8334

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8335

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8336

# a year.

8337

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8338

# month and day.

8339

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8340

# if specifying a year by itself or a year and month where the day is not

8341

# significant.

8342

},

8343

"stringValue": "A String", # string

8344

"integerValue": "A String", # integer

8345

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8346

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8347

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8348

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8349

# to allow the value "24:00:00" for scenarios like business closing time.

8350

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8351

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8352

# allow the value 60 if it allows leap-seconds.

8353

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8354

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8355

"booleanValue": True or False, # boolean

8356

"floatValue": 3.14, # float

8357

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8358

},

8359

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

8360

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

8361

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

8362

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8363

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

8364

# grouped together into a single bucket; for example if `lower_bound` = 10,

8365

# then all values less than 10 are replaced with the value "-10".

8366

# Note that for the purposes of inspection or transformation, the number

8367

# of bytes considered to comprise a 'Value' is based on its representation

8368

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8369

# 123456789, the number of bytes would be counted as 9, even though an

8370

# int64 only holds up to 8 bytes of data.

8371

"timestampValue": "A String", # timestamp

8372

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8373

# and time zone are either specified elsewhere or are not significant. The date

8374

# is relative to the Proleptic Gregorian Calendar. This can represent:

8375

#

8376

# * A full date, with non-zero year, month and day values

8377

# * A month and day value, with a zero year, e.g. an anniversary

8378

# * A year on its own, with zero month and day values

8379

# * A year and month value, with a zero day, e.g. a credit card expiration date

8380

#

8381

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8382

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8383

# a year.

8384

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8385

# month and day.

8386

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8387

# if specifying a year by itself or a year and month where the day is not

8388

# significant.

8389

},

8390

"stringValue": "A String", # string

8391

"integerValue": "A String", # integer

8392

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8393

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8394

# types are google.type.Date and `google.protobuf.Timestamp`.

8395

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8396

# to allow the value "24:00:00" for scenarios like business closing time.

8397

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8398

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8399

# allow the value 60 if it allows leap-seconds.

8400

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8401

},

8402

"booleanValue": True or False, # boolean

8403

"floatValue": 3.14, # float

8404

"dayOfWeekValue": "A String", # day of week

8405

},

8406

},

8407

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

8408

# fixed character. Masking can start from the beginning or end of the string.

8409

# This can be used on data of any type (numbers, longs, and so on) and when

8410

# de-identifying structured data we'll attempt to preserve the original data's

8411

# type. (This allows you to take a long like 123 and modify it to a string like

8412

# **3.

8413

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

8414

# characters. For example, if the input string is `555-555-5555` and you

8415

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

8416

# returns `***-**5-5555`.

8417

{ # Characters to skip when doing deidentification of a value. These will be left

8418

# alone and skipped.

8419

"charactersToSkip": "A String", # Characters to not transform when masking.

8420

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

8425

# masked. Skipped characters do not count towards this tally.

8426

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

8427

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

8428

# code or credit card number. This string must have a length of 1. If not

8429

# supplied, this value defaults to `*` for strings, and `0` for digits.

8430

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

8431

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

8432

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

8433

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

8434

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8435

},

8436

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8437

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

8438

# this transformation to apply to all findings that correspond to

8439

# infoTypes that were requested in `InspectConfig`.

8440

{ # Type of information detected by the API.

8441

"name": "A String", # Name of the information type. Either a name of your choosing when

8442

# creating a CustomInfoType, or one of the names listed

8443

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

8444

# a built-in type. InfoType names should conform to the pattern

8445

# `[a-zA-Z0-9_]{1,64}`.

8446

},

8447

],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

8452

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

8453

# portion of the value.

8454

"partToExtract": "A String", # The part of the time to keep.

8455

},

8456

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

8457

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

8458

# to learn more.

8459

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

8460

# If set, must also set cryptoKey. If set, shift will be consistent for the

8461

# given context.

8462

"name": "A String", # Name describing the field.

8463

},

8464

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

8465

# range (inclusive ends). Negative means shift to earlier in time. Must not

8466

# be more than 365250 days (1000 years) each direction.

8467

#

8468

# For example, 3 means shift date to at most 3 days into the future.

8469

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

8470

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

8471

# results in the same shift for the same context and crypto_key. If

8472

# set, must also set context. Can only be applied to table items.

8473

# a key encryption key (KEK) stored by KMS).

8474

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8475

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8476

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8477

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8478

# leaking the key. Choose another type of key if possible.

8479

"key": "A String", # Required. A 128/192/256 bit key.

8480

},

8481

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8482

# It will be discarded after the request finishes.

8483

"name": "A String", # Required. Name of the key.

8484

# This is an arbitrary string used to differentiate different keys.

8485

# A unique key is generated per name: two separate `TransientCryptoKey`

8486

# protos share the same generated key if their names are the same.

8487

# When the data crypto key is generated, this name is not used in any way

8488

# (repeating the api call will result in a different key being generated).

8489

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8490

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8491

# The wrapped key must be a 128/192/256 bit key.

8492

# Authorization requires the following IAM permissions when sending a request

8493

# to perform a crypto transformation using a kms-wrapped crypto key:

8494

# dlp.kms.encrypt

8495

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8496

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8497

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8498

},

8499

},

8500

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

8501

},

8502

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

8503

# Uses SHA-256.

8504

# The key size must be either 32 or 64 bytes.

8505

# Outputs a base64 encoded representation of the hashed output

8506

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

8507

# Currently, only string and integer values can be hashed.

8508

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

8509

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

8510

# a key encryption key (KEK) stored by KMS).

8511

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8512

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8513

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8514

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8515

# leaking the key. Choose another type of key if possible.

8516

"key": "A String", # Required. A 128/192/256 bit key.

8517

},

8518

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8519

# It will be discarded after the request finishes.

8520

"name": "A String", # Required. Name of the key.

8521

# This is an arbitrary string used to differentiate different keys.

8522

# A unique key is generated per name: two separate `TransientCryptoKey`

8523

# protos share the same generated key if their names are the same.

8524

# When the data crypto key is generated, this name is not used in any way

8525

# (repeating the api call will result in a different key being generated).

8526

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8527

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8528

# The wrapped key must be a 128/192/256 bit key.

8529

# Authorization requires the following IAM permissions when sending a request

8530

# to perform a crypto transformation using a kms-wrapped crypto key:

8531

# dlp.kms.encrypt

8532

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8533

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8534

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8535

},

8536

},

8537

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

8538

# (FPE) with the FFX mode of operation; however when used in the

8539

# `ReidentifyContent` API method, it serves the opposite function by reversing

8540

# the surrogate back into the original identifier. The identifier must be

8541

# encoded as ASCII. For a given crypto key and context, the same identifier

8542

# will be replaced with the same surrogate. Identifiers must be at least two

8543

# characters long. In the case that the identifier is the empty string, it will

8544

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

8545

# more.

8546

#

8547

# Note: We recommend using CryptoDeterministicConfig for all use cases which

8548

# do not require preserving the input alphabet space and size, plus warrant

8549

# referential integrity.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8550

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

8551

# This annotation will be applied to the surrogate by prefixing it with

8552

# the name of the custom infoType followed by the number of

8553

# characters comprising the surrogate. The following scheme defines the

8554

# format: info_type_name(surrogate_character_count):surrogate

8555

#

8556

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

8557

# the surrogate is 'abc', the full replacement value

8558

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

8559

#

8560

# This annotation identifies the surrogate when inspecting content using the

8561

# custom infoType

8562

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

8563

# This facilitates reversal of the surrogate when it occurs in free text.

8564

#

8565

# In order for inspection to work properly, the name of this infoType must

8566

# not occur naturally anywhere in your data; otherwise, inspection may

8567

# find a surrogate that does not correspond to an actual identifier.

8568

# Therefore, choose your custom infoType name carefully after considering

8569

# what your data looks like. One way to select a name that has a high chance

8570

# of yielding reliable detection is to include one or more unicode characters

8571

# that are highly improbable to exist in your data.

8572

# For example, assuming your data is entered from a regular ASCII keyboard,

8573

# the symbol with the hex code point 29DD might be used like so:

8574

# ⧝MY_TOKEN_TYPE

8575

"name": "A String", # Name of the information type. Either a name of your choosing when

8576

# creating a CustomInfoType, or one of the names listed

8577

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

8578

# a built-in type. InfoType names should conform to the pattern

8579

# `[a-zA-Z0-9_]{1,64}`.

8580

},

8581

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

8582

# identifier in two different contexts won't be given the same surrogate. If

8583

# the context is not set, a default tweak will be used.

8584

#

8585

# If the context is set but:

8586

#

8587

# 1. there is no record present when transforming a given value or

8588

# 1. the field is not present when transforming a given value,

8589

#

8590

# a default tweak will be used.

8591

#

8592

# Note that case (1) is expected when an `InfoTypeTransformation` is

8593

# applied to both structured and non-structured `ContentItem`s.

8594

# Currently, the referenced field may be of value type integer or string.

8595

#

8596

# The tweak is constructed as a sequence of bytes in big endian byte order

8597

# such that:

8598

#

8599

# - a 64 bit integer is encoded followed by a single byte of value 1

8600

# - a string is encoded in UTF-8 format followed by a single byte of value 2

8601

"name": "A String", # Name describing the field.

8602

},

8603

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

8604

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

8605

# a key encryption key (KEK) stored by KMS).

8606

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8607

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8608

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8609

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8610

# leaking the key. Choose another type of key if possible.

8611

"key": "A String", # Required. A 128/192/256 bit key.

8612

},

8613

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8614

# It will be discarded after the request finishes.

8615

"name": "A String", # Required. Name of the key.

8616

# This is an arbitrary string used to differentiate different keys.

8617

# A unique key is generated per name: two separate `TransientCryptoKey`

8618

# protos share the same generated key if their names are the same.

8619

# When the data crypto key is generated, this name is not used in any way

8620

# (repeating the api call will result in a different key being generated).

8621

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8622

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8623

# The wrapped key must be a 128/192/256 bit key.

8624

# Authorization requires the following IAM permissions when sending a request

8625

# to perform a crypto transformation using a kms-wrapped crypto key:

8626

# dlp.kms.encrypt

8627

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8628

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8629

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8630

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8631

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

8632

# that the FFX mode natively supports. This happens before/after

8633

# encryption/decryption.

8634

# Each character listed must appear only once.

8635

# Number of characters must be in the range [2, 95].

8636

# This must be encoded as ASCII.

8637

# The order of characters does not matter.

8638

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8639

},

8640

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

8641

# input. Outputs a base64 encoded representation of the encrypted output.

8642

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

8643

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

8644

# This annotation will be applied to the surrogate by prefixing it with

8645

# the name of the custom info type followed by the number of

8646

# characters comprising the surrogate. The following scheme defines the

8647

# format: {info type name}({surrogate character count}):{surrogate}

8648

#

8649

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

8650

# the surrogate is 'abc', the full replacement value

8651

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

8652

#

8653

# This annotation identifies the surrogate when inspecting content using the

8654

# custom info type 'Surrogate'. This facilitates reversal of the

8655

# surrogate when it occurs in free text.

8656

#

8657

# Note: For record transformations where the entire cell in a table is being

8658

# transformed, surrogates are not mandatory. Surrogates are used to denote

8659

# the location of the token and are necessary for re-identification in free

8660

# form text.

8661

#

8662

# In order for inspection to work properly, the name of this info type must

8663

# not occur naturally anywhere in your data; otherwise, inspection may either

8664

#

8665

# - reverse a surrogate that does not correspond to an actual identifier

8666

# - be unable to parse the surrogate and result in an error

8667

#

8668

# Therefore, choose your custom info type name carefully after considering

8669

# what your data looks like. One way to select a name that has a high chance

8670

# of yielding reliable detection is to include one or more unicode characters

8671

# that are highly improbable to exist in your data.

8672

# For example, assuming your data is entered from a regular ASCII keyboard,

8673

# the symbol with the hex code point 29DD might be used like so:

8674

# ⧝MY_TOKEN_TYPE.

8675

"name": "A String", # Name of the information type. Either a name of your choosing when

8676

# creating a CustomInfoType, or one of the names listed

8677

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

8678

# a built-in type. InfoType names should conform to the pattern

8679

# `[a-zA-Z0-9_]{1,64}`.

8680

},

8681

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

8682

# referential integrity such that the same identifier in two different

8683

# contexts will be given a distinct surrogate. The context is appended to

8684

# plaintext value being encrypted. On decryption the provided context is

8685

# validated against the value used during encryption. If a context was

8686

# provided during encryption, same context must be provided during decryption

8687

# as well.

8688

#

8689

# If the context is not set, plaintext would be used as is for encryption.

8690

# If the context is set but:

8691

#

8692

# 1. there is no record present when transforming a given value or

8693

# 2. the field is not present when transforming a given value,

8694

#

8695

# plaintext would be used as is for encryption.

8696

#

8697

# Note that case (1) is expected when an `InfoTypeTransformation` is

8698

# applied to both structured and non-structured `ContentItem`s.

8699

"name": "A String", # Name describing the field.

8700

},

8701

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

8702

# a key encryption key (KEK) stored by KMS).

8703

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8704

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8705

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8706

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8707

# leaking the key. Choose another type of key if possible.

8708

"key": "A String", # Required. A 128/192/256 bit key.

8709

},

8710

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8711

# It will be discarded after the request finishes.

8712

"name": "A String", # Required. Name of the key.

8713

# This is an arbitrary string used to differentiate different keys.

8714

# A unique key is generated per name: two separate `TransientCryptoKey`

8715

# protos share the same generated key if their names are the same.

8716

# When the data crypto key is generated, this name is not used in any way

8717

# (repeating the api call will result in a different key being generated).

8718

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8719

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8720

# The wrapped key must be a 128/192/256 bit key.

8721

# Authorization requires the following IAM permissions when sending a request

8722

# to perform a crypto transformation using a kms-wrapped crypto key:

8723

# dlp.kms.encrypt

8724

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8725

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8726

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8727

},

8728

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8729

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

8730

# replacement values are dynamically provided by the user for custom behavior,

8731

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

8732

# This can be used on

8733

# data of type: number, long, string, timestamp.

8734

# If the bound `Value` type differs from the type of data being transformed, we

8735

# will first attempt converting the type of the data to be transformed to match

8736

# the type of the bound before comparing.

8737

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

8738

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

8739

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8740

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

8741

# the default behavior will be to hyphenate the min-max range.

8742

# Note that for the purposes of inspection or transformation, the number

8743

# of bytes considered to comprise a 'Value' is based on its representation

8744

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8745

# 123456789, the number of bytes would be counted as 9, even though an

8746

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8747

"timestampValue": "A String", # timestamp

8748

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8749

# and time zone are either specified elsewhere or are not significant. The date

8750

# is relative to the Proleptic Gregorian Calendar. This can represent:

8751

#

8752

# * A full date, with non-zero year, month and day values

8753

# * A month and day value, with a zero year, e.g. an anniversary

8754

# * A year on its own, with zero month and day values

8755

# * A year and month value, with a zero day, e.g. a credit card expiration date

8756

#

8757

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8758

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8759

# a year.

8760

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8761

# month and day.

8762

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8763

# if specifying a year by itself or a year and month where the day is not

8764

# significant.

8765

},

8766

"stringValue": "A String", # string

8767

"integerValue": "A String", # integer

8768

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8769

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8770

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8771

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8772

# to allow the value "24:00:00" for scenarios like business closing time.

8773

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8774

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8775

# allow the value 60 if it allows leap-seconds.

8776

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8777

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8778

"booleanValue": True or False, # boolean

8779

"floatValue": 3.14, # float

8780

"dayOfWeekValue": "A String", # day of week

8781

},

8782

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

8783

# used.

8784

# Note that for the purposes of inspection or transformation, the number

8785

# of bytes considered to comprise a 'Value' is based on its representation

8786

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8787

# 123456789, the number of bytes would be counted as 9, even though an

8788

# int64 only holds up to 8 bytes of data.

8789

"timestampValue": "A String", # timestamp

8790

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8791

# and time zone are either specified elsewhere or are not significant. The date

8792

# is relative to the Proleptic Gregorian Calendar. This can represent:

8793

#

8794

# * A full date, with non-zero year, month and day values

8795

# * A month and day value, with a zero year, e.g. an anniversary

8796

# * A year on its own, with zero month and day values

8797

# * A year and month value, with a zero day, e.g. a credit card expiration date

8798

#

8799

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8800

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8801

# a year.

8802

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8803

# month and day.

8804

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8805

# if specifying a year by itself or a year and month where the day is not

8806

# significant.

8807

},

8808

"stringValue": "A String", # string

8809

"integerValue": "A String", # integer

8810

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8811

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8812

# types are google.type.Date and `google.protobuf.Timestamp`.

8813

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8814

# to allow the value "24:00:00" for scenarios like business closing time.

8815

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8816

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8817

# allow the value 60 if it allows leap-seconds.

8818

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8819

},

8820

"booleanValue": True or False, # boolean

8821

"floatValue": 3.14, # float

8822

"dayOfWeekValue": "A String", # day of week

8823

},

8824

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

8825

# Note that for the purposes of inspection or transformation, the number

8826

# of bytes considered to comprise a 'Value' is based on its representation

8827

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8828

# 123456789, the number of bytes would be counted as 9, even though an

8829

# int64 only holds up to 8 bytes of data.

8830

"timestampValue": "A String", # timestamp

8831

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8832

# and time zone are either specified elsewhere or are not significant. The date

8833

# is relative to the Proleptic Gregorian Calendar. This can represent:

8834

#

8835

# * A full date, with non-zero year, month and day values

8836

# * A month and day value, with a zero year, e.g. an anniversary

8837

# * A year on its own, with zero month and day values

8838

# * A year and month value, with a zero day, e.g. a credit card expiration date

8839

#

8840

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8841

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8842

# a year.

8843

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8844

# month and day.

8845

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8846

# if specifying a year by itself or a year and month where the day is not

8847

# significant.

8848

},

8849

"stringValue": "A String", # string

8850

"integerValue": "A String", # integer

8851

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8852

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8853

# types are google.type.Date and `google.protobuf.Timestamp`.

8854

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8855

# to allow the value "24:00:00" for scenarios like business closing time.

8856

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8857

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8858

# allow the value 60 if it allows leap-seconds.

8859

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8860

},

8861

"booleanValue": True or False, # boolean

8862

"floatValue": 3.14, # float

8863

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8868

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

8869

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

8870

# output would be 'My phone number is '.

8871

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8872

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

8873

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

8874

# Note that for the purposes of inspection or transformation, the number

8875

# of bytes considered to comprise a 'Value' is based on its representation

8876

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8877

# 123456789, the number of bytes would be counted as 9, even though an

8878

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8879

"timestampValue": "A String", # timestamp

8880

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8881

# and time zone are either specified elsewhere or are not significant. The date

8882

# is relative to the Proleptic Gregorian Calendar. This can represent:

8883

#

8884

# * A full date, with non-zero year, month and day values

8885

# * A month and day value, with a zero year, e.g. an anniversary

8886

# * A year on its own, with zero month and day values

8887

# * A year and month value, with a zero day, e.g. a credit card expiration date

8888

#

8889

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8890

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8891

# a year.

8892

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8893

# month and day.

8894

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8895

# if specifying a year by itself or a year and month where the day is not

8896

# significant.

8897

},

8898

"stringValue": "A String", # string

8899

"integerValue": "A String", # integer

8900

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8901

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8902

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8903

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8904

# to allow the value "24:00:00" for scenarios like business closing time.

8905

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8906

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8907

# allow the value 60 if it allows leap-seconds.

8908

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8909

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8910

"booleanValue": True or False, # boolean

8911

"floatValue": 3.14, # float

8912

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8913

},

8914

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8915

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

8916

# Bucketing transformation can provide all of this functionality,

8917

# but requires more configuration. This message is provided as a convenience to

8918

# the user for simple bucketing strategies.

8919

#

8920

# The transformed value will be a hyphenated string of

8921

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

8922

# all values that are within this bucket will be replaced with "10-20".

8923

#

8924

# This can be used on data of type: double, long.

8925

#

8926

# If the bound Value type differs from the type of data

8927

# being transformed, we will first attempt converting the type of the data to

8928

# be transformed to match the type of the bound before comparing.

8929

#

8930

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8931

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

8932

# grouped together into a single bucket; for example if `upper_bound` = 89,

8933

# then all values greater than 89 are replaced with the value "89+".

8934

# Note that for the purposes of inspection or transformation, the number

8935

# of bytes considered to comprise a 'Value' is based on its representation

8936

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8937

# 123456789, the number of bytes would be counted as 9, even though an

8938

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8939

"timestampValue": "A String", # timestamp

8940

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8941

# and time zone are either specified elsewhere or are not significant. The date

8942

# is relative to the Proleptic Gregorian Calendar. This can represent:

8943

#

8944

# * A full date, with non-zero year, month and day values

8945

# * A month and day value, with a zero year, e.g. an anniversary

8946

# * A year on its own, with zero month and day values

8947

# * A year and month value, with a zero day, e.g. a credit card expiration date

8948

#

8949

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8950

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8951

# a year.

8952

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8953

# month and day.

8954

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8955

# if specifying a year by itself or a year and month where the day is not

8956

# significant.

8957

},

8958

"stringValue": "A String", # string

8959

"integerValue": "A String", # integer

8960

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8961

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8962

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8963

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8964

# to allow the value "24:00:00" for scenarios like business closing time.

8965

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8966

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8967

# allow the value 60 if it allows leap-seconds.

8968

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8969

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8970

"booleanValue": True or False, # boolean

8971

"floatValue": 3.14, # float

8972

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

8973

},

8974

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

8975

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

8976

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

8977

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

8978

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

8979

# grouped together into a single bucket; for example if `lower_bound` = 10,

8980

# then all values less than 10 are replaced with the value "-10".

8981

# Note that for the purposes of inspection or transformation, the number

8982

# of bytes considered to comprise a 'Value' is based on its representation

8983

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8984

# 123456789, the number of bytes would be counted as 9, even though an

8985

# int64 only holds up to 8 bytes of data.

8986

"timestampValue": "A String", # timestamp

8987

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8988

# and time zone are either specified elsewhere or are not significant. The date

8989

# is relative to the Proleptic Gregorian Calendar. This can represent:

8990

#

8991

# * A full date, with non-zero year, month and day values

8992

# * A month and day value, with a zero year, e.g. an anniversary

8993

# * A year on its own, with zero month and day values

8994

# * A year and month value, with a zero day, e.g. a credit card expiration date

8995

#

8996

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8997

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8998

# a year.

8999

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9000

# month and day.

9001

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9002

# if specifying a year by itself or a year and month where the day is not

9003

# significant.

9004

},

9005

"stringValue": "A String", # string

9006

"integerValue": "A String", # integer

9007

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9008

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9009

# types are google.type.Date and `google.protobuf.Timestamp`.

9010

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9011

# to allow the value "24:00:00" for scenarios like business closing time.

9012

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9013

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9014

# allow the value 60 if it allows leap-seconds.

9015

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9016

},

9017

"booleanValue": True or False, # boolean

9018

"floatValue": 3.14, # float

9019

"dayOfWeekValue": "A String", # day of week

9020

},

9021

},

9022

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

9023

# fixed character. Masking can start from the beginning or end of the string.

9024

# This can be used on data of any type (numbers, longs, and so on) and when

9025

# de-identifying structured data we'll attempt to preserve the original data's

9026

# type. (This allows you to take a long like 123 and modify it to a string like

9027

# **3.

9028

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

9029

# characters. For example, if the input string is `555-555-5555` and you

9030

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

9031

# returns `***-**5-5555`.

9032

{ # Characters to skip when doing deidentification of a value. These will be left

9033

# alone and skipped.

9034

"charactersToSkip": "A String", # Characters to not transform when masking.

9035

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

9040

# masked. Skipped characters do not count towards this tally.

9041

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

9042

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

9043

# code or credit card number. This string must have a length of 1. If not

9044

# supplied, this value defaults to `*` for strings, and `0` for digits.

9045

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

9046

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

9047

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

9048

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

9049

# is `true`, then the string `12345` is masked as `12***`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9050

},

9051

},

9052

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

9053

# given `RecordCondition`. The conditions are allowed to reference fields

9054

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

9059

# column for the same record is within a specific range.

9060

# - Redact a field if the date of birth field is greater than 85.

9061

# a field.

9062

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

9063

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

9064

# only supported value is `AND`.

9065

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

9066

"conditions": [ # A collection of conditions.

9067

{ # The field type of `value` and `field` do not need to match to be

9068

# considered equal, but not all comparisons are possible.

9069

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

9070

# but all other comparisons are invalid with incompatible types.

9071

# A `value` of type:

9072

#

9073

# - `string` can be compared against all other types

9074

# - `boolean` can only be compared against other booleans

9075

# - `integer` can be compared against doubles or a string if the string value

9076

# can be parsed as an integer.

9077

# - `double` can be compared against integers or a string if the string can

9078

# be parsed as a double.

9079

# - `Timestamp` can be compared against strings in RFC 3339 date string

9080

# format.

9081

# - `TimeOfDay` can be compared against timestamps and strings in the format

9082

# of 'HH:mm:ss'.

9083

#

9084

# If we fail to compare do to type mismatch, a warning will be given and

9085

# the condition will evaluate to false.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9086

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

9087

# Note that for the purposes of inspection or transformation, the number

9088

# of bytes considered to comprise a 'Value' is based on its representation

9089

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9090

# 123456789, the number of bytes would be counted as 9, even though an

9091

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9092

"timestampValue": "A String", # timestamp

9093

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9094

# and time zone are either specified elsewhere or are not significant. The date

9095

# is relative to the Proleptic Gregorian Calendar. This can represent:

9096

#

9097

# * A full date, with non-zero year, month and day values

9098

# * A month and day value, with a zero year, e.g. an anniversary

9099

# * A year on its own, with zero month and day values

9100

# * A year and month value, with a zero day, e.g. a credit card expiration date

9101

#

9102

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9103

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9104

# a year.

9105

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9106

# month and day.

9107

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9108

# if specifying a year by itself or a year and month where the day is not

9109

# significant.

9110

},

9111

"stringValue": "A String", # string

9112

"integerValue": "A String", # integer

9113

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9114

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9115

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9116

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9117

# to allow the value "24:00:00" for scenarios like business closing time.

9118

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9119

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9120

# allow the value 60 if it allows leap-seconds.

9121

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9122

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9123

"booleanValue": True or False, # boolean

9124

"floatValue": 3.14, # float

9125

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9126

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9127

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

9128

"name": "A String", # Name describing the field.

9129

},

9130

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

},

},

],

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9138

"transformation": { # A rule for transforming a value. # The specific transformation these stats apply to.

9139

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

9140

# portion of the value.

9141

"partToExtract": "A String", # The part of the time to keep.

9142

},

9143

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

9144

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

9145

# to learn more.

9146

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

9147

# If set, must also set cryptoKey. If set, shift will be consistent for the

9148

# given context.

9149

"name": "A String", # Name describing the field.

9150

},

9151

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

9152

# range (inclusive ends). Negative means shift to earlier in time. Must not

9153

# be more than 365250 days (1000 years) each direction.

9154

#

9155

# For example, 3 means shift date to at most 3 days into the future.

9156

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

9157

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

9158

# results in the same shift for the same context and crypto_key. If

9159

# set, must also set context. Can only be applied to table items.

9160

# a key encryption key (KEK) stored by KMS).

9161

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9162

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9163

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9164

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9165

# leaking the key. Choose another type of key if possible.

9166

"key": "A String", # Required. A 128/192/256 bit key.

9167

},

9168

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9169

# It will be discarded after the request finishes.

9170

"name": "A String", # Required. Name of the key.

9171

# This is an arbitrary string used to differentiate different keys.

9172

# A unique key is generated per name: two separate `TransientCryptoKey`

9173

# protos share the same generated key if their names are the same.

9174

# When the data crypto key is generated, this name is not used in any way

9175

# (repeating the api call will result in a different key being generated).

9176

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9177

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9178

# The wrapped key must be a 128/192/256 bit key.

9179

# Authorization requires the following IAM permissions when sending a request

9180

# to perform a crypto transformation using a kms-wrapped crypto key:

9181

# dlp.kms.encrypt

9182

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9183

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9184

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9185

},

9186

},

9187

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

9188

},

9189

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

9190

# Uses SHA-256.

9191

# The key size must be either 32 or 64 bytes.

9192

# Outputs a base64 encoded representation of the hashed output

9193

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

9194

# Currently, only string and integer values can be hashed.

9195

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

9196

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

9197

# a key encryption key (KEK) stored by KMS).

9198

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9199

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9200

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9201

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9202

# leaking the key. Choose another type of key if possible.

9203

"key": "A String", # Required. A 128/192/256 bit key.

9204

},

9205

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9206

# It will be discarded after the request finishes.

9207

"name": "A String", # Required. Name of the key.

9208

# This is an arbitrary string used to differentiate different keys.

9209

# A unique key is generated per name: two separate `TransientCryptoKey`

9210

# protos share the same generated key if their names are the same.

9211

# When the data crypto key is generated, this name is not used in any way

9212

# (repeating the api call will result in a different key being generated).

9213

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9214

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9215

# The wrapped key must be a 128/192/256 bit key.

9216

# Authorization requires the following IAM permissions when sending a request

9217

# to perform a crypto transformation using a kms-wrapped crypto key:

9218

# dlp.kms.encrypt

9219

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9220

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9221

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9222

},

9223

},

9224

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

9225

# (FPE) with the FFX mode of operation; however when used in the

9226

# `ReidentifyContent` API method, it serves the opposite function by reversing

9227

# the surrogate back into the original identifier. The identifier must be

9228

# encoded as ASCII. For a given crypto key and context, the same identifier

9229

# will be replaced with the same surrogate. Identifiers must be at least two

9230

# characters long. In the case that the identifier is the empty string, it will

9231

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

9232

# more.

9233

#

9234

# Note: We recommend using CryptoDeterministicConfig for all use cases which

9235

# do not require preserving the input alphabet space and size, plus warrant

9236

# referential integrity.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9237

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

9238

# This annotation will be applied to the surrogate by prefixing it with

9239

# the name of the custom infoType followed by the number of

9240

# characters comprising the surrogate. The following scheme defines the

9241

# format: info_type_name(surrogate_character_count):surrogate

9242

#

9243

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

9244

# the surrogate is 'abc', the full replacement value

9245

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

9246

#

9247

# This annotation identifies the surrogate when inspecting content using the

9248

# custom infoType

9249

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

9250

# This facilitates reversal of the surrogate when it occurs in free text.

9251

#

9252

# In order for inspection to work properly, the name of this infoType must

9253

# not occur naturally anywhere in your data; otherwise, inspection may

9254

# find a surrogate that does not correspond to an actual identifier.

9255

# Therefore, choose your custom infoType name carefully after considering

9256

# what your data looks like. One way to select a name that has a high chance

9257

# of yielding reliable detection is to include one or more unicode characters

9258

# that are highly improbable to exist in your data.

9259

# For example, assuming your data is entered from a regular ASCII keyboard,

9260

# the symbol with the hex code point 29DD might be used like so:

9261

# ⧝MY_TOKEN_TYPE

9262

"name": "A String", # Name of the information type. Either a name of your choosing when

9263

# creating a CustomInfoType, or one of the names listed

9264

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

9265

# a built-in type. InfoType names should conform to the pattern

9266

# `[a-zA-Z0-9_]{1,64}`.

9267

},

9268

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

9269

# identifier in two different contexts won't be given the same surrogate. If

9270

# the context is not set, a default tweak will be used.

9271

#

9272

# If the context is set but:

9273

#

9274

# 1. there is no record present when transforming a given value or

9275

# 1. the field is not present when transforming a given value,

9276

#

9277

# a default tweak will be used.

9278

#

9279

# Note that case (1) is expected when an `InfoTypeTransformation` is

9280

# applied to both structured and non-structured `ContentItem`s.

9281

# Currently, the referenced field may be of value type integer or string.

9282

#

9283

# The tweak is constructed as a sequence of bytes in big endian byte order

9284

# such that:

9285

#

9286

# - a 64 bit integer is encoded followed by a single byte of value 1

9287

# - a string is encoded in UTF-8 format followed by a single byte of value 2

9288

"name": "A String", # Name describing the field.

9289

},

9290

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

9291

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

9292

# a key encryption key (KEK) stored by KMS).

9293

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9294

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9295

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9296

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9297

# leaking the key. Choose another type of key if possible.

9298

"key": "A String", # Required. A 128/192/256 bit key.

9299

},

9300

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9301

# It will be discarded after the request finishes.

9302

"name": "A String", # Required. Name of the key.

9303

# This is an arbitrary string used to differentiate different keys.

9304

# A unique key is generated per name: two separate `TransientCryptoKey`

9305

# protos share the same generated key if their names are the same.

9306

# When the data crypto key is generated, this name is not used in any way

9307

# (repeating the api call will result in a different key being generated).

9308

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9309

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9310

# The wrapped key must be a 128/192/256 bit key.

9311

# Authorization requires the following IAM permissions when sending a request

9312

# to perform a crypto transformation using a kms-wrapped crypto key:

9313

# dlp.kms.encrypt

9314

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9315

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9316

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9317

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9318

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

9319

# that the FFX mode natively supports. This happens before/after

9320

# encryption/decryption.

9321

# Each character listed must appear only once.

9322

# Number of characters must be in the range [2, 95].

9323

# This must be encoded as ASCII.

9324

# The order of characters does not matter.

9325

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9326

},

9327

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

9328

# input. Outputs a base64 encoded representation of the encrypted output.

9329

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

9330

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

9331

# This annotation will be applied to the surrogate by prefixing it with

9332

# the name of the custom info type followed by the number of

9333

# characters comprising the surrogate. The following scheme defines the

9334

# format: {info type name}({surrogate character count}):{surrogate}

9335

#

9336

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

9337

# the surrogate is 'abc', the full replacement value

9338

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

9339

#

9340

# This annotation identifies the surrogate when inspecting content using the

9341

# custom info type 'Surrogate'. This facilitates reversal of the

9342

# surrogate when it occurs in free text.

9343

#

9344

# Note: For record transformations where the entire cell in a table is being

9345

# transformed, surrogates are not mandatory. Surrogates are used to denote

9346

# the location of the token and are necessary for re-identification in free

9347

# form text.

9348

#

9349

# In order for inspection to work properly, the name of this info type must

9350

# not occur naturally anywhere in your data; otherwise, inspection may either

9351

#

9352

# - reverse a surrogate that does not correspond to an actual identifier

9353

# - be unable to parse the surrogate and result in an error

9354

#

9355

# Therefore, choose your custom info type name carefully after considering

9356

# what your data looks like. One way to select a name that has a high chance

9357

# of yielding reliable detection is to include one or more unicode characters

9358

# that are highly improbable to exist in your data.

9359

# For example, assuming your data is entered from a regular ASCII keyboard,

9360

# the symbol with the hex code point 29DD might be used like so:

9361

# ⧝MY_TOKEN_TYPE.

9362

"name": "A String", # Name of the information type. Either a name of your choosing when

9363

# creating a CustomInfoType, or one of the names listed

9364

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

9365

# a built-in type. InfoType names should conform to the pattern

9366

# `[a-zA-Z0-9_]{1,64}`.

9367

},

9368

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

9369

# referential integrity such that the same identifier in two different

9370

# contexts will be given a distinct surrogate. The context is appended to

9371

# plaintext value being encrypted. On decryption the provided context is

9372

# validated against the value used during encryption. If a context was

9373

# provided during encryption, same context must be provided during decryption

9374

# as well.

9375

#

9376

# If the context is not set, plaintext would be used as is for encryption.

9377

# If the context is set but:

9378

#

9379

# 1. there is no record present when transforming a given value or

9380

# 2. the field is not present when transforming a given value,

9381

#

9382

# plaintext would be used as is for encryption.

9383

#

9384

# Note that case (1) is expected when an `InfoTypeTransformation` is

9385

# applied to both structured and non-structured `ContentItem`s.

9386

"name": "A String", # Name describing the field.

9387

},

9388

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

9389

# a key encryption key (KEK) stored by KMS).

9390

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9391

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9392

# unwrap the data crypto key.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9393

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9394

# leaking the key. Choose another type of key if possible.

9395

"key": "A String", # Required. A 128/192/256 bit key.

9396

},

9397

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9398

# It will be discarded after the request finishes.

9399

"name": "A String", # Required. Name of the key.

9400

# This is an arbitrary string used to differentiate different keys.

9401

# A unique key is generated per name: two separate `TransientCryptoKey`

9402

# protos share the same generated key if their names are the same.

9403

# When the data crypto key is generated, this name is not used in any way

9404

# (repeating the api call will result in a different key being generated).

9405

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9406

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9407

# The wrapped key must be a 128/192/256 bit key.

9408

# Authorization requires the following IAM permissions when sending a request

9409

# to perform a crypto transformation using a kms-wrapped crypto key:

9410

# dlp.kms.encrypt

9411

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9412

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9413

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9414

},

9415

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9416

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

9417

# replacement values are dynamically provided by the user for custom behavior,

9418

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

9419

# This can be used on

9420

# data of type: number, long, string, timestamp.

9421

# If the bound `Value` type differs from the type of data being transformed, we

9422

# will first attempt converting the type of the data to be transformed to match

9423

# the type of the bound before comparing.

9424

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

9425

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

9426

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9427

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

9428

# the default behavior will be to hyphenate the min-max range.

9429

# Note that for the purposes of inspection or transformation, the number

9430

# of bytes considered to comprise a 'Value' is based on its representation

9431

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9432

# 123456789, the number of bytes would be counted as 9, even though an

9433

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9434

"timestampValue": "A String", # timestamp

9435

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9436

# and time zone are either specified elsewhere or are not significant. The date

9437

# is relative to the Proleptic Gregorian Calendar. This can represent:

9438

#

9439

# * A full date, with non-zero year, month and day values

9440

# * A month and day value, with a zero year, e.g. an anniversary

9441

# * A year on its own, with zero month and day values

9442

# * A year and month value, with a zero day, e.g. a credit card expiration date

9443

#

9444

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9445

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9446

# a year.

9447

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9448

# month and day.

9449

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9450

# if specifying a year by itself or a year and month where the day is not

9451

# significant.

9452

},

9453

"stringValue": "A String", # string

9454

"integerValue": "A String", # integer

9455

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9456

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9457

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9458

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9459

# to allow the value "24:00:00" for scenarios like business closing time.

9460

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9461

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9462

# allow the value 60 if it allows leap-seconds.

9463

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9464

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9465

"booleanValue": True or False, # boolean

9466

"floatValue": 3.14, # float

9467

"dayOfWeekValue": "A String", # day of week

9468

},

9469

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

9470

# used.

9471

# Note that for the purposes of inspection or transformation, the number

9472

# of bytes considered to comprise a 'Value' is based on its representation

9473

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9474

# 123456789, the number of bytes would be counted as 9, even though an

9475

# int64 only holds up to 8 bytes of data.

9476

"timestampValue": "A String", # timestamp

9477

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9478

# and time zone are either specified elsewhere or are not significant. The date

9479

# is relative to the Proleptic Gregorian Calendar. This can represent:

9480

#

9481

# * A full date, with non-zero year, month and day values

9482

# * A month and day value, with a zero year, e.g. an anniversary

9483

# * A year on its own, with zero month and day values

9484

# * A year and month value, with a zero day, e.g. a credit card expiration date

9485

#

9486

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9487

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9488

# a year.

9489

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9490

# month and day.

9491

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9492

# if specifying a year by itself or a year and month where the day is not

9493

# significant.

9494

},

9495

"stringValue": "A String", # string

9496

"integerValue": "A String", # integer

9497

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9498

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9499

# types are google.type.Date and `google.protobuf.Timestamp`.

9500

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9501

# to allow the value "24:00:00" for scenarios like business closing time.

9502

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9503

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9504

# allow the value 60 if it allows leap-seconds.

9505

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9506

},

9507

"booleanValue": True or False, # boolean

9508

"floatValue": 3.14, # float

9509

"dayOfWeekValue": "A String", # day of week

9510

},

9511

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

9512

# Note that for the purposes of inspection or transformation, the number

9513

# of bytes considered to comprise a 'Value' is based on its representation

9514

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9515

# 123456789, the number of bytes would be counted as 9, even though an

9516

# int64 only holds up to 8 bytes of data.

9517

"timestampValue": "A String", # timestamp

9518

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9519

# and time zone are either specified elsewhere or are not significant. The date

9520

# is relative to the Proleptic Gregorian Calendar. This can represent:

9521

#

9522

# * A full date, with non-zero year, month and day values

9523

# * A month and day value, with a zero year, e.g. an anniversary

9524

# * A year on its own, with zero month and day values

9525

# * A year and month value, with a zero day, e.g. a credit card expiration date

9526

#

9527

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9528

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9529

# a year.

9530

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9531

# month and day.

9532

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9533

# if specifying a year by itself or a year and month where the day is not

9534

# significant.

9535

},

9536

"stringValue": "A String", # string

9537

"integerValue": "A String", # integer

9538

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9539

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9540

# types are google.type.Date and `google.protobuf.Timestamp`.

9541

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9542

# to allow the value "24:00:00" for scenarios like business closing time.

9543

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9544

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9545

# allow the value 60 if it allows leap-seconds.

9546

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9547

},

9548

"booleanValue": True or False, # boolean

9549

"floatValue": 3.14, # float

9550

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9555

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

9556

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

9557

# output would be 'My phone number is '.

9558

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9559

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

9560

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

9561

# Note that for the purposes of inspection or transformation, the number

9562

# of bytes considered to comprise a 'Value' is based on its representation

9563

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9564

# 123456789, the number of bytes would be counted as 9, even though an

9565

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9566

"timestampValue": "A String", # timestamp

9567

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9568

# and time zone are either specified elsewhere or are not significant. The date

9569

# is relative to the Proleptic Gregorian Calendar. This can represent:

9570

#

9571

# * A full date, with non-zero year, month and day values

9572

# * A month and day value, with a zero year, e.g. an anniversary

9573

# * A year on its own, with zero month and day values

9574

# * A year and month value, with a zero day, e.g. a credit card expiration date

9575

#

9576

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9577

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9578

# a year.

9579

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9580

# month and day.

9581

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9582

# if specifying a year by itself or a year and month where the day is not

9583

# significant.

9584

},

9585

"stringValue": "A String", # string

9586

"integerValue": "A String", # integer

9587

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9588

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9589

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9590

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9591

# to allow the value "24:00:00" for scenarios like business closing time.

9592

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9593

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9594

# allow the value 60 if it allows leap-seconds.

9595

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9596

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9597

"booleanValue": True or False, # boolean

9598

"floatValue": 3.14, # float

9599

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9600

},

9601

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9602

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

9603

# Bucketing transformation can provide all of this functionality,

9604

# but requires more configuration. This message is provided as a convenience to

9605

# the user for simple bucketing strategies.

9606

#

9607

# The transformed value will be a hyphenated string of

9608

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

9609

# all values that are within this bucket will be replaced with "10-20".

9610

#

9611

# This can be used on data of type: double, long.

9612

#

9613

# If the bound Value type differs from the type of data

9614

# being transformed, we will first attempt converting the type of the data to

9615

# be transformed to match the type of the bound before comparing.

9616

#

9617

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9618

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

9619

# grouped together into a single bucket; for example if `upper_bound` = 89,

9620

# then all values greater than 89 are replaced with the value "89+".

9621

# Note that for the purposes of inspection or transformation, the number

9622

# of bytes considered to comprise a 'Value' is based on its representation

9623

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9624

# 123456789, the number of bytes would be counted as 9, even though an

9625

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9626

"timestampValue": "A String", # timestamp

9627

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9628

# and time zone are either specified elsewhere or are not significant. The date

9629

# is relative to the Proleptic Gregorian Calendar. This can represent:

9630

#

9631

# * A full date, with non-zero year, month and day values

9632

# * A month and day value, with a zero year, e.g. an anniversary

9633

# * A year on its own, with zero month and day values

9634

# * A year and month value, with a zero day, e.g. a credit card expiration date

9635

#

9636

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9637

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9638

# a year.

9639

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9640

# month and day.

9641

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9642

# if specifying a year by itself or a year and month where the day is not

9643

# significant.

9644

},

9645

"stringValue": "A String", # string

9646

"integerValue": "A String", # integer

9647

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9648

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9649

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9650

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9651

# to allow the value "24:00:00" for scenarios like business closing time.

9652

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9653

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9654

# allow the value 60 if it allows leap-seconds.

9655

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9656

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9657

"booleanValue": True or False, # boolean

9658

"floatValue": 3.14, # float

9659

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9660

},

9661

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

9662

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

9663

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

9664

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9665

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

9666

# grouped together into a single bucket; for example if `lower_bound` = 10,

9667

# then all values less than 10 are replaced with the value "-10".

9668

# Note that for the purposes of inspection or transformation, the number

9669

# of bytes considered to comprise a 'Value' is based on its representation

9670

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9671

# 123456789, the number of bytes would be counted as 9, even though an

9672

# int64 only holds up to 8 bytes of data.

9673

"timestampValue": "A String", # timestamp

9674

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9675

# and time zone are either specified elsewhere or are not significant. The date

9676

# is relative to the Proleptic Gregorian Calendar. This can represent:

9677

#

9678

# * A full date, with non-zero year, month and day values

9679

# * A month and day value, with a zero year, e.g. an anniversary

9680

# * A year on its own, with zero month and day values

9681

# * A year and month value, with a zero day, e.g. a credit card expiration date

9682

#

9683

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9684

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9685

# a year.

9686

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9687

# month and day.

9688

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9689

# if specifying a year by itself or a year and month where the day is not

9690

# significant.

9691

},

9692

"stringValue": "A String", # string

9693

"integerValue": "A String", # integer

9694

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9695

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9696

# types are google.type.Date and `google.protobuf.Timestamp`.

9697

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9698

# to allow the value "24:00:00" for scenarios like business closing time.

9699

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9700

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9701

# allow the value 60 if it allows leap-seconds.

9702

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9703

},

9704

"booleanValue": True or False, # boolean

9705

"floatValue": 3.14, # float

9706

"dayOfWeekValue": "A String", # day of week

9707

},

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9708

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9709

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

9710

# fixed character. Masking can start from the beginning or end of the string.

9711

# This can be used on data of any type (numbers, longs, and so on) and when

9712

# de-identifying structured data we'll attempt to preserve the original data's

9713

# type. (This allows you to take a long like 123 and modify it to a string like

9714

# **3.

9715

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

9716

# characters. For example, if the input string is `555-555-5555` and you

9717

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

9718

# returns `***-**5-5555`.

9719

{ # Characters to skip when doing deidentification of a value. These will be left

9720

# alone and skipped.

9721

"charactersToSkip": "A String", # Characters to not transform when masking.

9722

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

9727

# masked. Skipped characters do not count towards this tally.

9728

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

9729

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

9730

# code or credit card number. This string must have a length of 1. If not

9731

# supplied, this value defaults to `*` for strings, and `0` for digits.

9732

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

9733

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

9734

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

9735

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

9736

# is `true`, then the string `12345` is masked as `12***`.

9737

},

9738

},

9739

"field": { # General identifier of a data field in a storage service. # Set if the transformation was limited to a specific FieldId.

9740

"name": "A String", # Name describing the field.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9741

},

9742

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

9743

"recordSuppress": { # Configuration to suppress records whose suppression conditions evaluate to # The specific suppression option these stats apply to.

9744

# true.

9745

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

9746

# evaluated to be suppressed from the transformed content.

9747

# a field.

9748

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

9749

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

9750

# only supported value is `AND`.

9751

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

9752

"conditions": [ # A collection of conditions.

9753

{ # The field type of `value` and `field` do not need to match to be

9754

# considered equal, but not all comparisons are possible.

9755

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

9756

# but all other comparisons are invalid with incompatible types.

9757

# A `value` of type:

9758

#

9759

# - `string` can be compared against all other types

9760

# - `boolean` can only be compared against other booleans

9761

# - `integer` can be compared against doubles or a string if the string value

9762

# can be parsed as an integer.

9763

# - `double` can be compared against integers or a string if the string can

9764

# be parsed as a double.

9765

# - `Timestamp` can be compared against strings in RFC 3339 date string

9766

# format.

9767

# - `TimeOfDay` can be compared against timestamps and strings in the format

9768

# of 'HH:mm:ss'.

9769

#

9770

# If we fail to compare do to type mismatch, a warning will be given and

9771

# the condition will evaluate to false.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9772

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

9773

# Note that for the purposes of inspection or transformation, the number

9774

# of bytes considered to comprise a 'Value' is based on its representation

9775

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9776

# 123456789, the number of bytes would be counted as 9, even though an

9777

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9778

"timestampValue": "A String", # timestamp

9779

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9780

# and time zone are either specified elsewhere or are not significant. The date

9781

# is relative to the Proleptic Gregorian Calendar. This can represent:

9782

#

9783

# * A full date, with non-zero year, month and day values

9784

# * A month and day value, with a zero year, e.g. an anniversary

9785

# * A year on its own, with zero month and day values

9786

# * A year and month value, with a zero day, e.g. a credit card expiration date

9787

#

9788

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9789

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9790

# a year.

9791

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9792

# month and day.

9793

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9794

# if specifying a year by itself or a year and month where the day is not

9795

# significant.

9796

},

9797

"stringValue": "A String", # string

9798

"integerValue": "A String", # integer

9799

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9800

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9801

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9802

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9803

# to allow the value "24:00:00" for scenarios like business closing time.

9804

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9805

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9806

# allow the value 60 if it allows leap-seconds.

9807

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9808

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9809

"booleanValue": True or False, # boolean

9810

"floatValue": 3.14, # float

9811

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9812

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9813

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

9814

"name": "A String", # Name describing the field.

9815

},

9816

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

},

},

"infoType": { # Type of information detected by the API. # Set if the transformation was limited to a specific InfoType.

9824

"name": "A String", # Name of the information type. Either a name of your choosing when

9825

# creating a CustomInfoType, or one of the names listed

9826

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

9827

# a built-in type. InfoType names should conform to the pattern

9828

# `[a-zA-Z0-9_]{1,64}`.

9829

},

9830

"results": [ # Collection of all transformations that took place or had an error.

9831

{ # A collection that informs the user the number of times a particular

9832

# `TransformationResultCode` and error details occurred.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9833

"details": "A String", # A place for warnings or errors to show up if a transformation didn't

9834

# work as expected.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9835

"code": "A String", # Outcome of the transformation.

9836

"count": "A String", # Number of transformations counted by this result.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

],

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

9842

},

9843

"item": { # Container structure for the content to inspect. # The re-identified item.

9844

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9845

"data": "A String", # Content data to inspect or redact.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9846

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9847

},

9848

"value": "A String", # String data to inspect or redact.

9849

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

9850

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

9851

# learn more.

9852

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

9853

# learn more.

9854

"rows": [ # Rows of the table.

9855

{ # Values of the row.

9856

"values": [ # Individual cells.

9857

{ # Set of primitive values supported by the system.

9858

# Note that for the purposes of inspection or transformation, the number

9859

# of bytes considered to comprise a 'Value' is based on its representation

9860

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9861

# 123456789, the number of bytes would be counted as 9, even though an

9862

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9863

"timestampValue": "A String", # timestamp

9864

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9865

# and time zone are either specified elsewhere or are not significant. The date

9866

# is relative to the Proleptic Gregorian Calendar. This can represent:

9867

#

9868

# * A full date, with non-zero year, month and day values

9869

# * A month and day value, with a zero year, e.g. an anniversary

9870

# * A year on its own, with zero month and day values

9871

# * A year and month value, with a zero day, e.g. a credit card expiration date

9872

#

9873

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9874

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9875

# a year.

9876

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9877

# month and day.

9878

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9879

# if specifying a year by itself or a year and month where the day is not

9880

# significant.

9881

},

9882

"stringValue": "A String", # string

9883

"integerValue": "A String", # integer

9884

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9885

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9886

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9887

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9888

# to allow the value "24:00:00" for scenarios like business closing time.

9889

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9890

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9891

# allow the value 60 if it allows leap-seconds.

9892

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

9893

},

Bu Sun Kim

4ed7d3f

2020-05-27 12:20:54 -0700

[diff] [blame^]

9894

"booleanValue": True or False, # boolean

9895

"floatValue": 3.14, # float

9896

"dayOfWeekValue": "A String", # day of week

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

],

"headers": [ # Headers of the table.

9902

{ # General identifier of a data field in a storage service.

9903

"name": "A String", # Name describing the field.

},

],

},

},

}</pre>

</div>

</body></html>