Blame - docs/dyn/dlp_v2.projects.content.html - platform/external/python/google-api-python-client

2020-10-06 16:46:05 -0700

[diff] [blame]

78

<code><a href="#close">close()</a></code></p>

79

<p class="firstline">Close httplib2 connections.</p>

80

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

81

<code><a href="#deidentify">deidentify(parent, body=None, x__xgafv=None)</a></code></p>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

82

<p class="firstline">De-identifies potentially sensitive info from a ContentItem. This method has limits on input size and output size. See https://cloud.google.com/dlp/docs/deidentify-sensitive-data to learn more. When no InfoTypes or CustomInfoTypes are specified in this request, the system will automatically choose what detectors to run. By default this may be all types, but may change over time as detectors are updated.</p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

83

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

84

<code><a href="#inspect">inspect(parent, body=None, x__xgafv=None)</a></code></p>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

85

<p class="firstline">Finds potentially sensitive info in content. This method has limits on input size, processing time, and output size. When no InfoTypes or CustomInfoTypes are specified in this request, the system will automatically choose what detectors to run. By default this may be all types, but may change over time as detectors are updated. For how to guides, see https://cloud.google.com/dlp/docs/inspecting-images and https://cloud.google.com/dlp/docs/inspecting-text,</p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

86

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

87

<code><a href="#reidentify">reidentify(parent, body=None, x__xgafv=None)</a></code></p>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

88

<p class="firstline">Re-identifies content that has been de-identified. See https://cloud.google.com/dlp/docs/pseudonymization#re-identification_in_free_text_code_example to learn more.</p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

89

<h3>Method Details</h3>

90

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

91

<code class="details" id="close">close()</code>

92

<pre>Close httplib2 connections.</pre>

93

</div>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

94

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

95

96

<code class="details" id="deidentify">deidentify(parent, body=None, x__xgafv=None)</code>

97

<pre>De-identifies potentially sensitive info from a ContentItem. This method has limits on input size and output size. See https://cloud.google.com/dlp/docs/deidentify-sensitive-data to learn more. When no InfoTypes or CustomInfoTypes are specified in this request, the system will automatically choose what detectors to run. By default this may be all types, but may change over time as detectors are updated.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

98

99

Args:

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

100

parent: string, Parent resource name. The format of this value varies depending on whether you have [specified a processing location](https://cloud.google.com/dlp/docs/specifying-location): + Projects scope, location specified: `projects/`PROJECT_ID`/locations/`LOCATION_ID + Projects scope, no location specified (defaults to global): `projects/`PROJECT_ID The following example `parent` string specifies a parent project with the identifier `example-project`, and specifies the `europe-west3` location for processing data: parent=projects/example-project/locations/europe-west3 (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

101

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

102

The object takes the form of:

103

104

{ # Request to de-identify a list of items.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

105

"locationId": "A String", # Deprecated. This field has no effect.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

106

"deidentifyConfig": { # The configuration that controls how the data will change. # Configuration for the de-identification of the content item. Items specified here will override the template referenced by the deidentify_template_name argument.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

107

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the dataset as free-form text and apply the same free text transformation everywhere.

108

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

109

{ # A transformation to apply to text that is identified as a specific info_type.

110

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

111

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

112

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

113

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

114

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

115

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

116

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

117

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

118

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

119

"stringValue": "A String", # string

120

"timestampValue": "A String", # timestamp

121

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

122

"dayOfWeekValue": "A String", # day of week

123

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

124

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

125

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

126

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

127

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

128

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

129

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

130

},

131

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

132

"integerValue": "A String", # integer

133

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

134

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

135

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

136

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

137

},

138

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

139

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

140

"floatValue": 3.14, # float

141

"dayOfWeekValue": "A String", # day of week

142

"booleanValue": True or False, # boolean

143

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

144

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

145

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

146

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

147

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

148

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

149

},

150

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

151

},

152

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

153

"partToExtract": "A String", # The part of the time to keep.

154

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

155

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

156

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

157

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

158

},

159

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

160

"name": "A String", # Name describing the field.

161

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

162

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

163

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

164

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

165

"wrappedKey": "A String", # Required. The wrapped data crypto key.

166

},

167

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

168

"key": "A String", # Required. A 128/192/256 bit key.

169

},

170

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

171

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

172

},

173

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

174

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

175

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

176

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

177

"name": "A String", # Name describing the field.

178

},

179

"commonAlphabet": "A String", # Common alphabets.

180

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

181

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

182

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

183

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

184

},

185

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

186

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

187

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

188

"wrappedKey": "A String", # Required. The wrapped data crypto key.

189

},

190

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

191

"key": "A String", # Required. A 128/192/256 bit key.

192

},

193

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

194

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

195

},

196

},

197

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

198

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

199

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

200

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

201

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

202

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

203

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

204

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

205

"charactersToSkip": "A String", # Characters to not transform when masking.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame]

206

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

207

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

208

},

209

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

210

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

211

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

212

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

213

"wrappedKey": "A String", # Required. The wrapped data crypto key.

214

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

215

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

216

"key": "A String", # Required. A 128/192/256 bit key.

217

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

218

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

219

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

220

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

221

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

222

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

223

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

224

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

225

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

226

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

227

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

228

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

229

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

230

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

231

"stringValue": "A String", # string

232

"timestampValue": "A String", # timestamp

233

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

234

"dayOfWeekValue": "A String", # day of week

235

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

236

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

237

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

238

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

239

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

240

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

241

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

242

},

243

},

244

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

245

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

246

{ # Bucket is represented as a range, along with replacement values.

247

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

248

"integerValue": "A String", # integer

249

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

250

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

251

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

252

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

253

},

254

"stringValue": "A String", # string

255

"timestampValue": "A String", # timestamp

256

"floatValue": 3.14, # float

257

"dayOfWeekValue": "A String", # day of week

258

"booleanValue": True or False, # boolean

259

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

260

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

261

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

262

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

263

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

264

},

265

},

266

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

267

"integerValue": "A String", # integer

268

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

269

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

270

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

271

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

272

},

273

"stringValue": "A String", # string

274

"timestampValue": "A String", # timestamp

275

"floatValue": 3.14, # float

276

"dayOfWeekValue": "A String", # day of week

277

"booleanValue": True or False, # boolean

278

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

279

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

280

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

281

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

282

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

283

},

284

},

285

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

286

"integerValue": "A String", # integer

287

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

288

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

289

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

290

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

291

},

292

"stringValue": "A String", # string

293

"timestampValue": "A String", # timestamp

294

"floatValue": 3.14, # float

295

"dayOfWeekValue": "A String", # day of week

296

"booleanValue": True or False, # boolean

297

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

298

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

299

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

300

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

301

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

308

},

309

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

310

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

311

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

312

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

313

"name": "A String", # Name describing the field.

314

},

315

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

316

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

317

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

318

"wrappedKey": "A String", # Required. The wrapped data crypto key.

319

},

320

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

321

"key": "A String", # Required. A 128/192/256 bit key.

322

},

323

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

324

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

325

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

326

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

327

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

328

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

329

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

330

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

331

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

332

{ # Type of information detected by the API.

333

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A transformation error occurs when the requested transformation is incompatible with the data. For example, trying to de-identify an IP address using a `DateShift` transformation would result in a transformation error, since date info cannot be extracted from an IP address. Information about any incompatible transformations, and how they were handled, is returned in the response as part of the `TransformationOverviews`. # Mode for handling transformation errors. If left unspecified, the default mode is `TransformationErrorHandling.ThrowError`.

340

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would cause an error. For example, if a `DateShift` transformation were applied an an IP address, this mode would leave the IP address unchanged in the response. # Ignore errors

341

},

342

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

343

},

344

},

345

"recordTransformations": { # A type of transformation that is applied over structured data such as a table. # Treat the dataset as structured. Transformations can be applied to specific locations within structured datasets, such as transforming a column within a table.

346

"fieldTransformations": [ # Transform the record by applying various field transformations.

347

{ # The transformation to apply to the field.

348

"condition": { # A condition for determining whether a transformation should be applied to a field. # Only apply the transformation if the condition evaluates to true for the given `RecordCondition`. The conditions are allowed to reference fields that are not used in the actual transformation. Example Use Cases: - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range. - Redact a field if the date of birth field is greater than 85.

349

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

350

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

351

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

352

"conditions": [ # A collection of conditions.

353

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

354

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

355

"name": "A String", # Name describing the field.

356

},

357

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

358

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

359

"integerValue": "A String", # integer

360

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

361

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

362

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

363

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

364

},

365

"stringValue": "A String", # string

366

"timestampValue": "A String", # timestamp

367

"floatValue": 3.14, # float

368

"dayOfWeekValue": "A String", # day of week

369

"booleanValue": True or False, # boolean

370

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

371

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

372

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

373

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

374

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

},

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

382

"fields": [ # Required. Input field(s) to apply the transformation to.

383

{ # General identifier of a data field in a storage service.

384

"name": "A String", # Name describing the field.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

385

},

386

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

387

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

388

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

389

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

390

"integerValue": "A String", # integer

391

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

392

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

393

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

394

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

395

},

396

"stringValue": "A String", # string

397

"timestampValue": "A String", # timestamp

398

"floatValue": 3.14, # float

399

"dayOfWeekValue": "A String", # day of week

400

"booleanValue": True or False, # boolean

401

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

402

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

403

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

404

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

405

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

406

},

407

},

408

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

409

"integerValue": "A String", # integer

410

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

411

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

412

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

413

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

414

},

415

"stringValue": "A String", # string

416

"timestampValue": "A String", # timestamp

417

"floatValue": 3.14, # float

418

"dayOfWeekValue": "A String", # day of week

419

"booleanValue": True or False, # boolean

420

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

421

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

422

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

423

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

424

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

425

},

426

},

427

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

428

},

429

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

430

"partToExtract": "A String", # The part of the time to keep.

431

},

432

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

433

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

434

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

435

},

436

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

437

"name": "A String", # Name describing the field.

438

},

439

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

440

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

441

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

442

"wrappedKey": "A String", # Required. The wrapped data crypto key.

443

},

444

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

445

"key": "A String", # Required. A 128/192/256 bit key.

446

},

447

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

448

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

453

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

454

"name": "A String", # Name describing the field.

455

},

456

"commonAlphabet": "A String", # Common alphabets.

457

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

458

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

459

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

460

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

461

},

462

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

463

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

464

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

465

"wrappedKey": "A String", # Required. The wrapped data crypto key.

466

},

467

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

468

"key": "A String", # Required. A 128/192/256 bit key.

469

},

470

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

471

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

476

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

477

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

478

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

479

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

480

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

481

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

482

"charactersToSkip": "A String", # Characters to not transform when masking.

},

],

},

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

487

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

488

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

489

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

490

"wrappedKey": "A String", # Required. The wrapped data crypto key.

491

},

492

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

493

"key": "A String", # Required. A 128/192/256 bit key.

494

},

495

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

496

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

501

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

502

"integerValue": "A String", # integer

503

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

504

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

505

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

506

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

507

},

508

"stringValue": "A String", # string

509

"timestampValue": "A String", # timestamp

510

"floatValue": 3.14, # float

511

"dayOfWeekValue": "A String", # day of week

512

"booleanValue": True or False, # boolean

513

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

514

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

515

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

516

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

517

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

522

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

523

{ # Bucket is represented as a range, along with replacement values.

524

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

525

"integerValue": "A String", # integer

526

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

527

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

528

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

529

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

530

},

531

"stringValue": "A String", # string

532

"timestampValue": "A String", # timestamp

533

"floatValue": 3.14, # float

534

"dayOfWeekValue": "A String", # day of week

535

"booleanValue": True or False, # boolean

536

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

537

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

538

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

539

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

540

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

541

},

542

},

543

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

544

"integerValue": "A String", # integer

545

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

546

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

547

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

548

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

549

},

550

"stringValue": "A String", # string

551

"timestampValue": "A String", # timestamp

552

"floatValue": 3.14, # float

553

"dayOfWeekValue": "A String", # day of week

554

"booleanValue": True or False, # boolean

555

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

556

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

557

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

558

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

559

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

560

},

561

},

562

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

563

"integerValue": "A String", # integer

564

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

565

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

566

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

567

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

568

},

569

"stringValue": "A String", # string

570

"timestampValue": "A String", # timestamp

571

"floatValue": 3.14, # float

572

"dayOfWeekValue": "A String", # day of week

573

"booleanValue": True or False, # boolean

574

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

575

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

576

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

577

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

578

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

585

},

586

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

587

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

588

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

589

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

590

"name": "A String", # Name describing the field.

591

},

592

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

593

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

594

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

595

"wrappedKey": "A String", # Required. The wrapped data crypto key.

596

},

597

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

598

"key": "A String", # Required. A 128/192/256 bit key.

599

},

600

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

601

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

606

},

607

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

608

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the contents of the field as free text, and selectively transform content that matches an `InfoType`.

609

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

610

{ # A transformation to apply to text that is identified as a specific info_type.

611

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

612

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

613

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

614

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

615

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

616

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

617

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

618

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

619

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

620

"stringValue": "A String", # string

621

"timestampValue": "A String", # timestamp

622

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

623

"dayOfWeekValue": "A String", # day of week

624

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

625

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

626

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

627

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

628

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

629

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

630

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

631

},

632

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

633

"integerValue": "A String", # integer

634

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

635

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

636

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

637

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

638

},

639

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

640

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

641

"floatValue": 3.14, # float

642

"dayOfWeekValue": "A String", # day of week

643

"booleanValue": True or False, # boolean

644

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

645

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

646

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

647

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

648

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

649

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

650

},

651

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

652

},

653

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

654

"partToExtract": "A String", # The part of the time to keep.

655

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

656

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

657

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

658

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

659

},

660

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

661

"name": "A String", # Name describing the field.

662

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

663

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

664

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

665

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

666

"wrappedKey": "A String", # Required. The wrapped data crypto key.

667

},

668

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

669

"key": "A String", # Required. A 128/192/256 bit key.

670

},

671

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

672

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

673

},

674

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

675

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

676

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

677

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

678

"name": "A String", # Name describing the field.

679

},

680

"commonAlphabet": "A String", # Common alphabets.

681

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

682

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

683

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

684

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

685

},

686

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

687

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

688

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

689

"wrappedKey": "A String", # Required. The wrapped data crypto key.

690

},

691

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

692

"key": "A String", # Required. A 128/192/256 bit key.

693

},

694

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

695

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

696

},

697

},

698

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

699

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

700

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

701

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

702

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

703

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

704

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

705

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

706

"charactersToSkip": "A String", # Characters to not transform when masking.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

707

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

708

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

709

},

710

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

711

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

712

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

713

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

714

"wrappedKey": "A String", # Required. The wrapped data crypto key.

715

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

716

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

717

"key": "A String", # Required. A 128/192/256 bit key.

718

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

719

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

720

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

721

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

722

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

723

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

724

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

725

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

726

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

727

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

728

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

729

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

730

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

731

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

732

"stringValue": "A String", # string

733

"timestampValue": "A String", # timestamp

734

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

735

"dayOfWeekValue": "A String", # day of week

736

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

737

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

738

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

739

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

740

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

741

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

742

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

743

},

744

},

745

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

746

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

747

{ # Bucket is represented as a range, along with replacement values.

748

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

749

"integerValue": "A String", # integer

750

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

751

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

752

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

753

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

754

},

755

"stringValue": "A String", # string

756

"timestampValue": "A String", # timestamp

757

"floatValue": 3.14, # float

758

"dayOfWeekValue": "A String", # day of week

759

"booleanValue": True or False, # boolean

760

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

761

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

762

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

763

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

764

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

765

},

766

},

767

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

768

"integerValue": "A String", # integer

769

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

770

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

771

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

772

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

773

},

774

"stringValue": "A String", # string

775

"timestampValue": "A String", # timestamp

776

"floatValue": 3.14, # float

777

"dayOfWeekValue": "A String", # day of week

778

"booleanValue": True or False, # boolean

779

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

780

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

781

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

782

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

783

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

784

},

785

},

786

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

787

"integerValue": "A String", # integer

788

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

789

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

790

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

791

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

792

},

793

"stringValue": "A String", # string

794

"timestampValue": "A String", # timestamp

795

"floatValue": 3.14, # float

796

"dayOfWeekValue": "A String", # day of week

797

"booleanValue": True or False, # boolean

798

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

799

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

800

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

801

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

802

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

809

},

810

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

811

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

812

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

813

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

814

"name": "A String", # Name describing the field.

815

},

816

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

817

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

818

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

819

"wrappedKey": "A String", # Required. The wrapped data crypto key.

820

},

821

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

822

"key": "A String", # Required. A 128/192/256 bit key.

823

},

824

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

825

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

826

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

827

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

828

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

829

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

830

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

831

},

832

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

833

{ # Type of information detected by the API.

834

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

840

},

841

],

842

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that match any suppression rule are omitted from the output.

843

{ # Configuration to suppress records whose suppression conditions evaluate to true.

844

"condition": { # A condition for determining whether a transformation should be applied to a field. # A condition that when it evaluates to true will result in the record being evaluated to be suppressed from the transformed content.

845

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

846

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

847

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

848

"conditions": [ # A collection of conditions.

849

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

850

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

851

"name": "A String", # Name describing the field.

852

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

853

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

854

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

855

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

856

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

857

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

858

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

859

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

860

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

861

"stringValue": "A String", # string

862

"timestampValue": "A String", # timestamp

863

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

864

"dayOfWeekValue": "A String", # day of week

865

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

866

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

867

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

868

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

869

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

870

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

871

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

},

],

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

881

},

882

"inspectConfig": { # Configuration description of the scanning process. When used with redactContent only info_types and min_likelihood are currently used. # Configuration for the inspector. Items specified here will override the template referenced by the inspect_template_name argument.

883

"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is included in the response; see Finding.quote.

884

"customInfoTypes": [ # CustomInfoTypes provided by the user. See https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

885

{ # Custom information type provided by the user. Used to find domain-specific sensitive information configurable to the data in question.

886

"storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in `InspectDataSource`. Not currently supported in `InspectContent`.

887

"createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for inspection was created. Output-only field, populated by the system.

888

"name": "A String", # Resource name of the requested `StoredInfoType`, for example `organizations/433245324/storedInfoTypes/432452342` or `projects/project-id/storedInfoTypes/432452342`.

889

},

890

"likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be altered by a detection rule if the finding meets the criteria specified by the rule. Defaults to `VERY_LIKELY` if not specified.

891

"regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.

892

"pattern": "A String", # Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.

893

"groupIndexes": [ # The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.

42,

],

},

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can be used to match sensitive information specific to the data, such as a list of employee IDs or job titles. Dictionary words are case-insensitive and all characters other than letters and digits in the unicode [Basic Multilingual Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane) will be replaced with whitespace when scanning for matches, so the dictionary phrase "Sam Johnson" will match all three phrases "sam johnson", "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters surrounding any match must be of a different type than the adjacent characters within the word, so letters must be next to non-letters and digits next to non-digits. For example, the dictionary word "jen" will match the first three letters of the text "jen123" but will return no matches for "jennifer". Dictionary words containing a large number of characters that are not letters or digits may result in unexpected findings because such characters are treated as whitespace. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries. For dictionaries that do not fit within these constraints, consider using `LargeCustomDictionaryConfig` in the `StoredInfoType` API. # A list of phrases to detect as a CustomInfoType.

898

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file is accepted.

899

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage. Example: gs://[BUCKET_NAME]/dictionary.txt

900

},

901

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

902

"words": [ # Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits. [required]

"A String",

],

},

},

"exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding to be returned. It still can be used for rules matching.

908

"surrogateType": { # Message for detecting output from deidentification transformations such as [`CryptoReplaceFfxFpeConfig`](https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig). These types of transformations are those that perform pseudonymization, thereby producing a "surrogate" as output. This should be used in conjunction with a field on the transformation such as `surrogate_info_type`. This CustomInfoType does not support the use of `detection_rules`. # Message for detecting output from deidentification transformations that support reversing.

909

},

910

"infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in infoType, when the name matches one of existing infoTypes and that infoType is specified in `InspectContent.info_types` field. Specifying the latter adds findings to the one detected by the system. If built-in info type is not specified in `InspectContent.info_types` list then the name is treated as a custom info type.

911

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

912

},

913

"detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType. Rules are applied in order that they are specified. Not supported for the `surrogate_type` CustomInfoType.

914

{ # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a `CustomInfoType` to alter behavior under certain circumstances, depending on the specific details of the rule. Not supported for the `surrogate_type` custom infoType.

915

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain proximity of hotwords. # Hotword-based detection rule.

916

"proximity": { # Message for specifying a window around a finding to apply a detection rule. # Proximity of the finding within which the entire hotword must reside. The total length of the window cannot exceed 1000 characters. Note that the finding itself will be included in the window, so that hotwords may be used to match substrings of the finding itself. For example, the certainty of a phone number regex "$\d{3}$ \d{3}-\d{4}" could be adjusted upwards if the area code is known to be the local area code of a company office using the hotword regex "$xxx$", where "xxx" is the area code in question.

917

"windowAfter": 42, # Number of characters after the finding to consider.

918

"windowBefore": 42, # Number of characters before the finding to consider.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

919

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

920

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

921

"pattern": "A String", # Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.

922

"groupIndexes": [ # The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.

923

42,

924

],

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

925

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

926

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as part of a detection rule. # Likelihood adjustment to apply to all matching findings.

927

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

928

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of levels. For example, if a finding would be `POSSIBLE` without the detection rule and `relative_likelihood` is 1, then it is upgraded to `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`. Likelihood may never drop below `VERY_UNLIKELY` or exceed `VERY_LIKELY`, so applying an adjustment of 1 followed by an adjustment of -1 when base likelihood is `VERY_LIKELY` will result in a final likelihood of `LIKELY`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

929

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

930

},

931

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

],

},

],

"contentOptions": [ # List of options defining data content to scan. If empty, text, images, and other content will be included.

936

"A String",

937

],

938

"minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is POSSIBLE. See https://cloud.google.com/dlp/docs/likelihood to learn more.

939

"limits": { # Configuration to control the number of findings returned. # Configuration to control the number of findings returned.

940

"maxFindingsPerInfoType": [ # Configuration of findings limit given for specified infoTypes.

941

{ # Max findings configuration per infoType, per content item or long running DlpJob.

942

"infoType": { # Type of information detected by the API. # Type of information the findings limit applies to. Only one limit per info_type should be provided. If InfoTypeLimit does not have an info_type, the DLP API applies the limit against all info_types that are found but not specified in another InfoTypeLimit.

943

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

944

},

945

"maxFindings": 42, # Max findings limit for the given infoType.

946

},

947

],

948

"maxFindingsPerRequest": 42, # Max number of findings that will be returned per request/job. When set within `InspectContentRequest`, the maximum returned is 2000 regardless if this is set higher.

949

"maxFindingsPerItem": 42, # Max number of findings that will be returned for each item scanned. When set within `InspectJobConfig`, the maximum returned is 2000 regardless if this is set higher. When set within `InspectContentRequest`, this field is ignored.

950

},

951

"infoTypes": [ # Restricts what info_types to look for. The values must correspond to InfoType values returned by ListInfoTypes or listed at https://cloud.google.com/dlp/docs/infotypes-reference. When no InfoTypes or CustomInfoTypes are specified in a request, the system may automatically choose what detectors to run. By default this may be all types, but may change over time as detectors are updated. If you need precise control and predictability as to what detectors are run you should specify specific InfoTypes listed in the reference, otherwise a default list will be used, which may change over time.

952

{ # Type of information detected by the API.

953

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

954

},

955

],

956

"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig. Exclusion rules, contained in the set are executed in the end, other rules are executed in the order they are specified for each info type.

957

{ # Rule set for modifying a set of infoTypes to alter behavior under certain circumstances, depending on the specific details of the rules within the set.

958

"infoTypes": [ # List of infoTypes this rule set is applied to.

959

{ # Type of information detected by the API.

960

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

961

},

962

],

963

"rules": [ # Set of rules to be applied to infoTypes. The rules are applied in order.

964

{ # A single inspection rule to be applied to infoTypes, specified in `InspectionRuleSet`.

965

"exclusionRule": { # The rule that specifies conditions when findings of infoTypes specified in `InspectionRuleSet` are removed from results. # Exclusion rule.

966

"regex": { # Message defining a custom regular expression. # Regular expression which defines the rule.

967

"pattern": "A String", # Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.

968

"groupIndexes": [ # The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.

42,

],

},

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can be used to match sensitive information specific to the data, such as a list of employee IDs or job titles. Dictionary words are case-insensitive and all characters other than letters and digits in the unicode [Basic Multilingual Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane) will be replaced with whitespace when scanning for matches, so the dictionary phrase "Sam Johnson" will match all three phrases "sam johnson", "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters surrounding any match must be of a different type than the adjacent characters within the word, so letters must be next to non-letters and digits next to non-digits. For example, the dictionary word "jen" will match the first three letters of the text "jen123" but will return no matches for "jennifer". Dictionary words containing a large number of characters that are not letters or digits may result in unexpected findings because such characters are treated as whitespace. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries. For dictionaries that do not fit within these constraints, consider using `LargeCustomDictionaryConfig` in the `StoredInfoType` API. # Dictionary which defines the rule.

973

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file is accepted.

974

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage. Example: gs://[BUCKET_NAME]/dictionary.txt

975

},

976

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

977

"words": [ # Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits. [required]

"A String",

],

},

},

"excludeInfoTypes": { # List of exclude infoTypes. # Set of infoTypes for which findings would affect this rule.

983

"infoTypes": [ # InfoType list in ExclusionRule rule drops a finding when it overlaps or contained within with a finding of an infoType from this list. For example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and `exclusion_rule` containing `exclude_info_types.info_types` with "EMAIL_ADDRESS" the phone number findings are dropped if they overlap with EMAIL_ADDRESS finding. That leads to "555-222-2222@example.org" to generate only a single finding, namely email address.

984

{ # Type of information detected by the API.

985

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

"matchingType": "A String", # How the rule is applied, see MatchingType documentation for details.

990

},

991

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain proximity of hotwords. # Hotword-based detection rule.

992

"proximity": { # Message for specifying a window around a finding to apply a detection rule. # Proximity of the finding within which the entire hotword must reside. The total length of the window cannot exceed 1000 characters. Note that the finding itself will be included in the window, so that hotwords may be used to match substrings of the finding itself. For example, the certainty of a phone number regex "$\d{3}$ \d{3}-\d{4}" could be adjusted upwards if the area code is known to be the local area code of a company office using the hotword regex "$xxx$", where "xxx" is the area code in question.

993

"windowAfter": 42, # Number of characters after the finding to consider.

994

"windowBefore": 42, # Number of characters before the finding to consider.

995

},

996

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

997

"pattern": "A String", # Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.

998

"groupIndexes": [ # The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.

42,

],

},

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as part of a detection rule. # Likelihood adjustment to apply to all matching findings.

1003

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

1004

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of levels. For example, if a finding would be `POSSIBLE` without the detection rule and `relative_likelihood` is 1, then it is upgraded to `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`. Likelihood may never drop below `VERY_UNLIKELY` or exceed `VERY_LIKELY`, so applying an adjustment of 1 followed by an adjustment of -1 when base likelihood is `VERY_LIKELY` will result in a final likelihood of `LIKELY`.

},

},

},

],

},

],

"excludeInfoTypes": True or False, # When true, excludes type information of the findings.

1012

},

1013

"inspectTemplateName": "A String", # Template to use. Any configuration directly specified in inspect_config will override those set in the template. Singular fields that are set in this request will replace their corresponding fields in the template. Repeated fields are appended. Singular sub-messages and groups are recursively merged.

1014

"item": { # Container structure for the content to inspect. # The item to de-identify. Will be treated as text.

1015

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to learn more. # Structured content for inspection. See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to learn more.

1016

"headers": [ # Headers of the table.

1017

{ # General identifier of a data field in a storage service.

1018

"name": "A String", # Name describing the field.

1019

},

1020

],

1021

"rows": [ # Rows of the table.

1022

{ # Values of the row.

1023

"values": [ # Individual cells.

1024

{ # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data.

1025

"integerValue": "A String", # integer

1026

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1027

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1028

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1029

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1030

},

1031

"stringValue": "A String", # string

1032

"timestampValue": "A String", # timestamp

1033

"floatValue": 3.14, # float

1034

"dayOfWeekValue": "A String", # day of week

1035

"booleanValue": True or False, # boolean

1036

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1037

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1038

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1039

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1040

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1041

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1042

},

1043

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1044

},

1045

],

1046

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1047

"value": "A String", # String data to inspect or redact.

1048

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

1049

"data": "A String", # Content data to inspect or redact.

1050

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

1051

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1052

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1053

"deidentifyTemplateName": "A String", # Template to use. Any configuration directly specified in deidentify_config will override those set in the template. Singular fields that are set in this request will replace their corresponding fields in the template. Repeated fields are appended. Singular sub-messages and groups are recursively merged.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1054

}

1055

1056

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1063

1064

{ # Results of de-identifying a ContentItem.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1065

"item": { # Container structure for the content to inspect. # The de-identified item.

1066

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to learn more. # Structured content for inspection. See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to learn more.

1067

"headers": [ # Headers of the table.

1068

{ # General identifier of a data field in a storage service.

1069

"name": "A String", # Name describing the field.

1070

},

1071

],

1072

"rows": [ # Rows of the table.

1073

{ # Values of the row.

1074

"values": [ # Individual cells.

1075

{ # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data.

1076

"integerValue": "A String", # integer

1077

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1078

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1079

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1080

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1081

},

1082

"stringValue": "A String", # string

1083

"timestampValue": "A String", # timestamp

1084

"floatValue": 3.14, # float

1085

"dayOfWeekValue": "A String", # day of week

1086

"booleanValue": True or False, # boolean

1087

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1088

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1089

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1090

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1091

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

],

},

],

},

"value": "A String", # String data to inspect or redact.

1099

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

1100

"data": "A String", # Content data to inspect or redact.

1101

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

1102

},

1103

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1104

"overview": { # Overview of the modifications that occurred. # An overview of the changes that were made on the `item`.

1105

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

1106

"transformationSummaries": [ # Transformations applied to the dataset.

1107

{ # Summary of a single transformation. Only one of 'transformation', 'field_transformation', or 'record_suppress' will be set.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1108

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1109

"transformation": { # A rule for transforming a value. # The specific transformation these stats apply to.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1110

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1111

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

1112

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1113

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1114

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1115

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1116

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1117

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1118

"stringValue": "A String", # string

1119

"timestampValue": "A String", # timestamp

1120

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1121

"dayOfWeekValue": "A String", # day of week

1122

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1123

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1124

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1125

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1126

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1127

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1128

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1129

},

1130

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

1131

"integerValue": "A String", # integer

1132

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1133

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1134

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1135

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1136

},

1137

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1138

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1139

"floatValue": 3.14, # float

1140

"dayOfWeekValue": "A String", # day of week

1141

"booleanValue": True or False, # boolean

1142

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1143

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1144

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1145

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1146

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1147

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1148

},

1149

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

1150

},

1151

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

1152

"partToExtract": "A String", # The part of the time to keep.

1153

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1154

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1155

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

1156

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1157

},

1158

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

1159

"name": "A String", # Name describing the field.

1160

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1161

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

1162

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1163

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1164

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1165

},

1166

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1167

"key": "A String", # Required. A 128/192/256 bit key.

1168

},

1169

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1170

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1171

},

1172

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1173

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1174

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

1175

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

1176

"name": "A String", # Name describing the field.

1177

},

1178

"commonAlphabet": "A String", # Common alphabets.

1179

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

1180

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

1181

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

1182

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1183

},

1184

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

1185

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1186

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1187

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1188

},

1189

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1190

"key": "A String", # Required. A 128/192/256 bit key.

1191

},

1192

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1193

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1194

},

1195

},

1196

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1197

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1198

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1199

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1200

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1201

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

1202

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

1203

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

1204

"charactersToSkip": "A String", # Characters to not transform when masking.

1205

},

1206

],

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1207

},

1208

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

1209

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

1210

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1211

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1212

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1213

},

1214

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1215

"key": "A String", # Required. A 128/192/256 bit key.

1216

},

1217

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1218

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1219

},

1220

},

1221

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1222

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

1223

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

1224

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1225

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1226

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1227

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1228

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1229

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1230

"stringValue": "A String", # string

1231

"timestampValue": "A String", # timestamp

1232

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1233

"dayOfWeekValue": "A String", # day of week

1234

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1235

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1236

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1237

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1238

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1239

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1240

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1241

},

1242

},

1243

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

1244

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

1245

{ # Bucket is represented as a range, along with replacement values.

1246

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

1247

"integerValue": "A String", # integer

1248

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1249

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1250

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1251

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1252

},

1253

"stringValue": "A String", # string

1254

"timestampValue": "A String", # timestamp

1255

"floatValue": 3.14, # float

1256

"dayOfWeekValue": "A String", # day of week

1257

"booleanValue": True or False, # boolean

1258

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1259

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1260

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1261

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1262

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1263

},

1264

},

1265

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

1266

"integerValue": "A String", # integer

1267

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1268

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1269

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1270

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1271

},

1272

"stringValue": "A String", # string

1273

"timestampValue": "A String", # timestamp

1274

"floatValue": 3.14, # float

1275

"dayOfWeekValue": "A String", # day of week

1276

"booleanValue": True or False, # boolean

1277

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1278

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1279

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1280

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1281

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1282

},

1283

},

1284

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

1285

"integerValue": "A String", # integer

1286

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1287

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1288

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1289

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1290

},

1291

"stringValue": "A String", # string

1292

"timestampValue": "A String", # timestamp

1293

"floatValue": 3.14, # float

1294

"dayOfWeekValue": "A String", # day of week

1295

"booleanValue": True or False, # boolean

1296

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1297

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1298

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1299

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1300

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1307

},

1308

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

1309

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

1310

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1311

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

1312

"name": "A String", # Name describing the field.

1313

},

1314

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

1315

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1316

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1317

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1318

},

1319

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1320

"key": "A String", # Required. A 128/192/256 bit key.

1321

},

1322

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1323

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1324

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1325

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1326

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1327

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1328

},

1329

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1330

"recordSuppress": { # Configuration to suppress records whose suppression conditions evaluate to true. # The specific suppression option these stats apply to.

1331

"condition": { # A condition for determining whether a transformation should be applied to a field. # A condition that when it evaluates to true will result in the record being evaluated to be suppressed from the transformed content.

1332

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

1333

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

1334

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

1335

"conditions": [ # A collection of conditions.

1336

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

1337

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

1338

"name": "A String", # Name describing the field.

1339

},

1340

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

1341

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

1342

"integerValue": "A String", # integer

1343

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1344

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1345

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1346

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1347

},

1348

"stringValue": "A String", # string

1349

"timestampValue": "A String", # timestamp

1350

"floatValue": 3.14, # float

1351

"dayOfWeekValue": "A String", # day of week

1352

"booleanValue": True or False, # boolean

1353

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1354

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1355

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1356

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1357

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

},

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1365

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1366

"results": [ # Collection of all transformations that took place or had an error.

1367

{ # A collection that informs the user the number of times a particular `TransformationResultCode` and error details occurred.

1368

"count": "A String", # Number of transformations counted by this result.

1369

"code": "A String", # Outcome of the transformation.

1370

"details": "A String", # A place for warnings or errors to show up if a transformation didn't work as expected.

1371

},

1372

],

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1373

"fieldTransformations": [ # The field transformation that was applied. If multiple field transformations are requested for a single field, this list will contain all of them; otherwise, only one is supplied.

1374

{ # The transformation to apply to the field.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1375

"condition": { # A condition for determining whether a transformation should be applied to a field. # Only apply the transformation if the condition evaluates to true for the given `RecordCondition`. The conditions are allowed to reference fields that are not used in the actual transformation. Example Use Cases: - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range. - Redact a field if the date of birth field is greater than 85.

1376

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

1377

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

1378

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

1379

"conditions": [ # A collection of conditions.

1380

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

1381

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

1382

"name": "A String", # Name describing the field.

1383

},

1384

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

1385

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

1386

"integerValue": "A String", # integer

1387

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1388

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1389

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1390

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1391

},

1392

"stringValue": "A String", # string

1393

"timestampValue": "A String", # timestamp

1394

"floatValue": 3.14, # float

1395

"dayOfWeekValue": "A String", # day of week

1396

"booleanValue": True or False, # boolean

1397

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1398

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1399

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1400

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1401

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

},

},

"fields": [ # Required. Input field(s) to apply the transformation to.

1410

{ # General identifier of a data field in a storage service.

1411

"name": "A String", # Name describing the field.

1412

},

1413

],

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1414

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1415

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1416

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

1417

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1418

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1419

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1420

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1421

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1422

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1423

"stringValue": "A String", # string

1424

"timestampValue": "A String", # timestamp

1425

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1426

"dayOfWeekValue": "A String", # day of week

1427

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1428

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1429

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1430

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1431

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1432

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1433

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1434

},

1435

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

1436

"integerValue": "A String", # integer

1437

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1438

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1439

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1440

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1441

},

1442

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1443

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1444

"floatValue": 3.14, # float

1445

"dayOfWeekValue": "A String", # day of week

1446

"booleanValue": True or False, # boolean

1447

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1448

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1449

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1450

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1451

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1452

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1453

},

1454

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

1455

},

1456

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

1457

"partToExtract": "A String", # The part of the time to keep.

1458

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1459

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1460

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

1461

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1462

},

1463

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

1464

"name": "A String", # Name describing the field.

1465

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1466

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

1467

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1468

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1469

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1470

},

1471

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1472

"key": "A String", # Required. A 128/192/256 bit key.

1473

},

1474

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1475

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1476

},

1477

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1478

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1479

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

1480

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

1481

"name": "A String", # Name describing the field.

1482

},

1483

"commonAlphabet": "A String", # Common alphabets.

1484

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

1485

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

1486

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

1487

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1488

},

1489

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

1490

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1491

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1492

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1493

},

1494

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1495

"key": "A String", # Required. A 128/192/256 bit key.

1496

},

1497

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1498

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1499

},

1500

},

1501

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1502

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1503

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1504

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1505

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1506

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

1507

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

1508

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

1509

"charactersToSkip": "A String", # Characters to not transform when masking.

1510

},

1511

],

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1512

},

1513

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

1514

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

1515

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1516

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1517

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1518

},

1519

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1520

"key": "A String", # Required. A 128/192/256 bit key.

1521

},

1522

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1523

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1524

},

1525

},

1526

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1527

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

1528

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1529

"integerValue": "A String", # integer

1530

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1531

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1532

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1533

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1534

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1535

"stringValue": "A String", # string

1536

"timestampValue": "A String", # timestamp

1537

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1538

"dayOfWeekValue": "A String", # day of week

1539

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1540

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1541

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1542

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1543

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1544

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1545

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1546

},

1547

},

1548

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

1549

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

1550

{ # Bucket is represented as a range, along with replacement values.

1551

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

1552

"integerValue": "A String", # integer

1553

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1554

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1555

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1556

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1557

},

1558

"stringValue": "A String", # string

1559

"timestampValue": "A String", # timestamp

1560

"floatValue": 3.14, # float

1561

"dayOfWeekValue": "A String", # day of week

1562

"booleanValue": True or False, # boolean

1563

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1564

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1565

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1566

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1567

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1568

},

1569

},

1570

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

1571

"integerValue": "A String", # integer

1572

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1573

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1574

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1575

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1576

},

1577

"stringValue": "A String", # string

1578

"timestampValue": "A String", # timestamp

1579

"floatValue": 3.14, # float

1580

"dayOfWeekValue": "A String", # day of week

1581

"booleanValue": True or False, # boolean

1582

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1583

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1584

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1585

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1586

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1587

},

1588

},

1589

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

1590

"integerValue": "A String", # integer

1591

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1592

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1593

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1594

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1595

},

1596

"stringValue": "A String", # string

1597

"timestampValue": "A String", # timestamp

1598

"floatValue": 3.14, # float

1599

"dayOfWeekValue": "A String", # day of week

1600

"booleanValue": True or False, # boolean

1601

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1602

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1603

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1604

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1605

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1612

},

1613

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

1614

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

1615

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1616

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

1617

"name": "A String", # Name describing the field.

1618

},

1619

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

1620

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1621

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1622

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1623

},

1624

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1625

"key": "A String", # Required. A 128/192/256 bit key.

1626

},

1627

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1628

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1629

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1630

},

1631

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1632

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

1633

},

1634

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1635

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the contents of the field as free text, and selectively transform content that matches an `InfoType`.

1636

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

1637

{ # A transformation to apply to text that is identified as a specific info_type.

1638

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

1639

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1640

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

1641

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1642

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1643

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1644

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1645

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1646

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1647

"stringValue": "A String", # string

1648

"timestampValue": "A String", # timestamp

1649

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1650

"dayOfWeekValue": "A String", # day of week

1651

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1652

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1653

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1654

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1655

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1656

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1657

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1658

},

1659

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

1660

"integerValue": "A String", # integer

1661

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1662

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1663

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1664

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1665

},

1666

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1667

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1668

"floatValue": 3.14, # float

1669

"dayOfWeekValue": "A String", # day of week

1670

"booleanValue": True or False, # boolean

1671

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1672

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1673

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1674

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1675

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1676

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1677

},

1678

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

1679

},

1680

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

1681

"partToExtract": "A String", # The part of the time to keep.

1682

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1683

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

1684

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

1685

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1686

},

1687

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

1688

"name": "A String", # Name describing the field.

1689

},

1690

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

1691

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1692

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1693

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1694

},

1695

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1696

"key": "A String", # Required. A 128/192/256 bit key.

1697

},

1698

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1699

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1700

},

1701

},

1702

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1703

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

1704

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

1705

"name": "A String", # Name describing the field.

1706

},

1707

"commonAlphabet": "A String", # Common alphabets.

1708

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

1709

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

1710

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

1711

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1712

},

1713

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

1714

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1715

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1716

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1717

},

1718

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1719

"key": "A String", # Required. A 128/192/256 bit key.

1720

},

1721

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1722

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1723

},

1724

},

1725

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1726

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1727

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1728

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1729

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1730

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

1731

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

1732

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

1733

"charactersToSkip": "A String", # Characters to not transform when masking.

1734

},

1735

],

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1736

},

1737

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

1738

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

1739

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1740

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1741

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1742

},

1743

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1744

"key": "A String", # Required. A 128/192/256 bit key.

1745

},

1746

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1747

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

1752

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

1753

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1754

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1755

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1756

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1757

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1758

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1759

"stringValue": "A String", # string

1760

"timestampValue": "A String", # timestamp

1761

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1762

"dayOfWeekValue": "A String", # day of week

1763

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1764

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1765

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1766

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1767

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1768

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1769

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1770

},

1771

},

1772

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

1773

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

1774

{ # Bucket is represented as a range, along with replacement values.

1775

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

1776

"integerValue": "A String", # integer

1777

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1778

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1779

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1780

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1781

},

1782

"stringValue": "A String", # string

1783

"timestampValue": "A String", # timestamp

1784

"floatValue": 3.14, # float

1785

"dayOfWeekValue": "A String", # day of week

1786

"booleanValue": True or False, # boolean

1787

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1788

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1789

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1790

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1791

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1792

},

1793

},

1794

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

1795

"integerValue": "A String", # integer

1796

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1797

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1798

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1799

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1800

},

1801

"stringValue": "A String", # string

1802

"timestampValue": "A String", # timestamp

1803

"floatValue": 3.14, # float

1804

"dayOfWeekValue": "A String", # day of week

1805

"booleanValue": True or False, # boolean

1806

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1807

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1808

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1809

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1810

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1811

},

1812

},

1813

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

1814

"integerValue": "A String", # integer

1815

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1816

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1817

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1818

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1819

},

1820

"stringValue": "A String", # string

1821

"timestampValue": "A String", # timestamp

1822

"floatValue": 3.14, # float

1823

"dayOfWeekValue": "A String", # day of week

1824

"booleanValue": True or False, # boolean

1825

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1826

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1827

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1828

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1829

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1836

},

1837

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

1838

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

1839

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1840

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

1841

"name": "A String", # Name describing the field.

1842

},

1843

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

1844

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1845

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1846

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1847

},

1848

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1849

"key": "A String", # Required. A 128/192/256 bit key.

1850

},

1851

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1852

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1853

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1854

},

1855

},

1856

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

1857

},

1858

},

1859

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

1860

{ # Type of information detected by the API.

1861

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1866

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1867

},

1868

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1869

"field": { # General identifier of a data field in a storage service. # Set if the transformation was limited to a specific FieldId.

1870

"name": "A String", # Name describing the field.

1871

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1872

"infoType": { # Type of information detected by the API. # Set if the transformation was limited to a specific InfoType.

1873

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1874

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1875

},

1876

],

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

},

}</pre>

</div>

<code class="details" id="inspect">inspect(parent, body=None, x__xgafv=None)</code>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1883

<pre>Finds potentially sensitive info in content. This method has limits on input size, processing time, and output size. When no InfoTypes or CustomInfoTypes are specified in this request, the system will automatically choose what detectors to run. By default this may be all types, but may change over time as detectors are updated. For how to guides, see https://cloud.google.com/dlp/docs/inspecting-images and https://cloud.google.com/dlp/docs/inspecting-text,

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1884

1885

Args:

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1886

parent: string, Parent resource name. The format of this value varies depending on whether you have [specified a processing location](https://cloud.google.com/dlp/docs/specifying-location): + Projects scope, location specified: `projects/`PROJECT_ID`/locations/`LOCATION_ID + Projects scope, no location specified (defaults to global): `projects/`PROJECT_ID The following example `parent` string specifies a parent project with the identifier `example-project`, and specifies the `europe-west3` location for processing data: parent=projects/example-project/locations/europe-west3 (required)

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1887

body: object, The request body.

1888

The object takes the form of:

1889

1890

{ # Request to search for potentially sensitive info in a ContentItem.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1891

"item": { # Container structure for the content to inspect. # The item to inspect.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1892

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to learn more. # Structured content for inspection. See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to learn more.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1893

"headers": [ # Headers of the table.

1894

{ # General identifier of a data field in a storage service.

1895

"name": "A String", # Name describing the field.

1896

},

1897

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1898

"rows": [ # Rows of the table.

1899

{ # Values of the row.

1900

"values": [ # Individual cells.

1901

{ # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data.

1902

"integerValue": "A String", # integer

1903

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1904

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1905

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1906

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1907

},

1908

"stringValue": "A String", # string

1909

"timestampValue": "A String", # timestamp

1910

"floatValue": 3.14, # float

1911

"dayOfWeekValue": "A String", # day of week

1912

"booleanValue": True or False, # boolean

1913

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1914

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1915

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1916

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1917

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

],

},

],

},

"value": "A String", # String data to inspect or redact.

1925

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

1926

"data": "A String", # Content data to inspect or redact.

1927

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1928

},

1929

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1930

"locationId": "A String", # Deprecated. This field has no effect.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1931

"inspectTemplateName": "A String", # Template to use. Any configuration directly specified in inspect_config will override those set in the template. Singular fields that are set in this request will replace their corresponding fields in the template. Repeated fields are appended. Singular sub-messages and groups are recursively merged.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1932

"inspectConfig": { # Configuration description of the scanning process. When used with redactContent only info_types and min_likelihood are currently used. # Configuration for the inspector. What specified here will override the template referenced by the inspect_template_name argument.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1933

"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is included in the response; see Finding.quote.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1934

"customInfoTypes": [ # CustomInfoTypes provided by the user. See https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

1935

{ # Custom information type provided by the user. Used to find domain-specific sensitive information configurable to the data in question.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1936

"storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in `InspectDataSource`. Not currently supported in `InspectContent`.

1937

"createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for inspection was created. Output-only field, populated by the system.

1938

"name": "A String", # Resource name of the requested `StoredInfoType`, for example `organizations/433245324/storedInfoTypes/432452342` or `projects/project-id/storedInfoTypes/432452342`.

1939

},

1940

"likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be altered by a detection rule if the finding meets the criteria specified by the rule. Defaults to `VERY_LIKELY` if not specified.

1941

"regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.

1942

"pattern": "A String", # Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.

1943

"groupIndexes": [ # The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.

1944

42,

1945

],

1946

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1947

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can be used to match sensitive information specific to the data, such as a list of employee IDs or job titles. Dictionary words are case-insensitive and all characters other than letters and digits in the unicode [Basic Multilingual Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane) will be replaced with whitespace when scanning for matches, so the dictionary phrase "Sam Johnson" will match all three phrases "sam johnson", "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters surrounding any match must be of a different type than the adjacent characters within the word, so letters must be next to non-letters and digits next to non-digits. For example, the dictionary word "jen" will match the first three letters of the text "jen123" but will return no matches for "jennifer". Dictionary words containing a large number of characters that are not letters or digits may result in unexpected findings because such characters are treated as whitespace. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries. For dictionaries that do not fit within these constraints, consider using `LargeCustomDictionaryConfig` in the `StoredInfoType` API. # A list of phrases to detect as a CustomInfoType.

1948

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file is accepted.

1949

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage. Example: gs://[BUCKET_NAME]/dictionary.txt

1950

},

1951

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

1952

"words": [ # Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits. [required]

"A String",

],

},

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1957

"exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding to be returned. It still can be used for rules matching.

1958

"surrogateType": { # Message for detecting output from deidentification transformations such as [`CryptoReplaceFfxFpeConfig`](https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig). These types of transformations are those that perform pseudonymization, thereby producing a "surrogate" as output. This should be used in conjunction with a field on the transformation such as `surrogate_info_type`. This CustomInfoType does not support the use of `detection_rules`. # Message for detecting output from deidentification transformations that support reversing.

1959

},

1960

"infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in infoType, when the name matches one of existing infoTypes and that infoType is specified in `InspectContent.info_types` field. Specifying the latter adds findings to the one detected by the system. If built-in info type is not specified in `InspectContent.info_types` list then the name is treated as a custom info type.

1961

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1962

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1963

"detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType. Rules are applied in order that they are specified. Not supported for the `surrogate_type` CustomInfoType.

1964

{ # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a `CustomInfoType` to alter behavior under certain circumstances, depending on the specific details of the rule. Not supported for the `surrogate_type` custom infoType.

1965

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain proximity of hotwords. # Hotword-based detection rule.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1966

"proximity": { # Message for specifying a window around a finding to apply a detection rule. # Proximity of the finding within which the entire hotword must reside. The total length of the window cannot exceed 1000 characters. Note that the finding itself will be included in the window, so that hotwords may be used to match substrings of the finding itself. For example, the certainty of a phone number regex "$\d{3}$ \d{3}-\d{4}" could be adjusted upwards if the area code is known to be the local area code of a company office using the hotword regex "$xxx$", where "xxx" is the area code in question.

1967

"windowAfter": 42, # Number of characters after the finding to consider.

1968

"windowBefore": 42, # Number of characters before the finding to consider.

1969

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1970

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

1971

"pattern": "A String", # Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.

1972

"groupIndexes": [ # The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.

42,

],

},

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as part of a detection rule. # Likelihood adjustment to apply to all matching findings.

1977

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

1978

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of levels. For example, if a finding would be `POSSIBLE` without the detection rule and `relative_likelihood` is 1, then it is upgraded to `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`. Likelihood may never drop below `VERY_UNLIKELY` or exceed `VERY_LIKELY`, so applying an adjustment of 1 followed by an adjustment of -1 when base likelihood is `VERY_LIKELY` will result in a final likelihood of `LIKELY`.

1979

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1980

},

1981

},

1982

],

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1983

},

1984

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1985

"contentOptions": [ # List of options defining data content to scan. If empty, text, images, and other content will be included.

1986

"A String",

1987

],

1988

"minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is POSSIBLE. See https://cloud.google.com/dlp/docs/likelihood to learn more.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1989

"limits": { # Configuration to control the number of findings returned. # Configuration to control the number of findings returned.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1990

"maxFindingsPerInfoType": [ # Configuration of findings limit given for specified infoTypes.

1991

{ # Max findings configuration per infoType, per content item or long running DlpJob.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1992

"infoType": { # Type of information detected by the API. # Type of information the findings limit applies to. Only one limit per info_type should be provided. If InfoTypeLimit does not have an info_type, the DLP API applies the limit against all info_types that are found but not specified in another InfoTypeLimit.

1993

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1994

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1995

"maxFindings": 42, # Max findings limit for the given infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1996

},

1997

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1998

"maxFindingsPerRequest": 42, # Max number of findings that will be returned per request/job. When set within `InspectContentRequest`, the maximum returned is 2000 regardless if this is set higher.

1999

"maxFindingsPerItem": 42, # Max number of findings that will be returned for each item scanned. When set within `InspectJobConfig`, the maximum returned is 2000 regardless if this is set higher. When set within `InspectContentRequest`, this field is ignored.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2000

},

2001

"infoTypes": [ # Restricts what info_types to look for. The values must correspond to InfoType values returned by ListInfoTypes or listed at https://cloud.google.com/dlp/docs/infotypes-reference. When no InfoTypes or CustomInfoTypes are specified in a request, the system may automatically choose what detectors to run. By default this may be all types, but may change over time as detectors are updated. If you need precise control and predictability as to what detectors are run you should specify specific InfoTypes listed in the reference, otherwise a default list will be used, which may change over time.

2002

{ # Type of information detected by the API.

2003

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2004

},

2005

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2006

"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig. Exclusion rules, contained in the set are executed in the end, other rules are executed in the order they are specified for each info type.

2007

{ # Rule set for modifying a set of infoTypes to alter behavior under certain circumstances, depending on the specific details of the rules within the set.

2008

"infoTypes": [ # List of infoTypes this rule set is applied to.

2009

{ # Type of information detected by the API.

2010

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2011

},

2012

],

2013

"rules": [ # Set of rules to be applied to infoTypes. The rules are applied in order.

2014

{ # A single inspection rule to be applied to infoTypes, specified in `InspectionRuleSet`.

2015

"exclusionRule": { # The rule that specifies conditions when findings of infoTypes specified in `InspectionRuleSet` are removed from results. # Exclusion rule.

2016

"regex": { # Message defining a custom regular expression. # Regular expression which defines the rule.

2017

"pattern": "A String", # Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.

2018

"groupIndexes": [ # The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.

42,

],

},

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can be used to match sensitive information specific to the data, such as a list of employee IDs or job titles. Dictionary words are case-insensitive and all characters other than letters and digits in the unicode [Basic Multilingual Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane) will be replaced with whitespace when scanning for matches, so the dictionary phrase "Sam Johnson" will match all three phrases "sam johnson", "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters surrounding any match must be of a different type than the adjacent characters within the word, so letters must be next to non-letters and digits next to non-digits. For example, the dictionary word "jen" will match the first three letters of the text "jen123" but will return no matches for "jennifer". Dictionary words containing a large number of characters that are not letters or digits may result in unexpected findings because such characters are treated as whitespace. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries. For dictionaries that do not fit within these constraints, consider using `LargeCustomDictionaryConfig` in the `StoredInfoType` API. # Dictionary which defines the rule.

2023

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file is accepted.

2024

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage. Example: gs://[BUCKET_NAME]/dictionary.txt

2025

},

2026

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

2027

"words": [ # Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits. [required]

"A String",

],

},

},

"excludeInfoTypes": { # List of exclude infoTypes. # Set of infoTypes for which findings would affect this rule.

2033

"infoTypes": [ # InfoType list in ExclusionRule rule drops a finding when it overlaps or contained within with a finding of an infoType from this list. For example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and `exclusion_rule` containing `exclude_info_types.info_types` with "EMAIL_ADDRESS" the phone number findings are dropped if they overlap with EMAIL_ADDRESS finding. That leads to "555-222-2222@example.org" to generate only a single finding, namely email address.

2034

{ # Type of information detected by the API.

2035

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

"matchingType": "A String", # How the rule is applied, see MatchingType documentation for details.

2040

},

2041

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain proximity of hotwords. # Hotword-based detection rule.

2042

"proximity": { # Message for specifying a window around a finding to apply a detection rule. # Proximity of the finding within which the entire hotword must reside. The total length of the window cannot exceed 1000 characters. Note that the finding itself will be included in the window, so that hotwords may be used to match substrings of the finding itself. For example, the certainty of a phone number regex "$\d{3}$ \d{3}-\d{4}" could be adjusted upwards if the area code is known to be the local area code of a company office using the hotword regex "$xxx$", where "xxx" is the area code in question.

2043

"windowAfter": 42, # Number of characters after the finding to consider.

2044

"windowBefore": 42, # Number of characters before the finding to consider.

2045

},

2046

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

2047

"pattern": "A String", # Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.

2048

"groupIndexes": [ # The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.

42,

],

},

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as part of a detection rule. # Likelihood adjustment to apply to all matching findings.

2053

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

2054

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of levels. For example, if a finding would be `POSSIBLE` without the detection rule and `relative_likelihood` is 1, then it is upgraded to `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`. Likelihood may never drop below `VERY_UNLIKELY` or exceed `VERY_LIKELY`, so applying an adjustment of 1 followed by an adjustment of -1 when base likelihood is `VERY_LIKELY` will result in a final likelihood of `LIKELY`.

},

},

},

],

},

],

"excludeInfoTypes": True or False, # When true, excludes type information of the findings.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2062

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2063

}

2064

2065

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2072

2073

{ # Results of inspecting an item.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2074

"result": { # All the findings for a single scanned item. # The findings.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2075

"findingsTruncated": True or False, # If true, then this item might have more findings than were returned, and the findings returned are an arbitrary subset of all findings. The findings list might be truncated because the input items were too large, or because the server reached the maximum amount of resources allowed for a single API call. For best results, divide the input into smaller batches.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2076

"findings": [ # List of findings for an item.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2077

{ # Represents a piece of potentially sensitive content.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2078

"quoteInfo": { # Message for infoType-dependent details parsed from quote. # Contains data parsed from quotes. Only populated if include_quote was set to true and a supported infoType was requested. Currently supported infoTypes: DATE, DATE_OF_BIRTH and TIME.

2079

"dateTime": { # Message for a date time object. e.g. 2018-01-01, 5th August. # The date time indicated by the quote.

2080

"date": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # One or more of the following must be set. Must be a valid date or time value.

2081

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2082

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2083

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2084

},

2085

"timeZone": { # Time zone of the date time object. # Time zone

2086

"offsetMinutes": 42, # Set only if the offset can be determined. Positive for time ahead of UTC. E.g. For "UTC-9", this value is -540.

2087

},

2088

"time": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # Time of day

2089

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2090

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2091

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2092

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2093

},

2094

"dayOfWeek": "A String", # Day of week

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2095

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2096

},

2097

"findingId": "A String", # The unique finding id.

2098

"name": "A String", # Resource name in format projects/{project}/locations/{location}/findings/{finding} Populated only when viewing persisted findings.

2099

"location": { # Specifies the location of the finding. # Where the content was found.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2100

"container": { # Represents a container that may contain DLP findings. Examples of a container include a file, table, or database record. # Information about the container where this finding occurred, if available.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2101

"version": "A String", # Findings container version, if available ("generation" for Google Cloud Storage).

2102

"relativePath": "A String", # The rest of the path after the root. Examples: - For BigQuery table `project_id:dataset_id.table_id`, the relative path is `table_id` - Google Cloud Storage file `gs://bucket/folder/filename.txt`, the relative path is `folder/filename.txt`

2103

"type": "A String", # Container type, for example BigQuery or Google Cloud Storage.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2104

"fullPath": "A String", # A string representation of the full container name. Examples: - BigQuery: 'Project:DataSetId.TableId' - Google Cloud Storage: 'gs://Bucket/folders/filename.txt'

2105

"rootPath": "A String", # The root of the container. Examples: - For BigQuery table `project_id:dataset_id.table_id`, the root is `dataset_id` - For Google Cloud Storage file `gs://bucket/folder/filename.txt`, the root is `gs://bucket`

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2106

"projectId": "A String", # Project where the finding was found. Can be different from the project that owns the finding.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2107

"updateTime": "A String", # Findings container modification timestamp, if applicable. For Google Cloud Storage contains last file modification timestamp. For BigQuery table contains last_modified_time property. For Datastore - not populated.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2108

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2109

"byteRange": { # Generic half-open interval [start, end) # Zero-based byte offsets delimiting the finding. These are relative to the finding's containing element. Note that when the content is not textual, this references the UTF-8 encoded textual representation of the content. Omitted if content is an image.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2110

"start": "A String", # Index of the first character of the range (inclusive).

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2111

"end": "A String", # Index of the last character of the range (exclusive).

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2112

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2113

"contentLocations": [ # List of nested objects pointing to the precise location of the finding within the file or record.

2114

{ # Precise location of the finding within a document, record, image, or metadata container.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2115

"containerTimestamp": "A String", # Findings container modification timestamp, if applicable. For Google Cloud Storage contains last file modification timestamp. For BigQuery table contains last_modified_time property. For Datastore - not populated.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2116

"containerVersion": "A String", # Findings container version, if available ("generation" for Google Cloud Storage).

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2117

"metadataLocation": { # Metadata Location # Location within the metadata for inspected content.

2118

"storageLabel": { # Storage metadata label to indicate which metadata entry contains findings. # Storage metadata.

2119

"key": "A String",

2120

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2121

"type": "A String", # Type of metadata containing the finding.

2122

},

2123

"documentLocation": { # Location of a finding within a document. # Location data for document files.

2124

"fileOffset": "A String", # Offset of the line, from the beginning of the file, where the finding is located.

Bu Sun Kim

d059ad8

2020-07-22 17:02:09 -0700

[diff] [blame]

2125

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2126

"containerName": "A String", # Name of the container where the finding is located. The top level name is the source file name or table name. Names of some common storage containers are formatted as follows: * BigQuery tables: `{project_id}:{dataset_id}.{table_id}` * Cloud Storage files: `gs://{bucket}/{path}` * Datastore namespace: {namespace} Nested names could be absent if the embedded object has no string identifier (for an example an image contained within a document).

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2127

"imageLocation": { # Location of the finding within an image. # Location within an image's pixels.

2128

"boundingBoxes": [ # Bounding boxes locating the pixels within the image containing the finding.

2129

{ # Bounding box encompassing detected text within an image.

2130

"top": 42, # Top coordinate of the bounding box. (0,0) is upper left.

2131

"width": 42, # Width of the bounding box in pixels.

2132

"height": 42, # Height of the bounding box in pixels.

2133

"left": 42, # Left coordinate of the bounding box. (0,0) is upper left.

2134

},

2135

],

2136

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2137

"recordLocation": { # Location of a finding within a row or record. # Location within a row or record of a database table.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2138

"tableLocation": { # Location of a finding within a table. # Location within a `ContentItem.Table`.

2139

"rowIndex": "A String", # The zero-based index of the row where the finding is located. Only populated for resources that have a natural ordering, not BigQuery. In BigQuery, to identify the row a finding came from, populate BigQueryOptions.identifying_fields with your primary key column names and when you store the findings the value of those columns will be stored inside of Finding.

2140

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2141

"recordKey": { # Message for a unique key indicating a record that contains a finding. # Key of the finding.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2142

"idValues": [ # Values of identifying columns in the given row. Order of values matches the order of `identifying_fields` specified in the scanning request.

2143

"A String",

2144

],

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2145

"bigQueryKey": { # Row key for identifying a record in BigQuery table.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2146

"tableReference": { # Message defining the location of a BigQuery table. A table is uniquely identified by its project_id, dataset_id, and table_name. Within a query a table is often referenced with a string in the format of: `:.` or `..`. # Complete BigQuery table reference.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2147

"datasetId": "A String", # Dataset ID of the table.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2148

"tableId": "A String", # Name of the table.

2149

"projectId": "A String", # The Google Cloud Platform project ID of the project containing the table. If omitted, project ID is inferred from the API call.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2150

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2151

"rowNumber": "A String", # Row number inferred at the time the table was scanned. This value is nondeterministic, cannot be queried, and may be null for inspection jobs. To locate findings within a table, specify `inspect_job.storage_config.big_query_options.identifying_fields` in `CreateDlpJobRequest`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2152

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2153

"datastoreKey": { # Record key for a finding in Cloud Datastore.

2154

"entityKey": { # A unique identifier for a Datastore entity. If a key's partition ID or any of its path kinds or names are reserved/read-only, the key is reserved/read-only. A reserved/read-only key is forbidden in certain documented contexts. # Datastore entity key.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2155

"partitionId": { # Datastore partition ID. A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty. A partition ID contains several dimensions: project ID and namespace ID. # Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.

2156

"namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.

2157

"projectId": "A String", # The ID of the project to which the entities belong.

2158

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2159

"path": [ # The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a _root entity_, the second element identifies a _child_ of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's _ancestors_. A path can never be empty, and a path can have at most 100 elements.

2160

{ # A (kind, ID/name) pair used to construct a key path. If either name or ID is set, the element is complete. If neither is set, the element is incomplete.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2161

"name": "A String", # The name of the entity. A name matching regex `__.*__` is reserved/read-only. A name must not be more than 1500 bytes when UTF-8 encoded. Cannot be `""`.

2162

"id": "A String", # The auto-allocated ID of the entity. Never equal to zero. Values less than zero are discouraged and may not be supported in the future.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2163

"kind": "A String", # The kind of the entity. A kind matching regex `__.*__` is reserved/read-only. A kind must not contain more than 1500 bytes when UTF-8 encoded. Cannot be `""`.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2164

},

2165

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2166

},

2167

},

2168

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2169

"fieldId": { # General identifier of a data field in a storage service. # Field id of the field containing the finding.

2170

"name": "A String", # Name describing the field.

2171

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2172

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2173

},

2174

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2175

"codepointRange": { # Generic half-open interval [start, end) # Unicode character offsets delimiting the finding. These are relative to the finding's containing element. Provided when the content is text.

2176

"start": "A String", # Index of the first character of the range (inclusive).

2177

"end": "A String", # Index of the last character of the range (exclusive).

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2178

},

2179

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2180

"triggerName": "A String", # Job trigger name, if applicable, for this finding.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2181

"infoType": { # Type of information detected by the API. # The type of content that might have been found. Provided if `excluded_types` is false.

2182

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2183

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2184

"jobName": "A String", # The job that stored the finding.

2185

"resourceName": "A String", # The job that stored the finding.

2186

"quote": "A String", # The content that was found. Even if the content is not textual, it may be converted to a textual representation here. Provided if `include_quote` is true and the finding is less than or equal to 4096 bytes long. If the finding exceeds 4096 bytes in length, the quote may be omitted.

2187

"likelihood": "A String", # Confidence of how likely it is that the `info_type` is correct.

2188

"jobCreateTime": "A String", # Time the job started that produced this finding.

2189

"createTime": "A String", # Timestamp when finding was detected.

2190

"labels": { # The labels associated with this `Finding`. Label keys must be between 1 and 63 characters long and must conform to the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?`. Label values must be between 0 and 63 characters long and must conform to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`. No more than 10 labels can be associated with a given finding. Examples: * `"environment" : "production"` * `"pipeline" : "etl"`

2191

"a_key": "A String",

2192

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

],

},

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2200

<code class="details" id="reidentify">reidentify(parent, body=None, x__xgafv=None)</code>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2201

<pre>Re-identifies content that has been de-identified. See https://cloud.google.com/dlp/docs/pseudonymization#re-identification_in_free_text_code_example to learn more.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2202

2203

Args:

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2204

parent: string, Required. Parent resource name. The format of this value varies depending on whether you have [specified a processing location](https://cloud.google.com/dlp/docs/specifying-location): + Projects scope, location specified: `projects/`PROJECT_ID`/locations/`LOCATION_ID + Projects scope, no location specified (defaults to global): `projects/`PROJECT_ID The following example `parent` string specifies a parent project with the identifier `example-project`, and specifies the `europe-west3` location for processing data: parent=projects/example-project/locations/europe-west3 (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2205

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2206

The object takes the form of:

2207

2208

{ # Request to re-identify an item.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2209

"inspectConfig": { # Configuration description of the scanning process. When used with redactContent only info_types and min_likelihood are currently used. # Configuration for the inspector.

2210

"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is included in the response; see Finding.quote.

2211

"customInfoTypes": [ # CustomInfoTypes provided by the user. See https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

2212

{ # Custom information type provided by the user. Used to find domain-specific sensitive information configurable to the data in question.

2213

"storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in `InspectDataSource`. Not currently supported in `InspectContent`.

2214

"createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for inspection was created. Output-only field, populated by the system.

2215

"name": "A String", # Resource name of the requested `StoredInfoType`, for example `organizations/433245324/storedInfoTypes/432452342` or `projects/project-id/storedInfoTypes/432452342`.

2216

},

2217

"likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be altered by a detection rule if the finding meets the criteria specified by the rule. Defaults to `VERY_LIKELY` if not specified.

2218

"regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.

2219

"pattern": "A String", # Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.

2220

"groupIndexes": [ # The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.

2221

42,

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2222

],

2223

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2224

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can be used to match sensitive information specific to the data, such as a list of employee IDs or job titles. Dictionary words are case-insensitive and all characters other than letters and digits in the unicode [Basic Multilingual Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane) will be replaced with whitespace when scanning for matches, so the dictionary phrase "Sam Johnson" will match all three phrases "sam johnson", "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters surrounding any match must be of a different type than the adjacent characters within the word, so letters must be next to non-letters and digits next to non-digits. For example, the dictionary word "jen" will match the first three letters of the text "jen123" but will return no matches for "jennifer". Dictionary words containing a large number of characters that are not letters or digits may result in unexpected findings because such characters are treated as whitespace. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries. For dictionaries that do not fit within these constraints, consider using `LargeCustomDictionaryConfig` in the `StoredInfoType` API. # A list of phrases to detect as a CustomInfoType.

2225

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file is accepted.

2226

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage. Example: gs://[BUCKET_NAME]/dictionary.txt

2227

},

2228

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

2229

"words": [ # Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits. [required]

"A String",

],

},

},

"exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding to be returned. It still can be used for rules matching.

2235

"surrogateType": { # Message for detecting output from deidentification transformations such as [`CryptoReplaceFfxFpeConfig`](https://cloud.google.com/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig). These types of transformations are those that perform pseudonymization, thereby producing a "surrogate" as output. This should be used in conjunction with a field on the transformation such as `surrogate_info_type`. This CustomInfoType does not support the use of `detection_rules`. # Message for detecting output from deidentification transformations that support reversing.

2236

},

2237

"infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in infoType, when the name matches one of existing infoTypes and that infoType is specified in `InspectContent.info_types` field. Specifying the latter adds findings to the one detected by the system. If built-in info type is not specified in `InspectContent.info_types` list then the name is treated as a custom info type.

2238

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2239

},

2240

"detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType. Rules are applied in order that they are specified. Not supported for the `surrogate_type` CustomInfoType.

2241

{ # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a `CustomInfoType` to alter behavior under certain circumstances, depending on the specific details of the rule. Not supported for the `surrogate_type` custom infoType.

2242

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain proximity of hotwords. # Hotword-based detection rule.

2243

"proximity": { # Message for specifying a window around a finding to apply a detection rule. # Proximity of the finding within which the entire hotword must reside. The total length of the window cannot exceed 1000 characters. Note that the finding itself will be included in the window, so that hotwords may be used to match substrings of the finding itself. For example, the certainty of a phone number regex "$\d{3}$ \d{3}-\d{4}" could be adjusted upwards if the area code is known to be the local area code of a company office using the hotword regex "$xxx$", where "xxx" is the area code in question.

2244

"windowAfter": 42, # Number of characters after the finding to consider.

2245

"windowBefore": 42, # Number of characters before the finding to consider.

2246

},

2247

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

2248

"pattern": "A String", # Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.

2249

"groupIndexes": [ # The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.

42,

],

},

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as part of a detection rule. # Likelihood adjustment to apply to all matching findings.

2254

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

2255

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of levels. For example, if a finding would be `POSSIBLE` without the detection rule and `relative_likelihood` is 1, then it is upgraded to `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`. Likelihood may never drop below `VERY_UNLIKELY` or exceed `VERY_LIKELY`, so applying an adjustment of 1 followed by an adjustment of -1 when base likelihood is `VERY_LIKELY` will result in a final likelihood of `LIKELY`.

},

},

},

],

},

],

"contentOptions": [ # List of options defining data content to scan. If empty, text, images, and other content will be included.

2263

"A String",

2264

],

2265

"minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is POSSIBLE. See https://cloud.google.com/dlp/docs/likelihood to learn more.

2266

"limits": { # Configuration to control the number of findings returned. # Configuration to control the number of findings returned.

2267

"maxFindingsPerInfoType": [ # Configuration of findings limit given for specified infoTypes.

2268

{ # Max findings configuration per infoType, per content item or long running DlpJob.

2269

"infoType": { # Type of information detected by the API. # Type of information the findings limit applies to. Only one limit per info_type should be provided. If InfoTypeLimit does not have an info_type, the DLP API applies the limit against all info_types that are found but not specified in another InfoTypeLimit.

2270

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2271

},

2272

"maxFindings": 42, # Max findings limit for the given infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2273

},

2274

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2275

"maxFindingsPerRequest": 42, # Max number of findings that will be returned per request/job. When set within `InspectContentRequest`, the maximum returned is 2000 regardless if this is set higher.

2276

"maxFindingsPerItem": 42, # Max number of findings that will be returned for each item scanned. When set within `InspectJobConfig`, the maximum returned is 2000 regardless if this is set higher. When set within `InspectContentRequest`, this field is ignored.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2277

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2278

"infoTypes": [ # Restricts what info_types to look for. The values must correspond to InfoType values returned by ListInfoTypes or listed at https://cloud.google.com/dlp/docs/infotypes-reference. When no InfoTypes or CustomInfoTypes are specified in a request, the system may automatically choose what detectors to run. By default this may be all types, but may change over time as detectors are updated. If you need precise control and predictability as to what detectors are run you should specify specific InfoTypes listed in the reference, otherwise a default list will be used, which may change over time.

2279

{ # Type of information detected by the API.

2280

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2281

},

2282

],

2283

"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig. Exclusion rules, contained in the set are executed in the end, other rules are executed in the order they are specified for each info type.

2284

{ # Rule set for modifying a set of infoTypes to alter behavior under certain circumstances, depending on the specific details of the rules within the set.

2285

"infoTypes": [ # List of infoTypes this rule set is applied to.

2286

{ # Type of information detected by the API.

2287

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2288

},

2289

],

2290

"rules": [ # Set of rules to be applied to infoTypes. The rules are applied in order.

2291

{ # A single inspection rule to be applied to infoTypes, specified in `InspectionRuleSet`.

2292

"exclusionRule": { # The rule that specifies conditions when findings of infoTypes specified in `InspectionRuleSet` are removed from results. # Exclusion rule.

2293

"regex": { # Message defining a custom regular expression. # Regular expression which defines the rule.

2294

"pattern": "A String", # Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.

2295

"groupIndexes": [ # The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.

2296

42,

2297

],

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2298

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2299

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can be used to match sensitive information specific to the data, such as a list of employee IDs or job titles. Dictionary words are case-insensitive and all characters other than letters and digits in the unicode [Basic Multilingual Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane) will be replaced with whitespace when scanning for matches, so the dictionary phrase "Sam Johnson" will match all three phrases "sam johnson", "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters surrounding any match must be of a different type than the adjacent characters within the word, so letters must be next to non-letters and digits next to non-digits. For example, the dictionary word "jen" will match the first three letters of the text "jen123" but will return no matches for "jennifer". Dictionary words containing a large number of characters that are not letters or digits may result in unexpected findings because such characters are treated as whitespace. The [limits](https://cloud.google.com/dlp/limits) page contains details about the size limits of dictionaries. For dictionaries that do not fit within these constraints, consider using `LargeCustomDictionaryConfig` in the `StoredInfoType` API. # Dictionary which defines the rule.

2300

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file is accepted.

2301

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage. Example: gs://[BUCKET_NAME]/dictionary.txt

2302

},

2303

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

2304

"words": [ # Words or phrases defining the dictionary. The dictionary must contain at least one phrase and every phrase must contain at least 2 characters that are letters or digits. [required]

"A String",

],

},

},

"excludeInfoTypes": { # List of exclude infoTypes. # Set of infoTypes for which findings would affect this rule.

2310

"infoTypes": [ # InfoType list in ExclusionRule rule drops a finding when it overlaps or contained within with a finding of an infoType from this list. For example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and `exclusion_rule` containing `exclude_info_types.info_types` with "EMAIL_ADDRESS" the phone number findings are dropped if they overlap with EMAIL_ADDRESS finding. That leads to "555-222-2222@example.org" to generate only a single finding, namely email address.

2311

{ # Type of information detected by the API.

2312

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

"matchingType": "A String", # How the rule is applied, see MatchingType documentation for details.

2317

},

2318

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain proximity of hotwords. # Hotword-based detection rule.

2319

"proximity": { # Message for specifying a window around a finding to apply a detection rule. # Proximity of the finding within which the entire hotword must reside. The total length of the window cannot exceed 1000 characters. Note that the finding itself will be included in the window, so that hotwords may be used to match substrings of the finding itself. For example, the certainty of a phone number regex "$\d{3}$ \d{3}-\d{4}" could be adjusted upwards if the area code is known to be the local area code of a company office using the hotword regex "$xxx$", where "xxx" is the area code in question.

2320

"windowAfter": 42, # Number of characters after the finding to consider.

2321

"windowBefore": 42, # Number of characters before the finding to consider.

2322

},

2323

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

2324

"pattern": "A String", # Pattern defining the regular expression. Its syntax (https://github.com/google/re2/wiki/Syntax) can be found under the google/re2 repository on GitHub.

2325

"groupIndexes": [ # The index of the submatch to extract as findings. When not specified, the entire match is returned. No more than 3 may be included.

42,

],

},

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as part of a detection rule. # Likelihood adjustment to apply to all matching findings.

2330

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

2331

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of levels. For example, if a finding would be `POSSIBLE` without the detection rule and `relative_likelihood` is 1, then it is upgraded to `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`. Likelihood may never drop below `VERY_UNLIKELY` or exceed `VERY_LIKELY`, so applying an adjustment of 1 followed by an adjustment of -1 when base likelihood is `VERY_LIKELY` will result in a final likelihood of `LIKELY`.

},

},

},

],

},

],

"excludeInfoTypes": True or False, # When true, excludes type information of the findings.

2339

},

2340

"reidentifyTemplateName": "A String", # Template to use. References an instance of `DeidentifyTemplate`. Any configuration directly specified in `reidentify_config` or `inspect_config` will override those set in the template. The `DeidentifyTemplate` used must include only reversible transformations. Singular fields that are set in this request will replace their corresponding fields in the template. Repeated fields are appended. Singular sub-messages and groups are recursively merged.

2341

"locationId": "A String", # Deprecated. This field has no effect.

2342

"inspectTemplateName": "A String", # Template to use. Any configuration directly specified in `inspect_config` will override those set in the template. Singular fields that are set in this request will replace their corresponding fields in the template. Repeated fields are appended. Singular sub-messages and groups are recursively merged.

2343

"reidentifyConfig": { # The configuration that controls how the data will change. # Configuration for the re-identification of the content item. This field shares the same proto message type that is used for de-identification, however its usage here is for the reversal of the previous de-identification. Re-identification is performed by examining the transformations used to de-identify the items and executing the reverse. This requires that only reversible transformations be provided here. The reversible transformations are: - `CryptoDeterministicConfig` - `CryptoReplaceFfxFpeConfig`

2344

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the dataset as free-form text and apply the same free text transformation everywhere.

2345

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

2346

{ # A transformation to apply to text that is identified as a specific info_type.

2347

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

2348

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2349

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

2350

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2351

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2352

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2353

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2354

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2355

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2356

"stringValue": "A String", # string

2357

"timestampValue": "A String", # timestamp

2358

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2359

"dayOfWeekValue": "A String", # day of week

2360

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2361

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2362

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2363

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2364

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2365

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2366

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2367

},

2368

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

2369

"integerValue": "A String", # integer

2370

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2371

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2372

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2373

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2374

},

2375

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2376

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2377

"floatValue": 3.14, # float

2378

"dayOfWeekValue": "A String", # day of week

2379

"booleanValue": True or False, # boolean

2380

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2381

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2382

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2383

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2384

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2385

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2386

},

2387

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

2388

},

2389

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

2390

"partToExtract": "A String", # The part of the time to keep.

2391

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2392

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2393

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

2394

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2395

},

2396

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

2397

"name": "A String", # Name describing the field.

2398

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2399

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

2400

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2401

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2402

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2403

},

2404

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2405

"key": "A String", # Required. A 128/192/256 bit key.

2406

},

2407

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2408

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2409

},

2410

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2411

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2412

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

2413

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

2414

"name": "A String", # Name describing the field.

2415

},

2416

"commonAlphabet": "A String", # Common alphabets.

2417

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

2418

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

2419

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

2420

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2421

},

2422

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

2423

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2424

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2425

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2426

},

2427

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2428

"key": "A String", # Required. A 128/192/256 bit key.

2429

},

2430

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2431

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2432

},

2433

},

2434

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2435

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2436

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2437

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2438

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2439

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

2440

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

2441

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

2442

"charactersToSkip": "A String", # Characters to not transform when masking.

2443

},

2444

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2445

},

2446

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

2447

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2448

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2449

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2450

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2451

},

2452

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2453

"key": "A String", # Required. A 128/192/256 bit key.

2454

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2455

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2456

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2457

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2458

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2459

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2460

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

2461

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

2462

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2463

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2464

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2465

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2466

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2467

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2468

"stringValue": "A String", # string

2469

"timestampValue": "A String", # timestamp

2470

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2471

"dayOfWeekValue": "A String", # day of week

2472

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2473

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2474

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2475

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2476

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2477

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2478

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2479

},

2480

},

2481

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

2482

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

2483

{ # Bucket is represented as a range, along with replacement values.

2484

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

2485

"integerValue": "A String", # integer

2486

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2487

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2488

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2489

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2490

},

2491

"stringValue": "A String", # string

2492

"timestampValue": "A String", # timestamp

2493

"floatValue": 3.14, # float

2494

"dayOfWeekValue": "A String", # day of week

2495

"booleanValue": True or False, # boolean

2496

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2497

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2498

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2499

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2500

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2501

},

2502

},

2503

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

2504

"integerValue": "A String", # integer

2505

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2506

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2507

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2508

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2509

},

2510

"stringValue": "A String", # string

2511

"timestampValue": "A String", # timestamp

2512

"floatValue": 3.14, # float

2513

"dayOfWeekValue": "A String", # day of week

2514

"booleanValue": True or False, # boolean

2515

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2516

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2517

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2518

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2519

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2520

},

2521

},

2522

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

2523

"integerValue": "A String", # integer

2524

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2525

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2526

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2527

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2528

},

2529

"stringValue": "A String", # string

2530

"timestampValue": "A String", # timestamp

2531

"floatValue": 3.14, # float

2532

"dayOfWeekValue": "A String", # day of week

2533

"booleanValue": True or False, # boolean

2534

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2535

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2536

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2537

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2538

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

2545

},

2546

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

2547

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

2548

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

2549

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

2550

"name": "A String", # Name describing the field.

2551

},

2552

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

2553

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2554

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2555

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2556

},

2557

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2558

"key": "A String", # Required. A 128/192/256 bit key.

2559

},

2560

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2561

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2562

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2563

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2564

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2565

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2566

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2567

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2568

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

2569

{ # Type of information detected by the API.

2570

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A transformation error occurs when the requested transformation is incompatible with the data. For example, trying to de-identify an IP address using a `DateShift` transformation would result in a transformation error, since date info cannot be extracted from an IP address. Information about any incompatible transformations, and how they were handled, is returned in the response as part of the `TransformationOverviews`. # Mode for handling transformation errors. If left unspecified, the default mode is `TransformationErrorHandling.ThrowError`.

2577

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would cause an error. For example, if a `DateShift` transformation were applied an an IP address, this mode would leave the IP address unchanged in the response. # Ignore errors

2578

},

2579

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

2580

},

2581

},

2582

"recordTransformations": { # A type of transformation that is applied over structured data such as a table. # Treat the dataset as structured. Transformations can be applied to specific locations within structured datasets, such as transforming a column within a table.

2583

"fieldTransformations": [ # Transform the record by applying various field transformations.

2584

{ # The transformation to apply to the field.

2585

"condition": { # A condition for determining whether a transformation should be applied to a field. # Only apply the transformation if the condition evaluates to true for the given `RecordCondition`. The conditions are allowed to reference fields that are not used in the actual transformation. Example Use Cases: - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range. - Redact a field if the date of birth field is greater than 85.

2586

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

2587

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

2588

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

2589

"conditions": [ # A collection of conditions.

2590

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

2591

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

2592

"name": "A String", # Name describing the field.

2593

},

2594

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

2595

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

2596

"integerValue": "A String", # integer

2597

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2598

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2599

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2600

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2601

},

2602

"stringValue": "A String", # string

2603

"timestampValue": "A String", # timestamp

2604

"floatValue": 3.14, # float

2605

"dayOfWeekValue": "A String", # day of week

2606

"booleanValue": True or False, # boolean

2607

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2608

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2609

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2610

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2611

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

},

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2619

"fields": [ # Required. Input field(s) to apply the transformation to.

2620

{ # General identifier of a data field in a storage service.

2621

"name": "A String", # Name describing the field.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2622

},

2623

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2624

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

2625

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

2626

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

2627

"integerValue": "A String", # integer

2628

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2629

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2630

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2631

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2632

},

2633

"stringValue": "A String", # string

2634

"timestampValue": "A String", # timestamp

2635

"floatValue": 3.14, # float

2636

"dayOfWeekValue": "A String", # day of week

2637

"booleanValue": True or False, # boolean

2638

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2639

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2640

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2641

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2642

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2643

},

2644

},

2645

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

2646

"integerValue": "A String", # integer

2647

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2648

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2649

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2650

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2651

},

2652

"stringValue": "A String", # string

2653

"timestampValue": "A String", # timestamp

2654

"floatValue": 3.14, # float

2655

"dayOfWeekValue": "A String", # day of week

2656

"booleanValue": True or False, # boolean

2657

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2658

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2659

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2660

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2661

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2662

},

2663

},

2664

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

2665

},

2666

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

2667

"partToExtract": "A String", # The part of the time to keep.

2668

},

2669

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

2670

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

2671

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2672

},

2673

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

2674

"name": "A String", # Name describing the field.

2675

},

2676

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

2677

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2678

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2679

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2680

},

2681

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2682

"key": "A String", # Required. A 128/192/256 bit key.

2683

},

2684

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2685

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

2690

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

2691

"name": "A String", # Name describing the field.

2692

},

2693

"commonAlphabet": "A String", # Common alphabets.

2694

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

2695

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

2696

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

2697

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2698

},

2699

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

2700

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2701

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2702

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2703

},

2704

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2705

"key": "A String", # Required. A 128/192/256 bit key.

2706

},

2707

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2708

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

2713

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

2714

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

2715

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

2716

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

2717

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

2718

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

2719

"charactersToSkip": "A String", # Characters to not transform when masking.

},

],

},

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

2724

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

2725

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2726

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2727

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2728

},

2729

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2730

"key": "A String", # Required. A 128/192/256 bit key.

2731

},

2732

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2733

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

2738

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

2739

"integerValue": "A String", # integer

2740

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2741

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2742

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2743

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2744

},

2745

"stringValue": "A String", # string

2746

"timestampValue": "A String", # timestamp

2747

"floatValue": 3.14, # float

2748

"dayOfWeekValue": "A String", # day of week

2749

"booleanValue": True or False, # boolean

2750

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2751

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2752

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2753

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2754

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

2759

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

2760

{ # Bucket is represented as a range, along with replacement values.

2761

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

2762

"integerValue": "A String", # integer

2763

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2764

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2765

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2766

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2767

},

2768

"stringValue": "A String", # string

2769

"timestampValue": "A String", # timestamp

2770

"floatValue": 3.14, # float

2771

"dayOfWeekValue": "A String", # day of week

2772

"booleanValue": True or False, # boolean

2773

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2774

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2775

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2776

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2777

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2778

},

2779

},

2780

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

2781

"integerValue": "A String", # integer

2782

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2783

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2784

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2785

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2786

},

2787

"stringValue": "A String", # string

2788

"timestampValue": "A String", # timestamp

2789

"floatValue": 3.14, # float

2790

"dayOfWeekValue": "A String", # day of week

2791

"booleanValue": True or False, # boolean

2792

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2793

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2794

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2795

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2796

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2797

},

2798

},

2799

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

2800

"integerValue": "A String", # integer

2801

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2802

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2803

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2804

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2805

},

2806

"stringValue": "A String", # string

2807

"timestampValue": "A String", # timestamp

2808

"floatValue": 3.14, # float

2809

"dayOfWeekValue": "A String", # day of week

2810

"booleanValue": True or False, # boolean

2811

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2812

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2813

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2814

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2815

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

2822

},

2823

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

2824

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

2825

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

2826

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

2827

"name": "A String", # Name describing the field.

2828

},

2829

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

2830

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2831

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2832

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2833

},

2834

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2835

"key": "A String", # Required. A 128/192/256 bit key.

2836

},

2837

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2838

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

2843

},

2844

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2845

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the contents of the field as free text, and selectively transform content that matches an `InfoType`.

2846

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

2847

{ # A transformation to apply to text that is identified as a specific info_type.

2848

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2849

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2850

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

2851

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2852

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2853

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2854

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2855

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2856

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2857

"stringValue": "A String", # string

2858

"timestampValue": "A String", # timestamp

2859

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2860

"dayOfWeekValue": "A String", # day of week

2861

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2862

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2863

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2864

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2865

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2866

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2867

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2868

},

2869

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

2870

"integerValue": "A String", # integer

2871

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2872

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2873

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2874

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2875

},

2876

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2877

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2878

"floatValue": 3.14, # float

2879

"dayOfWeekValue": "A String", # day of week

2880

"booleanValue": True or False, # boolean

2881

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2882

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2883

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2884

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2885

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2886

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2887

},

2888

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

2889

},

2890

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

2891

"partToExtract": "A String", # The part of the time to keep.

2892

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2893

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2894

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

2895

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2896

},

2897

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

2898

"name": "A String", # Name describing the field.

2899

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2900

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

2901

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2902

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2903

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2904

},

2905

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2906

"key": "A String", # Required. A 128/192/256 bit key.

2907

},

2908

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2909

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2910

},

2911

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2912

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2913

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

2914

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

2915

"name": "A String", # Name describing the field.

2916

},

2917

"commonAlphabet": "A String", # Common alphabets.

2918

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

2919

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

2920

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

2921

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2922

},

2923

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

2924

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2925

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2926

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2927

},

2928

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2929

"key": "A String", # Required. A 128/192/256 bit key.

2930

},

2931

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2932

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2933

},

2934

},

2935

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2936

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2937

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2938

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2939

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2940

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

2941

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

2942

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

2943

"charactersToSkip": "A String", # Characters to not transform when masking.

2944

},

2945

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2946

},

2947

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

2948

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2949

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2950

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2951

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2952

},

2953

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2954

"key": "A String", # Required. A 128/192/256 bit key.

2955

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2956

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2957

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2958

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2959

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2960

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2961

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

2962

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

2963

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2964

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2965

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2966

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2967

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2968

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2969

"stringValue": "A String", # string

2970

"timestampValue": "A String", # timestamp

2971

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2972

"dayOfWeekValue": "A String", # day of week

2973

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2974

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2975

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2976

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2977

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2978

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2979

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2980

},

2981

},

2982

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

2983

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

2984

{ # Bucket is represented as a range, along with replacement values.

2985

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

2986

"integerValue": "A String", # integer

2987

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2988

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2989

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2990

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2991

},

2992

"stringValue": "A String", # string

2993

"timestampValue": "A String", # timestamp

2994

"floatValue": 3.14, # float

2995

"dayOfWeekValue": "A String", # day of week

2996

"booleanValue": True or False, # boolean

2997

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2998

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2999

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3000

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3001

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3002

},

3003

},

3004

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

3005

"integerValue": "A String", # integer

3006

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3007

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3008

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3009

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3010

},

3011

"stringValue": "A String", # string

3012

"timestampValue": "A String", # timestamp

3013

"floatValue": 3.14, # float

3014

"dayOfWeekValue": "A String", # day of week

3015

"booleanValue": True or False, # boolean

3016

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3017

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3018

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3019

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3020

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3021

},

3022

},

3023

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

3024

"integerValue": "A String", # integer

3025

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3026

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3027

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3028

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3029

},

3030

"stringValue": "A String", # string

3031

"timestampValue": "A String", # timestamp

3032

"floatValue": 3.14, # float

3033

"dayOfWeekValue": "A String", # day of week

3034

"booleanValue": True or False, # boolean

3035

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3036

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3037

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3038

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3039

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3046

},

3047

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

3048

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

3049

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3050

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

3051

"name": "A String", # Name describing the field.

3052

},

3053

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

3054

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3055

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3056

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3057

},

3058

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3059

"key": "A String", # Required. A 128/192/256 bit key.

3060

},

3061

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3062

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3063

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3064

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3065

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3066

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3067

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3068

},

3069

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

3070

{ # Type of information detected by the API.

3071

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3077

},

3078

],

3079

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that match any suppression rule are omitted from the output.

3080

{ # Configuration to suppress records whose suppression conditions evaluate to true.

3081

"condition": { # A condition for determining whether a transformation should be applied to a field. # A condition that when it evaluates to true will result in the record being evaluated to be suppressed from the transformed content.

3082

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3083

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3084

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

3085

"conditions": [ # A collection of conditions.

3086

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3087

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

3088

"name": "A String", # Name describing the field.

3089

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3090

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3091

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

3092

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3093

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3094

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3095

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3096

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3097

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3098

"stringValue": "A String", # string

3099

"timestampValue": "A String", # timestamp

3100

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3101

"dayOfWeekValue": "A String", # day of week

3102

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3103

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3104

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3105

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3106

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3107

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3108

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

},

],

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3118

},

3119

"item": { # Container structure for the content to inspect. # The item to re-identify. Will be treated as text.

3120

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to learn more. # Structured content for inspection. See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to learn more.

3121

"headers": [ # Headers of the table.

3122

{ # General identifier of a data field in a storage service.

3123

"name": "A String", # Name describing the field.

3124

},

3125

],

3126

"rows": [ # Rows of the table.

3127

{ # Values of the row.

3128

"values": [ # Individual cells.

3129

{ # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data.

3130

"integerValue": "A String", # integer

3131

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3132

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3133

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3134

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3135

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3136

"stringValue": "A String", # string

3137

"timestampValue": "A String", # timestamp

3138

"floatValue": 3.14, # float

3139

"dayOfWeekValue": "A String", # day of week

3140

"booleanValue": True or False, # boolean

3141

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3142

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3143

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3144

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3145

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3146

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

},

],

},

],

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3151

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3152

"value": "A String", # String data to inspect or redact.

3153

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

3154

"data": "A String", # Content data to inspect or redact.

3155

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3156

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3157

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3158

}

3159

3160

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

3167

3168

{ # Results of re-identifying a item.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3169

"item": { # Container structure for the content to inspect. # The re-identified item.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3170

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to learn more. # Structured content for inspection. See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to learn more.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3171

"headers": [ # Headers of the table.

3172

{ # General identifier of a data field in a storage service.

3173

"name": "A String", # Name describing the field.

3174

},

3175

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3176

"rows": [ # Rows of the table.

3177

{ # Values of the row.

3178

"values": [ # Individual cells.

3179

{ # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data.

3180

"integerValue": "A String", # integer

3181

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3182

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3183

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3184

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3185

},

3186

"stringValue": "A String", # string

3187

"timestampValue": "A String", # timestamp

3188

"floatValue": 3.14, # float

3189

"dayOfWeekValue": "A String", # day of week

3190

"booleanValue": True or False, # boolean

3191

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3192

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3193

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3194

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3195

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

],

},

],

},

"value": "A String", # String data to inspect or redact.

3203

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

3204

"data": "A String", # Content data to inspect or redact.

3205

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3206

},

3207

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3208

"overview": { # Overview of the modifications that occurred. # An overview of the changes that were made to the `item`.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3209

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3210

"transformationSummaries": [ # Transformations applied to the dataset.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3211

{ # Summary of a single transformation. Only one of 'transformation', 'field_transformation', or 'record_suppress' will be set.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3212

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3213

"transformation": { # A rule for transforming a value. # The specific transformation these stats apply to.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3214

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3215

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

3216

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3217

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3218

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3219

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3220

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3221

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3222

"stringValue": "A String", # string

3223

"timestampValue": "A String", # timestamp

3224

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3225

"dayOfWeekValue": "A String", # day of week

3226

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3227

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3228

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3229

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3230

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3231

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3232

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3233

},

3234

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

3235

"integerValue": "A String", # integer

3236

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3237

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3238

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3239

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3240

},

3241

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3242

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3243

"floatValue": 3.14, # float

3244

"dayOfWeekValue": "A String", # day of week

3245

"booleanValue": True or False, # boolean

3246

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3247

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3248

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3249

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3250

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3251

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3252

},

3253

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

3254

},

3255

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

3256

"partToExtract": "A String", # The part of the time to keep.

3257

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3258

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3259

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

3260

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3261

},

3262

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

3263

"name": "A String", # Name describing the field.

3264

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3265

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

3266

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3267

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3268

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3269

},

3270

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3271

"key": "A String", # Required. A 128/192/256 bit key.

3272

},

3273

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3274

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3275

},

3276

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3277

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3278

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

3279

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

3280

"name": "A String", # Name describing the field.

3281

},

3282

"commonAlphabet": "A String", # Common alphabets.

3283

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

3284

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

3285

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

3286

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3287

},

3288

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

3289

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3290

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3291

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3292

},

3293

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3294

"key": "A String", # Required. A 128/192/256 bit key.

3295

},

3296

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3297

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3298

},

3299

},

3300

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3301

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3302

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3303

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3304

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3305

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

3306

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

3307

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

3308

"charactersToSkip": "A String", # Characters to not transform when masking.

3309

},

3310

],

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3311

},

3312

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

3313

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

3314

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3315

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3316

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3317

},

3318

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3319

"key": "A String", # Required. A 128/192/256 bit key.

3320

},

3321

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3322

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3323

},

3324

},

3325

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3326

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3327

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

3328

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3329

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3330

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3331

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3332

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3333

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3334

"stringValue": "A String", # string

3335

"timestampValue": "A String", # timestamp

3336

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3337

"dayOfWeekValue": "A String", # day of week

3338

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3339

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3340

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3341

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3342

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3343

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3344

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3345

},

3346

},

3347

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

3348

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

3349

{ # Bucket is represented as a range, along with replacement values.

3350

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

3351

"integerValue": "A String", # integer

3352

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3353

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3354

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3355

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3356

},

3357

"stringValue": "A String", # string

3358

"timestampValue": "A String", # timestamp

3359

"floatValue": 3.14, # float

3360

"dayOfWeekValue": "A String", # day of week

3361

"booleanValue": True or False, # boolean

3362

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3363

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3364

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3365

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3366

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3367

},

3368

},

3369

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

3370

"integerValue": "A String", # integer

3371

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3372

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3373

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3374

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3375

},

3376

"stringValue": "A String", # string

3377

"timestampValue": "A String", # timestamp

3378

"floatValue": 3.14, # float

3379

"dayOfWeekValue": "A String", # day of week

3380

"booleanValue": True or False, # boolean

3381

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3382

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3383

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3384

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3385

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3386

},

3387

},

3388

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

3389

"integerValue": "A String", # integer

3390

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3391

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3392

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3393

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3394

},

3395

"stringValue": "A String", # string

3396

"timestampValue": "A String", # timestamp

3397

"floatValue": 3.14, # float

3398

"dayOfWeekValue": "A String", # day of week

3399

"booleanValue": True or False, # boolean

3400

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3401

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3402

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3403

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3404

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3411

},

3412

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

3413

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

3414

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3415

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

3416

"name": "A String", # Name describing the field.

3417

},

3418

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

3419

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3420

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3421

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3422

},

3423

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3424

"key": "A String", # Required. A 128/192/256 bit key.

3425

},

3426

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3427

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3428

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3429

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3430

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3431

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3432

},

3433

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3434

"recordSuppress": { # Configuration to suppress records whose suppression conditions evaluate to true. # The specific suppression option these stats apply to.

3435

"condition": { # A condition for determining whether a transformation should be applied to a field. # A condition that when it evaluates to true will result in the record being evaluated to be suppressed from the transformed content.

3436

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

3437

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

3438

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

3439

"conditions": [ # A collection of conditions.

3440

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

3441

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

3442

"name": "A String", # Name describing the field.

3443

},

3444

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

3445

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

3446

"integerValue": "A String", # integer

3447

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3448

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3449

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3450

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3451

},

3452

"stringValue": "A String", # string

3453

"timestampValue": "A String", # timestamp

3454

"floatValue": 3.14, # float

3455

"dayOfWeekValue": "A String", # day of week

3456

"booleanValue": True or False, # boolean

3457

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3458

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3459

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3460

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3461

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

},

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3469

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3470

"results": [ # Collection of all transformations that took place or had an error.

3471

{ # A collection that informs the user the number of times a particular `TransformationResultCode` and error details occurred.

3472

"count": "A String", # Number of transformations counted by this result.

3473

"code": "A String", # Outcome of the transformation.

3474

"details": "A String", # A place for warnings or errors to show up if a transformation didn't work as expected.

3475

},

3476

],

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3477

"fieldTransformations": [ # The field transformation that was applied. If multiple field transformations are requested for a single field, this list will contain all of them; otherwise, only one is supplied.

3478

{ # The transformation to apply to the field.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3479

"condition": { # A condition for determining whether a transformation should be applied to a field. # Only apply the transformation if the condition evaluates to true for the given `RecordCondition`. The conditions are allowed to reference fields that are not used in the actual transformation. Example Use Cases: - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range. - Redact a field if the date of birth field is greater than 85.

3480

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

3481

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

3482

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

3483

"conditions": [ # A collection of conditions.

3484

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

3485

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

3486

"name": "A String", # Name describing the field.

3487

},

3488

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

3489

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

3490

"integerValue": "A String", # integer

3491

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3492

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3493

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3494

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3495

},

3496

"stringValue": "A String", # string

3497

"timestampValue": "A String", # timestamp

3498

"floatValue": 3.14, # float

3499

"dayOfWeekValue": "A String", # day of week

3500

"booleanValue": True or False, # boolean

3501

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3502

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3503

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3504

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3505

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

},

},

"fields": [ # Required. Input field(s) to apply the transformation to.

3514

{ # General identifier of a data field in a storage service.

3515

"name": "A String", # Name describing the field.

3516

},

3517

],

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3518

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3519

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3520

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

3521

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3522

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3523

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3524

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3525

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3526

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3527

"stringValue": "A String", # string

3528

"timestampValue": "A String", # timestamp

3529

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3530

"dayOfWeekValue": "A String", # day of week

3531

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3532

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3533

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3534

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3535

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3536

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3537

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3538

},

3539

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

3540

"integerValue": "A String", # integer

3541

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3542

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3543

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3544

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3545

},

3546

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3547

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3548

"floatValue": 3.14, # float

3549

"dayOfWeekValue": "A String", # day of week

3550

"booleanValue": True or False, # boolean

3551

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3552

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3553

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3554

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3555

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3556

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3557

},

3558

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

3559

},

3560

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

3561

"partToExtract": "A String", # The part of the time to keep.

3562

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3563

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3564

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

3565

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3566

},

3567

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

3568

"name": "A String", # Name describing the field.

3569

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3570

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

3571

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3572

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3573

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3574

},

3575

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3576

"key": "A String", # Required. A 128/192/256 bit key.

3577

},

3578

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3579

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3580

},

3581

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3582

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3583

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

3584

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

3585

"name": "A String", # Name describing the field.

3586

},

3587

"commonAlphabet": "A String", # Common alphabets.

3588

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

3589

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

3590

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

3591

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3592

},

3593

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

3594

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3595

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3596

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3597

},

3598

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3599

"key": "A String", # Required. A 128/192/256 bit key.

3600

},

3601

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3602

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3603

},

3604

},

3605

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3606

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3607

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3608

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3609

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3610

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

3611

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

3612

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

3613

"charactersToSkip": "A String", # Characters to not transform when masking.

3614

},

3615

],

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3616

},

3617

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

3618

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

3619

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3620

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3621

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3622

},

3623

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3624

"key": "A String", # Required. A 128/192/256 bit key.

3625

},

3626

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3627

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3628

},

3629

},

3630

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3631

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3632

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3633

"integerValue": "A String", # integer

3634

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3635

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3636

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3637

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3638

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3639

"stringValue": "A String", # string

3640

"timestampValue": "A String", # timestamp

3641

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3642

"dayOfWeekValue": "A String", # day of week

3643

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3644

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3645

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3646

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3647

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3648

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3649

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3650

},

3651

},

3652

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

3653

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

3654

{ # Bucket is represented as a range, along with replacement values.

3655

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

3656

"integerValue": "A String", # integer

3657

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3658

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3659

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3660

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3661

},

3662

"stringValue": "A String", # string

3663

"timestampValue": "A String", # timestamp

3664

"floatValue": 3.14, # float

3665

"dayOfWeekValue": "A String", # day of week

3666

"booleanValue": True or False, # boolean

3667

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3668

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3669

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3670

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3671

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3672

},

3673

},

3674

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

3675

"integerValue": "A String", # integer

3676

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3677

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3678

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3679

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3680

},

3681

"stringValue": "A String", # string

3682

"timestampValue": "A String", # timestamp

3683

"floatValue": 3.14, # float

3684

"dayOfWeekValue": "A String", # day of week

3685

"booleanValue": True or False, # boolean

3686

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3687

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3688

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3689

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3690

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3691

},

3692

},

3693

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

3694

"integerValue": "A String", # integer

3695

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3696

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3697

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3698

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3699

},

3700

"stringValue": "A String", # string

3701

"timestampValue": "A String", # timestamp

3702

"floatValue": 3.14, # float

3703

"dayOfWeekValue": "A String", # day of week

3704

"booleanValue": True or False, # boolean

3705

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3706

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3707

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3708

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3709

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3716

},

3717

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

3718

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

3719

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3720

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

3721

"name": "A String", # Name describing the field.

3722

},

3723

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

3724

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3725

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3726

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3727

},

3728

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3729

"key": "A String", # Required. A 128/192/256 bit key.

3730

},

3731

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3732

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3733

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3734

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3735

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3736

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

3737

},

3738

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3739

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the contents of the field as free text, and selectively transform content that matches an `InfoType`.

3740

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

3741

{ # A transformation to apply to text that is identified as a specific info_type.

3742

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

3743

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3744

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

3745

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3746

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3747

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3748

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3749

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3750

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3751

"stringValue": "A String", # string

3752

"timestampValue": "A String", # timestamp

3753

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3754

"dayOfWeekValue": "A String", # day of week

3755

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3756

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3757

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3758

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3759

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3760

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3761

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3762

},

3763

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

3764

"integerValue": "A String", # integer

3765

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3766

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3767

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3768

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3769

},

3770

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3771

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3772

"floatValue": 3.14, # float

3773

"dayOfWeekValue": "A String", # day of week

3774

"booleanValue": True or False, # boolean

3775

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3776

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3777

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3778

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3779

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3780

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3781

},

3782

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

3783

},

3784

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

3785

"partToExtract": "A String", # The part of the time to keep.

3786

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3787

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

3788

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

3789

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3790

},

3791

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

3792

"name": "A String", # Name describing the field.

3793

},

3794

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

3795

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3796

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3797

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3798

},

3799

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3800

"key": "A String", # Required. A 128/192/256 bit key.

3801

},

3802

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3803

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3804

},

3805

},

3806

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3807

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

3808

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

3809

"name": "A String", # Name describing the field.

3810

},

3811

"commonAlphabet": "A String", # Common alphabets.

3812

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

3813

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

3814

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

3815

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3816

},

3817

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

3818

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3819

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3820

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3821

},

3822

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3823

"key": "A String", # Required. A 128/192/256 bit key.

3824

},

3825

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3826

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3827

},

3828

},

3829

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3830

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3831

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3832

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3833

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3834

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

3835

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

3836

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

3837

"charactersToSkip": "A String", # Characters to not transform when masking.

3838

},

3839

],

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3840

},

3841

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

3842

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

3843

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3844

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3845

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3846

},

3847

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3848

"key": "A String", # Required. A 128/192/256 bit key.

3849

},

3850

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3851

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3856

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

3857

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3858

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3859

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3860

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3861

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3862

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3863

"stringValue": "A String", # string

3864

"timestampValue": "A String", # timestamp

3865

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3866

"dayOfWeekValue": "A String", # day of week

3867

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3868

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3869

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3870

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3871

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3872

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3873

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3874

},

3875

},

3876

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

3877

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

3878

{ # Bucket is represented as a range, along with replacement values.

3879

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

3880

"integerValue": "A String", # integer

3881

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3882

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3883

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3884

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3885

},

3886

"stringValue": "A String", # string

3887

"timestampValue": "A String", # timestamp

3888

"floatValue": 3.14, # float

3889

"dayOfWeekValue": "A String", # day of week

3890

"booleanValue": True or False, # boolean

3891

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3892

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3893

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3894

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3895

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3896

},

3897

},

3898

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

3899

"integerValue": "A String", # integer

3900

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3901

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3902

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3903

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3904

},

3905

"stringValue": "A String", # string

3906

"timestampValue": "A String", # timestamp

3907

"floatValue": 3.14, # float

3908

"dayOfWeekValue": "A String", # day of week

3909

"booleanValue": True or False, # boolean

3910

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3911

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3912

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3913

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3914

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3915

},

3916

},

3917

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

3918

"integerValue": "A String", # integer

3919

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3920

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3921

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3922

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3923

},

3924

"stringValue": "A String", # string

3925

"timestampValue": "A String", # timestamp

3926

"floatValue": 3.14, # float

3927

"dayOfWeekValue": "A String", # day of week

3928

"booleanValue": True or False, # boolean

3929

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3930

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3931

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3932

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3933

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3940

},

3941

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

3942

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

3943

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3944

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

3945

"name": "A String", # Name describing the field.

3946

},

3947

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

3948

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3949

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3950

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3951

},

3952

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3953

"key": "A String", # Required. A 128/192/256 bit key.

3954

},

3955

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3956

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3957

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3958

},

3959

},

3960

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

3961

},

3962

},

3963

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

3964

{ # Type of information detected by the API.

3965

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3970

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3971

},

3972

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3973

"field": { # General identifier of a data field in a storage service. # Set if the transformation was limited to a specific FieldId.

3974

"name": "A String", # Name describing the field.

3975

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3976

"infoType": { # Type of information detected by the API. # Set if the transformation was limited to a specific InfoType.

3977

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3978

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3979

},

3980

],

Bu Sun Kim