Blame - docs/dyn/dlp_v2.projects.deidentifyTemplates.html - platform/external/python/google-api-python-client

2020-10-06 16:46:05 -0700

[diff] [blame]

78

<code><a href="#close">close()</a></code></p>

79

<p class="firstline">Close httplib2 connections.</p>

80

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

81

<code><a href="#create">create(parent, body=None, x__xgafv=None)</a></code></p>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

82

<p class="firstline">Creates a DeidentifyTemplate for re-using frequently used configuration for de-identifying content, images, and storage. See https://cloud.google.com/dlp/docs/creating-templates-deid to learn more.</p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

83

84

<code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

85

<p class="firstline">Deletes a DeidentifyTemplate. See https://cloud.google.com/dlp/docs/creating-templates-deid to learn more.</p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

86

87

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

88

<p class="firstline">Gets a DeidentifyTemplate. See https://cloud.google.com/dlp/docs/creating-templates-deid to learn more.</p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

89

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

90

<code><a href="#list">list(parent, orderBy=None, locationId=None, pageToken=None, pageSize=None, x__xgafv=None)</a></code></p>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

91

<p class="firstline">Lists DeidentifyTemplates. See https://cloud.google.com/dlp/docs/creating-templates-deid to learn more.</p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

92

93

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

94

<p class="firstline">Retrieves the next page of results.</p>

95

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

96

<code><a href="#patch">patch(name, body=None, x__xgafv=None)</a></code></p>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

97

<p class="firstline">Updates the DeidentifyTemplate. See https://cloud.google.com/dlp/docs/creating-templates-deid to learn more.</p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

98

<h3>Method Details</h3>

99

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

100

<code class="details" id="close">close()</code>

101

<pre>Close httplib2 connections.</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

105

<code class="details" id="create">create(parent, body=None, x__xgafv=None)</code>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

106

<pre>Creates a DeidentifyTemplate for re-using frequently used configuration for de-identifying content, images, and storage. See https://cloud.google.com/dlp/docs/creating-templates-deid to learn more.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

107

108

Args:

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

109

parent: string, Required. Parent resource name. The format of this value varies depending on the scope of the request (project or organization) and whether you have [specified a processing location](https://cloud.google.com/dlp/docs/specifying-location): + Projects scope, location specified: `projects/`PROJECT_ID`/locations/`LOCATION_ID + Projects scope, no location specified (defaults to global): `projects/`PROJECT_ID + Organizations scope, location specified: `organizations/`ORG_ID`/locations/`LOCATION_ID + Organizations scope, no location specified (defaults to global): `organizations/`ORG_ID The following example `parent` string specifies a parent project with the identifier `example-project`, and specifies the `europe-west3` location for processing data: parent=projects/example-project/locations/europe-west3 (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

110

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

111

The object takes the form of:

112

113

{ # Request message for CreateDeidentifyTemplate.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

114

"deidentifyTemplate": { # DeidentifyTemplates contains instructions on how to de-identify content. See https://cloud.google.com/dlp/docs/concepts-templates to learn more. # Required. The DeidentifyTemplate to create.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

115

"updateTime": "A String", # Output only. The last update timestamp of an inspectTemplate.

116

"name": "A String", # Output only. The template name. The template will have one of the following formats: `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`

117

"createTime": "A String", # Output only. The creation timestamp of an inspectTemplate.

118

"description": "A String", # Short description (max 256 chars).

119

"displayName": "A String", # Display name (max 256 chars).

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

120

"deidentifyConfig": { # The configuration that controls how the data will change. # ///////////// // The core content of the template // ///////////////

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

121

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the dataset as free-form text and apply the same free text transformation everywhere.

122

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

123

{ # A transformation to apply to text that is identified as a specific info_type.

124

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

125

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

126

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

127

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

128

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

129

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

130

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

131

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

132

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

133

"stringValue": "A String", # string

134

"timestampValue": "A String", # timestamp

135

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

136

"dayOfWeekValue": "A String", # day of week

137

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

138

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

139

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

140

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

141

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

142

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

143

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

144

},

145

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

146

"integerValue": "A String", # integer

147

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

148

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

149

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

150

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

151

},

152

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

153

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

154

"floatValue": 3.14, # float

155

"dayOfWeekValue": "A String", # day of week

156

"booleanValue": True or False, # boolean

157

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

158

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

159

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

160

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

161

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

162

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

163

},

164

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

165

},

166

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

167

"partToExtract": "A String", # The part of the time to keep.

168

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

169

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

170

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

171

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

172

},

173

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

174

"name": "A String", # Name describing the field.

175

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

176

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

177

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

178

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

179

"wrappedKey": "A String", # Required. The wrapped data crypto key.

180

},

181

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

182

"key": "A String", # Required. A 128/192/256 bit key.

183

},

184

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

185

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

186

},

187

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

188

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

189

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

190

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

191

"name": "A String", # Name describing the field.

192

},

193

"commonAlphabet": "A String", # Common alphabets.

194

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

195

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

196

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

197

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

198

},

199

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

200

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

201

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

202

"wrappedKey": "A String", # Required. The wrapped data crypto key.

203

},

204

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

205

"key": "A String", # Required. A 128/192/256 bit key.

206

},

207

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

208

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

209

},

210

},

211

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

212

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

213

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

214

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

215

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

216

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

217

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

218

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

219

"charactersToSkip": "A String", # Characters to not transform when masking.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

220

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

221

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

222

},

223

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

224

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

225

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

226

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

227

"wrappedKey": "A String", # Required. The wrapped data crypto key.

228

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

229

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

230

"key": "A String", # Required. A 128/192/256 bit key.

231

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

232

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

233

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

234

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

235

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

236

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

237

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

238

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

239

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

240

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

241

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

242

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

243

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

244

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

245

"stringValue": "A String", # string

246

"timestampValue": "A String", # timestamp

247

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

248

"dayOfWeekValue": "A String", # day of week

249

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

250

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

251

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

252

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

253

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

254

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

255

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

256

},

257

},

258

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

259

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

260

{ # Bucket is represented as a range, along with replacement values.

261

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

262

"integerValue": "A String", # integer

263

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

264

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

265

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

266

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

267

},

268

"stringValue": "A String", # string

269

"timestampValue": "A String", # timestamp

270

"floatValue": 3.14, # float

271

"dayOfWeekValue": "A String", # day of week

272

"booleanValue": True or False, # boolean

273

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

274

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

275

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

276

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

277

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

278

},

279

},

280

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

281

"integerValue": "A String", # integer

282

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

283

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

284

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

285

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

286

},

287

"stringValue": "A String", # string

288

"timestampValue": "A String", # timestamp

289

"floatValue": 3.14, # float

290

"dayOfWeekValue": "A String", # day of week

291

"booleanValue": True or False, # boolean

292

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

293

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

294

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

295

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

296

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

297

},

298

},

299

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

300

"integerValue": "A String", # integer

301

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

302

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

303

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

304

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

305

},

306

"stringValue": "A String", # string

307

"timestampValue": "A String", # timestamp

308

"floatValue": 3.14, # float

309

"dayOfWeekValue": "A String", # day of week

310

"booleanValue": True or False, # boolean

311

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

312

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

313

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

314

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

315

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

322

},

323

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

324

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

325

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

326

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

327

"name": "A String", # Name describing the field.

328

},

329

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

330

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

331

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

332

"wrappedKey": "A String", # Required. The wrapped data crypto key.

333

},

334

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

335

"key": "A String", # Required. A 128/192/256 bit key.

336

},

337

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

338

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

339

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

340

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

341

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

342

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

343

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

344

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

345

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

346

{ # Type of information detected by the API.

347

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A transformation error occurs when the requested transformation is incompatible with the data. For example, trying to de-identify an IP address using a `DateShift` transformation would result in a transformation error, since date info cannot be extracted from an IP address. Information about any incompatible transformations, and how they were handled, is returned in the response as part of the `TransformationOverviews`. # Mode for handling transformation errors. If left unspecified, the default mode is `TransformationErrorHandling.ThrowError`.

354

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would cause an error. For example, if a `DateShift` transformation were applied an an IP address, this mode would leave the IP address unchanged in the response. # Ignore errors

355

},

356

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

357

},

358

},

359

"recordTransformations": { # A type of transformation that is applied over structured data such as a table. # Treat the dataset as structured. Transformations can be applied to specific locations within structured datasets, such as transforming a column within a table.

360

"fieldTransformations": [ # Transform the record by applying various field transformations.

361

{ # The transformation to apply to the field.

362

"condition": { # A condition for determining whether a transformation should be applied to a field. # Only apply the transformation if the condition evaluates to true for the given `RecordCondition`. The conditions are allowed to reference fields that are not used in the actual transformation. Example Use Cases: - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range. - Redact a field if the date of birth field is greater than 85.

363

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

364

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

365

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

366

"conditions": [ # A collection of conditions.

367

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

368

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

369

"name": "A String", # Name describing the field.

370

},

371

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

372

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

373

"integerValue": "A String", # integer

374

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

375

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

376

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

377

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

378

},

379

"stringValue": "A String", # string

380

"timestampValue": "A String", # timestamp

381

"floatValue": 3.14, # float

382

"dayOfWeekValue": "A String", # day of week

383

"booleanValue": True or False, # boolean

384

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

385

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

386

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

387

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

388

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

},

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

396

"fields": [ # Required. Input field(s) to apply the transformation to.

397

{ # General identifier of a data field in a storage service.

398

"name": "A String", # Name describing the field.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

399

},

400

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

401

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

402

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

403

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

404

"integerValue": "A String", # integer

405

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

406

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

407

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

408

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

409

},

410

"stringValue": "A String", # string

411

"timestampValue": "A String", # timestamp

412

"floatValue": 3.14, # float

413

"dayOfWeekValue": "A String", # day of week

414

"booleanValue": True or False, # boolean

415

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

416

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

417

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

418

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

419

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

420

},

421

},

422

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

423

"integerValue": "A String", # integer

424

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

425

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

426

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

427

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

428

},

429

"stringValue": "A String", # string

430

"timestampValue": "A String", # timestamp

431

"floatValue": 3.14, # float

432

"dayOfWeekValue": "A String", # day of week

433

"booleanValue": True or False, # boolean

434

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

435

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

436

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

437

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

438

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

439

},

440

},

441

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

442

},

443

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

444

"partToExtract": "A String", # The part of the time to keep.

445

},

446

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

447

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

448

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

449

},

450

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

451

"name": "A String", # Name describing the field.

452

},

453

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

454

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

455

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

456

"wrappedKey": "A String", # Required. The wrapped data crypto key.

457

},

458

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

459

"key": "A String", # Required. A 128/192/256 bit key.

460

},

461

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

462

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

467

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

468

"name": "A String", # Name describing the field.

469

},

470

"commonAlphabet": "A String", # Common alphabets.

471

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

472

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

473

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

474

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

475

},

476

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

477

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

478

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

479

"wrappedKey": "A String", # Required. The wrapped data crypto key.

480

},

481

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

482

"key": "A String", # Required. A 128/192/256 bit key.

483

},

484

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

485

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

490

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

491

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

492

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

493

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

494

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

495

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

496

"charactersToSkip": "A String", # Characters to not transform when masking.

},

],

},

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

501

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

502

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

503

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

504

"wrappedKey": "A String", # Required. The wrapped data crypto key.

505

},

506

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

507

"key": "A String", # Required. A 128/192/256 bit key.

508

},

509

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

510

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

515

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

516

"integerValue": "A String", # integer

517

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

518

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

519

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

520

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

521

},

522

"stringValue": "A String", # string

523

"timestampValue": "A String", # timestamp

524

"floatValue": 3.14, # float

525

"dayOfWeekValue": "A String", # day of week

526

"booleanValue": True or False, # boolean

527

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

528

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

529

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

530

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

531

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

536

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

537

{ # Bucket is represented as a range, along with replacement values.

538

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

539

"integerValue": "A String", # integer

540

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

541

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

542

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

543

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

544

},

545

"stringValue": "A String", # string

546

"timestampValue": "A String", # timestamp

547

"floatValue": 3.14, # float

548

"dayOfWeekValue": "A String", # day of week

549

"booleanValue": True or False, # boolean

550

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

551

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

552

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

553

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

554

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

555

},

556

},

557

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

558

"integerValue": "A String", # integer

559

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

560

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

561

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

562

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

563

},

564

"stringValue": "A String", # string

565

"timestampValue": "A String", # timestamp

566

"floatValue": 3.14, # float

567

"dayOfWeekValue": "A String", # day of week

568

"booleanValue": True or False, # boolean

569

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

570

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

571

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

572

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

573

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

574

},

575

},

576

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

577

"integerValue": "A String", # integer

578

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

579

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

580

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

581

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

582

},

583

"stringValue": "A String", # string

584

"timestampValue": "A String", # timestamp

585

"floatValue": 3.14, # float

586

"dayOfWeekValue": "A String", # day of week

587

"booleanValue": True or False, # boolean

588

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

589

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

590

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

591

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

592

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

599

},

600

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

601

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

602

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

603

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

604

"name": "A String", # Name describing the field.

605

},

606

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

607

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

608

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

609

"wrappedKey": "A String", # Required. The wrapped data crypto key.

610

},

611

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

612

"key": "A String", # Required. A 128/192/256 bit key.

613

},

614

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

615

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

620

},

621

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

622

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the contents of the field as free text, and selectively transform content that matches an `InfoType`.

623

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

624

{ # A transformation to apply to text that is identified as a specific info_type.

625

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

626

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

627

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

628

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

629

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

630

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

631

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

632

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

633

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

634

"stringValue": "A String", # string

635

"timestampValue": "A String", # timestamp

636

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

637

"dayOfWeekValue": "A String", # day of week

638

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

639

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

640

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

641

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

642

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

643

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

644

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

645

},

646

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

647

"integerValue": "A String", # integer

648

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

649

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

650

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

651

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

652

},

653

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

654

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

655

"floatValue": 3.14, # float

656

"dayOfWeekValue": "A String", # day of week

657

"booleanValue": True or False, # boolean

658

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

659

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

660

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

661

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

662

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

663

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

664

},

665

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

666

},

667

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

668

"partToExtract": "A String", # The part of the time to keep.

669

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

670

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

671

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

672

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

673

},

674

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

675

"name": "A String", # Name describing the field.

676

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

677

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

678

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

679

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

680

"wrappedKey": "A String", # Required. The wrapped data crypto key.

681

},

682

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

683

"key": "A String", # Required. A 128/192/256 bit key.

684

},

685

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

686

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

687

},

688

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

689

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

690

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

691

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

692

"name": "A String", # Name describing the field.

693

},

694

"commonAlphabet": "A String", # Common alphabets.

695

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

696

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

697

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

698

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

699

},

700

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

701

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

702

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

703

"wrappedKey": "A String", # Required. The wrapped data crypto key.

704

},

705

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

706

"key": "A String", # Required. A 128/192/256 bit key.

707

},

708

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

709

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

710

},

711

},

712

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

713

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

714

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

715

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

716

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

717

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

718

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

719

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

720

"charactersToSkip": "A String", # Characters to not transform when masking.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

721

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

722

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

723

},

724

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

725

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

726

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

727

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

728

"wrappedKey": "A String", # Required. The wrapped data crypto key.

729

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

730

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

731

"key": "A String", # Required. A 128/192/256 bit key.

732

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

733

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

734

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

735

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

736

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

737

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

738

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

739

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

740

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

741

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

742

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

743

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

744

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

745

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

746

"stringValue": "A String", # string

747

"timestampValue": "A String", # timestamp

748

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

749

"dayOfWeekValue": "A String", # day of week

750

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

751

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

752

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

753

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

754

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

755

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

756

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

757

},

758

},

759

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

760

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

761

{ # Bucket is represented as a range, along with replacement values.

762

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

763

"integerValue": "A String", # integer

764

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

765

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

766

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

767

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

768

},

769

"stringValue": "A String", # string

770

"timestampValue": "A String", # timestamp

771

"floatValue": 3.14, # float

772

"dayOfWeekValue": "A String", # day of week

773

"booleanValue": True or False, # boolean

774

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

775

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

776

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

777

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

778

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

779

},

780

},

781

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

782

"integerValue": "A String", # integer

783

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

784

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

785

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

786

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

787

},

788

"stringValue": "A String", # string

789

"timestampValue": "A String", # timestamp

790

"floatValue": 3.14, # float

791

"dayOfWeekValue": "A String", # day of week

792

"booleanValue": True or False, # boolean

793

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

794

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

795

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

796

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

797

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

798

},

799

},

800

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

801

"integerValue": "A String", # integer

802

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

803

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

804

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

805

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

806

},

807

"stringValue": "A String", # string

808

"timestampValue": "A String", # timestamp

809

"floatValue": 3.14, # float

810

"dayOfWeekValue": "A String", # day of week

811

"booleanValue": True or False, # boolean

812

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

813

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

814

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

815

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

816

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

823

},

824

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

825

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

826

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

827

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

828

"name": "A String", # Name describing the field.

829

},

830

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

831

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

832

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

833

"wrappedKey": "A String", # Required. The wrapped data crypto key.

834

},

835

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

836

"key": "A String", # Required. A 128/192/256 bit key.

837

},

838

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

839

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

840

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

841

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

842

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

843

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

844

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

845

},

846

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

847

{ # Type of information detected by the API.

848

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

854

},

855

],

856

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that match any suppression rule are omitted from the output.

857

{ # Configuration to suppress records whose suppression conditions evaluate to true.

858

"condition": { # A condition for determining whether a transformation should be applied to a field. # A condition that when it evaluates to true will result in the record being evaluated to be suppressed from the transformed content.

859

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

860

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

861

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

862

"conditions": [ # A collection of conditions.

863

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

864

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

865

"name": "A String", # Name describing the field.

866

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

867

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

868

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

869

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

870

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

871

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

872

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

873

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

874

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

875

"stringValue": "A String", # string

876

"timestampValue": "A String", # timestamp

877

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

878

"dayOfWeekValue": "A String", # day of week

879

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

880

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

881

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

882

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

883

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

884

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

885

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

},

],

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

895

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

896

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

897

"templateId": "A String", # The template id can contain uppercase and lowercase letters, numbers, and hyphens; that is, it must match the regular expression: `[a-zA-Z\d-_]+`. The maximum length is 100 characters. Can be empty to allow the system to generate one.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

898

"locationId": "A String", # Deprecated. This field has no effect.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

899

}

900

901

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

908

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

909

{ # DeidentifyTemplates contains instructions on how to de-identify content. See https://cloud.google.com/dlp/docs/concepts-templates to learn more.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

910

"updateTime": "A String", # Output only. The last update timestamp of an inspectTemplate.

911

"name": "A String", # Output only. The template name. The template will have one of the following formats: `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`

912

"createTime": "A String", # Output only. The creation timestamp of an inspectTemplate.

913

"description": "A String", # Short description (max 256 chars).

914

"displayName": "A String", # Display name (max 256 chars).

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

915

"deidentifyConfig": { # The configuration that controls how the data will change. # ///////////// // The core content of the template // ///////////////

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

916

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the dataset as free-form text and apply the same free text transformation everywhere.

917

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

918

{ # A transformation to apply to text that is identified as a specific info_type.

919

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

920

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

921

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

922

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

923

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

924

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

925

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

926

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

927

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

928

"stringValue": "A String", # string

929

"timestampValue": "A String", # timestamp

930

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

931

"dayOfWeekValue": "A String", # day of week

932

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

933

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

934

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

935

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

936

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

937

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

938

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

939

},

940

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

941

"integerValue": "A String", # integer

942

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

943

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

944

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

945

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

946

},

947

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

948

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

949

"floatValue": 3.14, # float

950

"dayOfWeekValue": "A String", # day of week

951

"booleanValue": True or False, # boolean

952

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

953

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

954

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

955

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

956

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

957

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

958

},

959

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

960

},

961

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

962

"partToExtract": "A String", # The part of the time to keep.

963

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

964

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

965

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

966

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

967

},

968

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

969

"name": "A String", # Name describing the field.

970

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

971

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

972

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

973

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

974

"wrappedKey": "A String", # Required. The wrapped data crypto key.

975

},

976

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

977

"key": "A String", # Required. A 128/192/256 bit key.

978

},

979

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

980

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

981

},

982

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

983

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

984

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

985

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

986

"name": "A String", # Name describing the field.

987

},

988

"commonAlphabet": "A String", # Common alphabets.

989

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

990

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

991

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

992

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

993

},

994

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

995

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

996

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

997

"wrappedKey": "A String", # Required. The wrapped data crypto key.

998

},

999

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1000

"key": "A String", # Required. A 128/192/256 bit key.

1001

},

1002

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1003

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1004

},

1005

},

1006

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1007

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1008

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1009

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1010

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1011

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

1012

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

1013

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

1014

"charactersToSkip": "A String", # Characters to not transform when masking.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1015

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1016

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1017

},

1018

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

1019

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1020

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1021

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1022

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1023

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1024

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1025

"key": "A String", # Required. A 128/192/256 bit key.

1026

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1027

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1028

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1029

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1030

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1031

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1032

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

1033

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

1034

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1035

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1036

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1037

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1038

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1039

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1040

"stringValue": "A String", # string

1041

"timestampValue": "A String", # timestamp

1042

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1043

"dayOfWeekValue": "A String", # day of week

1044

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1045

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1046

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1047

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1048

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1049

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1050

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1051

},

1052

},

1053

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

1054

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

1055

{ # Bucket is represented as a range, along with replacement values.

1056

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

1057

"integerValue": "A String", # integer

1058

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1059

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1060

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1061

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1062

},

1063

"stringValue": "A String", # string

1064

"timestampValue": "A String", # timestamp

1065

"floatValue": 3.14, # float

1066

"dayOfWeekValue": "A String", # day of week

1067

"booleanValue": True or False, # boolean

1068

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1069

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1070

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1071

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1072

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1073

},

1074

},

1075

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

1076

"integerValue": "A String", # integer

1077

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1078

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1079

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1080

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1081

},

1082

"stringValue": "A String", # string

1083

"timestampValue": "A String", # timestamp

1084

"floatValue": 3.14, # float

1085

"dayOfWeekValue": "A String", # day of week

1086

"booleanValue": True or False, # boolean

1087

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1088

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1089

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1090

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1091

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1092

},

1093

},

1094

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

1095

"integerValue": "A String", # integer

1096

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1097

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1098

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1099

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1100

},

1101

"stringValue": "A String", # string

1102

"timestampValue": "A String", # timestamp

1103

"floatValue": 3.14, # float

1104

"dayOfWeekValue": "A String", # day of week

1105

"booleanValue": True or False, # boolean

1106

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1107

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1108

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1109

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1110

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1117

},

1118

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

1119

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

1120

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1121

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

1122

"name": "A String", # Name describing the field.

1123

},

1124

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

1125

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1126

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1127

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1128

},

1129

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1130

"key": "A String", # Required. A 128/192/256 bit key.

1131

},

1132

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1133

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1134

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1135

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1136

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1137

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1138

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1139

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1140

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

1141

{ # Type of information detected by the API.

1142

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A transformation error occurs when the requested transformation is incompatible with the data. For example, trying to de-identify an IP address using a `DateShift` transformation would result in a transformation error, since date info cannot be extracted from an IP address. Information about any incompatible transformations, and how they were handled, is returned in the response as part of the `TransformationOverviews`. # Mode for handling transformation errors. If left unspecified, the default mode is `TransformationErrorHandling.ThrowError`.

1149

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would cause an error. For example, if a `DateShift` transformation were applied an an IP address, this mode would leave the IP address unchanged in the response. # Ignore errors

1150

},

1151

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

1152

},

1153

},

1154

"recordTransformations": { # A type of transformation that is applied over structured data such as a table. # Treat the dataset as structured. Transformations can be applied to specific locations within structured datasets, such as transforming a column within a table.

1155

"fieldTransformations": [ # Transform the record by applying various field transformations.

1156

{ # The transformation to apply to the field.

1157

"condition": { # A condition for determining whether a transformation should be applied to a field. # Only apply the transformation if the condition evaluates to true for the given `RecordCondition`. The conditions are allowed to reference fields that are not used in the actual transformation. Example Use Cases: - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range. - Redact a field if the date of birth field is greater than 85.

1158

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

1159

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

1160

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

1161

"conditions": [ # A collection of conditions.

1162

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

1163

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

1164

"name": "A String", # Name describing the field.

1165

},

1166

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

1167

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

1168

"integerValue": "A String", # integer

1169

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1170

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1171

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1172

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1173

},

1174

"stringValue": "A String", # string

1175

"timestampValue": "A String", # timestamp

1176

"floatValue": 3.14, # float

1177

"dayOfWeekValue": "A String", # day of week

1178

"booleanValue": True or False, # boolean

1179

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1180

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1181

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1182

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1183

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

},

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1191

"fields": [ # Required. Input field(s) to apply the transformation to.

1192

{ # General identifier of a data field in a storage service.

1193

"name": "A String", # Name describing the field.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1194

},

1195

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1196

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

1197

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

1198

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

1199

"integerValue": "A String", # integer

1200

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1201

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1202

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1203

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1204

},

1205

"stringValue": "A String", # string

1206

"timestampValue": "A String", # timestamp

1207

"floatValue": 3.14, # float

1208

"dayOfWeekValue": "A String", # day of week

1209

"booleanValue": True or False, # boolean

1210

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1211

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1212

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1213

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1214

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1215

},

1216

},

1217

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

1218

"integerValue": "A String", # integer

1219

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1220

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1221

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1222

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1223

},

1224

"stringValue": "A String", # string

1225

"timestampValue": "A String", # timestamp

1226

"floatValue": 3.14, # float

1227

"dayOfWeekValue": "A String", # day of week

1228

"booleanValue": True or False, # boolean

1229

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1230

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1231

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1232

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1233

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1234

},

1235

},

1236

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

1237

},

1238

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

1239

"partToExtract": "A String", # The part of the time to keep.

1240

},

1241

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

1242

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

1243

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1244

},

1245

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

1246

"name": "A String", # Name describing the field.

1247

},

1248

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

1249

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1250

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1251

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1252

},

1253

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1254

"key": "A String", # Required. A 128/192/256 bit key.

1255

},

1256

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1257

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

1262

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

1263

"name": "A String", # Name describing the field.

1264

},

1265

"commonAlphabet": "A String", # Common alphabets.

1266

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

1267

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

1268

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

1269

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1270

},

1271

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

1272

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1273

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1274

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1275

},

1276

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1277

"key": "A String", # Required. A 128/192/256 bit key.

1278

},

1279

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1280

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

1285

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

1286

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

1287

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

1288

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

1289

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

1290

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

1291

"charactersToSkip": "A String", # Characters to not transform when masking.

},

],

},

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

1296

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

1297

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1298

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1299

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1300

},

1301

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1302

"key": "A String", # Required. A 128/192/256 bit key.

1303

},

1304

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1305

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

1310

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

1311

"integerValue": "A String", # integer

1312

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1313

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1314

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1315

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1316

},

1317

"stringValue": "A String", # string

1318

"timestampValue": "A String", # timestamp

1319

"floatValue": 3.14, # float

1320

"dayOfWeekValue": "A String", # day of week

1321

"booleanValue": True or False, # boolean

1322

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1323

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1324

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1325

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1326

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

1331

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

1332

{ # Bucket is represented as a range, along with replacement values.

1333

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

1334

"integerValue": "A String", # integer

1335

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1336

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1337

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1338

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1339

},

1340

"stringValue": "A String", # string

1341

"timestampValue": "A String", # timestamp

1342

"floatValue": 3.14, # float

1343

"dayOfWeekValue": "A String", # day of week

1344

"booleanValue": True or False, # boolean

1345

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1346

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1347

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1348

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1349

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1350

},

1351

},

1352

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

1353

"integerValue": "A String", # integer

1354

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1355

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1356

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1357

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1358

},

1359

"stringValue": "A String", # string

1360

"timestampValue": "A String", # timestamp

1361

"floatValue": 3.14, # float

1362

"dayOfWeekValue": "A String", # day of week

1363

"booleanValue": True or False, # boolean

1364

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1365

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1366

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1367

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1368

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1369

},

1370

},

1371

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

1372

"integerValue": "A String", # integer

1373

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1374

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1375

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1376

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1377

},

1378

"stringValue": "A String", # string

1379

"timestampValue": "A String", # timestamp

1380

"floatValue": 3.14, # float

1381

"dayOfWeekValue": "A String", # day of week

1382

"booleanValue": True or False, # boolean

1383

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1384

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1385

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1386

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1387

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1394

},

1395

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

1396

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

1397

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1398

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

1399

"name": "A String", # Name describing the field.

1400

},

1401

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

1402

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1403

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1404

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1405

},

1406

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1407

"key": "A String", # Required. A 128/192/256 bit key.

1408

},

1409

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1410

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

1415

},

1416

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1417

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the contents of the field as free text, and selectively transform content that matches an `InfoType`.

1418

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

1419

{ # A transformation to apply to text that is identified as a specific info_type.

1420

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1421

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1422

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

1423

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1424

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1425

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1426

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1427

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1428

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1429

"stringValue": "A String", # string

1430

"timestampValue": "A String", # timestamp

1431

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1432

"dayOfWeekValue": "A String", # day of week

1433

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1434

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1435

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1436

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1437

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1438

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1439

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1440

},

1441

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

1442

"integerValue": "A String", # integer

1443

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1444

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1445

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1446

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1447

},

1448

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1449

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1450

"floatValue": 3.14, # float

1451

"dayOfWeekValue": "A String", # day of week

1452

"booleanValue": True or False, # boolean

1453

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1454

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1455

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1456

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1457

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1458

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1459

},

1460

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

1461

},

1462

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

1463

"partToExtract": "A String", # The part of the time to keep.

1464

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1465

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1466

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

1467

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1468

},

1469

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

1470

"name": "A String", # Name describing the field.

1471

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1472

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

1473

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1474

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1475

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1476

},

1477

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1478

"key": "A String", # Required. A 128/192/256 bit key.

1479

},

1480

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1481

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1482

},

1483

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1484

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1485

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

1486

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

1487

"name": "A String", # Name describing the field.

1488

},

1489

"commonAlphabet": "A String", # Common alphabets.

1490

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

1491

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

1492

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

1493

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1494

},

1495

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

1496

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1497

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1498

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1499

},

1500

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1501

"key": "A String", # Required. A 128/192/256 bit key.

1502

},

1503

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1504

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1505

},

1506

},

1507

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1508

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1509

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1510

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1511

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1512

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

1513

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

1514

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

1515

"charactersToSkip": "A String", # Characters to not transform when masking.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1516

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1517

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1518

},

1519

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

1520

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1521

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1522

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1523

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1524

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1525

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1526

"key": "A String", # Required. A 128/192/256 bit key.

1527

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1528

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1529

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1530

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1531

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1532

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1533

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

1534

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

1535

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1536

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1537

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1538

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1539

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1540

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1541

"stringValue": "A String", # string

1542

"timestampValue": "A String", # timestamp

1543

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1544

"dayOfWeekValue": "A String", # day of week

1545

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1546

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1547

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1548

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1549

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1550

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1551

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1552

},

1553

},

1554

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

1555

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

1556

{ # Bucket is represented as a range, along with replacement values.

1557

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

1558

"integerValue": "A String", # integer

1559

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1560

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1561

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1562

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1563

},

1564

"stringValue": "A String", # string

1565

"timestampValue": "A String", # timestamp

1566

"floatValue": 3.14, # float

1567

"dayOfWeekValue": "A String", # day of week

1568

"booleanValue": True or False, # boolean

1569

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1570

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1571

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1572

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1573

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1574

},

1575

},

1576

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

1577

"integerValue": "A String", # integer

1578

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1579

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1580

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1581

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1582

},

1583

"stringValue": "A String", # string

1584

"timestampValue": "A String", # timestamp

1585

"floatValue": 3.14, # float

1586

"dayOfWeekValue": "A String", # day of week

1587

"booleanValue": True or False, # boolean

1588

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1589

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1590

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1591

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1592

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1593

},

1594

},

1595

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

1596

"integerValue": "A String", # integer

1597

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1598

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1599

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1600

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1601

},

1602

"stringValue": "A String", # string

1603

"timestampValue": "A String", # timestamp

1604

"floatValue": 3.14, # float

1605

"dayOfWeekValue": "A String", # day of week

1606

"booleanValue": True or False, # boolean

1607

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1608

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1609

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1610

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1611

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1618

},

1619

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

1620

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

1621

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1622

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

1623

"name": "A String", # Name describing the field.

1624

},

1625

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

1626

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1627

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1628

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1629

},

1630

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1631

"key": "A String", # Required. A 128/192/256 bit key.

1632

},

1633

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1634

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1635

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1636

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1637

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1638

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1639

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1640

},

1641

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

1642

{ # Type of information detected by the API.

1643

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1649

},

1650

],

1651

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that match any suppression rule are omitted from the output.

1652

{ # Configuration to suppress records whose suppression conditions evaluate to true.

1653

"condition": { # A condition for determining whether a transformation should be applied to a field. # A condition that when it evaluates to true will result in the record being evaluated to be suppressed from the transformed content.

1654

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1655

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1656

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

1657

"conditions": [ # A collection of conditions.

1658

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1659

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

1660

"name": "A String", # Name describing the field.

1661

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1662

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1663

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

1664

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1665

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1666

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1667

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1668

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1669

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1670

"stringValue": "A String", # string

1671

"timestampValue": "A String", # timestamp

1672

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1673

"dayOfWeekValue": "A String", # day of week

1674

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1675

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1676

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1677

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1678

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1679

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1680

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

},

],

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1690

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="delete">delete(name, x__xgafv=None)</code>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1696

<pre>Deletes a DeidentifyTemplate. See https://cloud.google.com/dlp/docs/creating-templates-deid to learn more.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1697

1698

Args:

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1699

name: string, Required. Resource name of the organization and deidentify template to be deleted, for example `organizations/433245324/deidentifyTemplates/432452342` or projects/project-id/deidentifyTemplates/432452342. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1700

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1707

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1708

{ # A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); } The JSON representation for `Empty` is empty JSON object `{}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="get">get(name, x__xgafv=None)</code>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1714

<pre>Gets a DeidentifyTemplate. See https://cloud.google.com/dlp/docs/creating-templates-deid to learn more.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1715

1716

Args:

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1717

name: string, Required. Resource name of the organization and deidentify template to be read, for example `organizations/433245324/deidentifyTemplates/432452342` or projects/project-id/deidentifyTemplates/432452342. (required)

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1718

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

1725

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1726

{ # DeidentifyTemplates contains instructions on how to de-identify content. See https://cloud.google.com/dlp/docs/concepts-templates to learn more.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1727

"updateTime": "A String", # Output only. The last update timestamp of an inspectTemplate.

1728

"name": "A String", # Output only. The template name. The template will have one of the following formats: `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`

1729

"createTime": "A String", # Output only. The creation timestamp of an inspectTemplate.

1730

"description": "A String", # Short description (max 256 chars).

1731

"displayName": "A String", # Display name (max 256 chars).

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1732

"deidentifyConfig": { # The configuration that controls how the data will change. # ///////////// // The core content of the template // ///////////////

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1733

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the dataset as free-form text and apply the same free text transformation everywhere.

1734

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

1735

{ # A transformation to apply to text that is identified as a specific info_type.

1736

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1737

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1738

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

1739

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1740

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1741

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1742

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1743

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1744

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1745

"stringValue": "A String", # string

1746

"timestampValue": "A String", # timestamp

1747

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1748

"dayOfWeekValue": "A String", # day of week

1749

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1750

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1751

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1752

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1753

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1754

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1755

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1756

},

1757

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

1758

"integerValue": "A String", # integer

1759

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1760

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1761

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1762

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1763

},

1764

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1765

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1766

"floatValue": 3.14, # float

1767

"dayOfWeekValue": "A String", # day of week

1768

"booleanValue": True or False, # boolean

1769

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1770

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1771

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1772

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1773

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1774

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1775

},

1776

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

1777

},

1778

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

1779

"partToExtract": "A String", # The part of the time to keep.

1780

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1781

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1782

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

1783

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1784

},

1785

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

1786

"name": "A String", # Name describing the field.

1787

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1788

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

1789

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1790

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1791

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1792

},

1793

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1794

"key": "A String", # Required. A 128/192/256 bit key.

1795

},

1796

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1797

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1798

},

1799

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1800

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1801

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

1802

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

1803

"name": "A String", # Name describing the field.

1804

},

1805

"commonAlphabet": "A String", # Common alphabets.

1806

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

1807

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

1808

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

1809

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

1810

},

1811

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

1812

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1813

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1814

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1815

},

1816

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1817

"key": "A String", # Required. A 128/192/256 bit key.

1818

},

1819

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1820

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1821

},

1822

},

1823

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1824

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1825

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1826

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1827

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1828

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

1829

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

1830

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

1831

"charactersToSkip": "A String", # Characters to not transform when masking.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

1832

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1833

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1834

},

1835

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

1836

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1837

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1838

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1839

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1840

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1841

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1842

"key": "A String", # Required. A 128/192/256 bit key.

1843

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1844

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1845

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1846

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1847

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

1848

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1849

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

1850

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

1851

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1852

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1853

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1854

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1855

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1856

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1857

"stringValue": "A String", # string

1858

"timestampValue": "A String", # timestamp

1859

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1860

"dayOfWeekValue": "A String", # day of week

1861

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1862

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1863

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1864

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1865

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1866

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1867

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1868

},

1869

},

1870

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

1871

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

1872

{ # Bucket is represented as a range, along with replacement values.

1873

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

1874

"integerValue": "A String", # integer

1875

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1876

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1877

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1878

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1879

},

1880

"stringValue": "A String", # string

1881

"timestampValue": "A String", # timestamp

1882

"floatValue": 3.14, # float

1883

"dayOfWeekValue": "A String", # day of week

1884

"booleanValue": True or False, # boolean

1885

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1886

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1887

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1888

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1889

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1890

},

1891

},

1892

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

1893

"integerValue": "A String", # integer

1894

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1895

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1896

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1897

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1898

},

1899

"stringValue": "A String", # string

1900

"timestampValue": "A String", # timestamp

1901

"floatValue": 3.14, # float

1902

"dayOfWeekValue": "A String", # day of week

1903

"booleanValue": True or False, # boolean

1904

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1905

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1906

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1907

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1908

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1909

},

1910

},

1911

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

1912

"integerValue": "A String", # integer

1913

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1914

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1915

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1916

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1917

},

1918

"stringValue": "A String", # string

1919

"timestampValue": "A String", # timestamp

1920

"floatValue": 3.14, # float

1921

"dayOfWeekValue": "A String", # day of week

1922

"booleanValue": True or False, # boolean

1923

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1924

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1925

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1926

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

1927

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1934

},

1935

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

1936

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

1937

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1938

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

1939

"name": "A String", # Name describing the field.

1940

},

1941

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

1942

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

1943

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1944

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1945

},

1946

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

1947

"key": "A String", # Required. A 128/192/256 bit key.

1948

},

1949

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

1950

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

1951

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

1952

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1953

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

1954

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

1955

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1956

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

1957

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

1958

{ # Type of information detected by the API.

1959

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A transformation error occurs when the requested transformation is incompatible with the data. For example, trying to de-identify an IP address using a `DateShift` transformation would result in a transformation error, since date info cannot be extracted from an IP address. Information about any incompatible transformations, and how they were handled, is returned in the response as part of the `TransformationOverviews`. # Mode for handling transformation errors. If left unspecified, the default mode is `TransformationErrorHandling.ThrowError`.

1966

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would cause an error. For example, if a `DateShift` transformation were applied an an IP address, this mode would leave the IP address unchanged in the response. # Ignore errors

1967

},

1968

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

1969

},

1970

},

1971

"recordTransformations": { # A type of transformation that is applied over structured data such as a table. # Treat the dataset as structured. Transformations can be applied to specific locations within structured datasets, such as transforming a column within a table.

1972

"fieldTransformations": [ # Transform the record by applying various field transformations.

1973

{ # The transformation to apply to the field.

1974

"condition": { # A condition for determining whether a transformation should be applied to a field. # Only apply the transformation if the condition evaluates to true for the given `RecordCondition`. The conditions are allowed to reference fields that are not used in the actual transformation. Example Use Cases: - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range. - Redact a field if the date of birth field is greater than 85.

1975

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

1976

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

1977

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

1978

"conditions": [ # A collection of conditions.

1979

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

1980

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

1981

"name": "A String", # Name describing the field.

1982

},

1983

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

1984

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

1985

"integerValue": "A String", # integer

1986

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

1987

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

1988

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

1989

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

1990

},

1991

"stringValue": "A String", # string

1992

"timestampValue": "A String", # timestamp

1993

"floatValue": 3.14, # float

1994

"dayOfWeekValue": "A String", # day of week

1995

"booleanValue": True or False, # boolean

1996

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

1997

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

1998

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1999

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2000

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

},

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2008

"fields": [ # Required. Input field(s) to apply the transformation to.

2009

{ # General identifier of a data field in a storage service.

2010

"name": "A String", # Name describing the field.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2011

},

2012

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2013

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

2014

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

2015

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

2016

"integerValue": "A String", # integer

2017

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2018

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2019

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2020

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2021

},

2022

"stringValue": "A String", # string

2023

"timestampValue": "A String", # timestamp

2024

"floatValue": 3.14, # float

2025

"dayOfWeekValue": "A String", # day of week

2026

"booleanValue": True or False, # boolean

2027

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2028

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2029

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2030

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2031

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2032

},

2033

},

2034

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

2035

"integerValue": "A String", # integer

2036

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2037

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2038

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2039

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2040

},

2041

"stringValue": "A String", # string

2042

"timestampValue": "A String", # timestamp

2043

"floatValue": 3.14, # float

2044

"dayOfWeekValue": "A String", # day of week

2045

"booleanValue": True or False, # boolean

2046

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2047

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2048

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2049

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2050

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2051

},

2052

},

2053

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

2054

},

2055

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

2056

"partToExtract": "A String", # The part of the time to keep.

2057

},

2058

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

2059

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

2060

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2061

},

2062

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

2063

"name": "A String", # Name describing the field.

2064

},

2065

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

2066

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2067

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2068

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2069

},

2070

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2071

"key": "A String", # Required. A 128/192/256 bit key.

2072

},

2073

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2074

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

2079

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

2080

"name": "A String", # Name describing the field.

2081

},

2082

"commonAlphabet": "A String", # Common alphabets.

2083

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

2084

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

2085

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

2086

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2087

},

2088

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

2089

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2090

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2091

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2092

},

2093

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2094

"key": "A String", # Required. A 128/192/256 bit key.

2095

},

2096

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2097

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

2102

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

2103

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

2104

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

2105

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

2106

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

2107

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

2108

"charactersToSkip": "A String", # Characters to not transform when masking.

},

],

},

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

2113

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

2114

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2115

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2116

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2117

},

2118

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2119

"key": "A String", # Required. A 128/192/256 bit key.

2120

},

2121

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2122

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

2127

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

2128

"integerValue": "A String", # integer

2129

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2130

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2131

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2132

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2133

},

2134

"stringValue": "A String", # string

2135

"timestampValue": "A String", # timestamp

2136

"floatValue": 3.14, # float

2137

"dayOfWeekValue": "A String", # day of week

2138

"booleanValue": True or False, # boolean

2139

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2140

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2141

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2142

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2143

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

2148

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

2149

{ # Bucket is represented as a range, along with replacement values.

2150

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

2151

"integerValue": "A String", # integer

2152

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2153

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2154

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2155

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2156

},

2157

"stringValue": "A String", # string

2158

"timestampValue": "A String", # timestamp

2159

"floatValue": 3.14, # float

2160

"dayOfWeekValue": "A String", # day of week

2161

"booleanValue": True or False, # boolean

2162

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2163

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2164

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2165

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2166

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2167

},

2168

},

2169

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

2170

"integerValue": "A String", # integer

2171

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2172

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2173

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2174

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2175

},

2176

"stringValue": "A String", # string

2177

"timestampValue": "A String", # timestamp

2178

"floatValue": 3.14, # float

2179

"dayOfWeekValue": "A String", # day of week

2180

"booleanValue": True or False, # boolean

2181

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2182

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2183

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2184

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2185

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2186

},

2187

},

2188

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

2189

"integerValue": "A String", # integer

2190

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2191

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2192

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2193

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2194

},

2195

"stringValue": "A String", # string

2196

"timestampValue": "A String", # timestamp

2197

"floatValue": 3.14, # float

2198

"dayOfWeekValue": "A String", # day of week

2199

"booleanValue": True or False, # boolean

2200

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2201

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2202

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2203

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2204

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

2211

},

2212

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

2213

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

2214

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

2215

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

2216

"name": "A String", # Name describing the field.

2217

},

2218

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

2219

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2220

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2221

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2222

},

2223

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2224

"key": "A String", # Required. A 128/192/256 bit key.

2225

},

2226

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2227

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

2232

},

2233

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2234

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the contents of the field as free text, and selectively transform content that matches an `InfoType`.

2235

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

2236

{ # A transformation to apply to text that is identified as a specific info_type.

2237

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2238

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2239

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

2240

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2241

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2242

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2243

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2244

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2245

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2246

"stringValue": "A String", # string

2247

"timestampValue": "A String", # timestamp

2248

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2249

"dayOfWeekValue": "A String", # day of week

2250

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2251

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2252

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2253

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2254

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2255

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2256

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2257

},

2258

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

2259

"integerValue": "A String", # integer

2260

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2261

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2262

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2263

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2264

},

2265

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2266

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2267

"floatValue": 3.14, # float

2268

"dayOfWeekValue": "A String", # day of week

2269

"booleanValue": True or False, # boolean

2270

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2271

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2272

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2273

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2274

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2275

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2276

},

2277

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

2278

},

2279

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

2280

"partToExtract": "A String", # The part of the time to keep.

2281

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2282

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2283

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

2284

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2285

},

2286

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

2287

"name": "A String", # Name describing the field.

2288

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2289

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

2290

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2291

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2292

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2293

},

2294

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2295

"key": "A String", # Required. A 128/192/256 bit key.

2296

},

2297

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2298

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2299

},

2300

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2301

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2302

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

2303

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

2304

"name": "A String", # Name describing the field.

2305

},

2306

"commonAlphabet": "A String", # Common alphabets.

2307

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

2308

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

2309

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

2310

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2311

},

2312

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

2313

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2314

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2315

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2316

},

2317

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2318

"key": "A String", # Required. A 128/192/256 bit key.

2319

},

2320

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2321

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2322

},

2323

},

2324

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2325

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2326

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2327

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2328

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2329

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

2330

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

2331

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

2332

"charactersToSkip": "A String", # Characters to not transform when masking.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2333

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2334

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2335

},

2336

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

2337

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2338

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2339

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2340

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2341

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2342

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2343

"key": "A String", # Required. A 128/192/256 bit key.

2344

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2345

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2346

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2347

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2348

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2349

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2350

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

2351

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

2352

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2353

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2354

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2355

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2356

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2357

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2358

"stringValue": "A String", # string

2359

"timestampValue": "A String", # timestamp

2360

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2361

"dayOfWeekValue": "A String", # day of week

2362

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2363

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2364

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2365

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2366

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2367

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2368

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2369

},

2370

},

2371

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

2372

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

2373

{ # Bucket is represented as a range, along with replacement values.

2374

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

2375

"integerValue": "A String", # integer

2376

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2377

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2378

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2379

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2380

},

2381

"stringValue": "A String", # string

2382

"timestampValue": "A String", # timestamp

2383

"floatValue": 3.14, # float

2384

"dayOfWeekValue": "A String", # day of week

2385

"booleanValue": True or False, # boolean

2386

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2387

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2388

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2389

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2390

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2391

},

2392

},

2393

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

2394

"integerValue": "A String", # integer

2395

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2396

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2397

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2398

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2399

},

2400

"stringValue": "A String", # string

2401

"timestampValue": "A String", # timestamp

2402

"floatValue": 3.14, # float

2403

"dayOfWeekValue": "A String", # day of week

2404

"booleanValue": True or False, # boolean

2405

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2406

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2407

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2408

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2409

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2410

},

2411

},

2412

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

2413

"integerValue": "A String", # integer

2414

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2415

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2416

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2417

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2418

},

2419

"stringValue": "A String", # string

2420

"timestampValue": "A String", # timestamp

2421

"floatValue": 3.14, # float

2422

"dayOfWeekValue": "A String", # day of week

2423

"booleanValue": True or False, # boolean

2424

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2425

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2426

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2427

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2428

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

2435

},

2436

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

2437

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

2438

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

2439

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

2440

"name": "A String", # Name describing the field.

2441

},

2442

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

2443

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2444

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2445

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2446

},

2447

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2448

"key": "A String", # Required. A 128/192/256 bit key.

2449

},

2450

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2451

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2452

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2453

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2454

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2455

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2456

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2457

},

2458

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

2459

{ # Type of information detected by the API.

2460

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2466

},

2467

],

2468

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that match any suppression rule are omitted from the output.

2469

{ # Configuration to suppress records whose suppression conditions evaluate to true.

2470

"condition": { # A condition for determining whether a transformation should be applied to a field. # A condition that when it evaluates to true will result in the record being evaluated to be suppressed from the transformed content.

2471

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2472

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2473

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

2474

"conditions": [ # A collection of conditions.

2475

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2476

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

2477

"name": "A String", # Name describing the field.

2478

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2479

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2480

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

2481

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2482

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2483

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2484

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2485

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2486

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2487

"stringValue": "A String", # string

2488

"timestampValue": "A String", # timestamp

2489

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2490

"dayOfWeekValue": "A String", # day of week

2491

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2492

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2493

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2494

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2495

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2496

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2497

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

},

],

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2507

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2512

<code class="details" id="list">list(parent, orderBy=None, locationId=None, pageToken=None, pageSize=None, x__xgafv=None)</code>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2513

<pre>Lists DeidentifyTemplates. See https://cloud.google.com/dlp/docs/creating-templates-deid to learn more.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2514

2515

Args:

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2516

parent: string, Required. Parent resource name. The format of this value varies depending on the scope of the request (project or organization) and whether you have [specified a processing location](https://cloud.google.com/dlp/docs/specifying-location): + Projects scope, location specified: `projects/`PROJECT_ID`/locations/`LOCATION_ID + Projects scope, no location specified (defaults to global): `projects/`PROJECT_ID + Organizations scope, location specified: `organizations/`ORG_ID`/locations/`LOCATION_ID + Organizations scope, no location specified (defaults to global): `organizations/`ORG_ID The following example `parent` string specifies a parent project with the identifier `example-project`, and specifies the `europe-west3` location for processing data: parent=projects/example-project/locations/europe-west3 (required)

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2517

orderBy: string, Comma separated list of fields to order by, followed by `asc` or `desc` postfix. This list is case-insensitive, default sorting order is ascending, redundant space characters are insignificant. Example: `name asc,update_time, create_time desc` Supported fields are: - `create_time`: corresponds to time the template was created. - `update_time`: corresponds to time the template was last updated. - `name`: corresponds to template's name. - `display_name`: corresponds to template's display name.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2518

locationId: string, Deprecated. This field has no effect.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2519

pageToken: string, Page token to continue retrieval. Comes from previous call to `ListDeidentifyTemplates`.

2520

pageSize: integer, Size of the page, can be limited by server. If zero server returns a page of max size 100.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2521

x__xgafv: string, V1 error format.

2522

Allowed values

2523

1 - v1 error format

2524

2 - v2 error format

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2525

2526

Returns:

2527

An object of the form:

2528

2529

{ # Response message for ListDeidentifyTemplates.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2530

"deidentifyTemplates": [ # List of deidentify templates, up to page_size in ListDeidentifyTemplatesRequest.

2531

{ # DeidentifyTemplates contains instructions on how to de-identify content. See https://cloud.google.com/dlp/docs/concepts-templates to learn more.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2532

"updateTime": "A String", # Output only. The last update timestamp of an inspectTemplate.

2533

"name": "A String", # Output only. The template name. The template will have one of the following formats: `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`

2534

"createTime": "A String", # Output only. The creation timestamp of an inspectTemplate.

2535

"description": "A String", # Short description (max 256 chars).

2536

"displayName": "A String", # Display name (max 256 chars).

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2537

"deidentifyConfig": { # The configuration that controls how the data will change. # ///////////// // The core content of the template // ///////////////

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2538

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the dataset as free-form text and apply the same free text transformation everywhere.

2539

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

2540

{ # A transformation to apply to text that is identified as a specific info_type.

2541

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2542

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2543

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

2544

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2545

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2546

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2547

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2548

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2549

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2550

"stringValue": "A String", # string

2551

"timestampValue": "A String", # timestamp

2552

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2553

"dayOfWeekValue": "A String", # day of week

2554

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2555

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2556

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2557

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2558

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2559

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2560

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2561

},

2562

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

2563

"integerValue": "A String", # integer

2564

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2565

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2566

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2567

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2568

},

2569

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2570

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2571

"floatValue": 3.14, # float

2572

"dayOfWeekValue": "A String", # day of week

2573

"booleanValue": True or False, # boolean

2574

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2575

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2576

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2577

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2578

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2579

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2580

},

2581

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

2582

},

2583

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

2584

"partToExtract": "A String", # The part of the time to keep.

2585

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2586

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2587

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

2588

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2589

},

2590

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

2591

"name": "A String", # Name describing the field.

2592

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2593

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

2594

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2595

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2596

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2597

},

2598

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2599

"key": "A String", # Required. A 128/192/256 bit key.

2600

},

2601

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2602

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2603

},

2604

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2605

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2606

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

2607

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

2608

"name": "A String", # Name describing the field.

2609

},

2610

"commonAlphabet": "A String", # Common alphabets.

2611

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

2612

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

2613

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

2614

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2615

},

2616

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

2617

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2618

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2619

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2620

},

2621

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2622

"key": "A String", # Required. A 128/192/256 bit key.

2623

},

2624

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2625

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2626

},

2627

},

2628

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2629

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2630

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2631

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2632

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2633

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

2634

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

2635

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

2636

"charactersToSkip": "A String", # Characters to not transform when masking.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

2637

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2638

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2639

},

2640

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

2641

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2642

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2643

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2644

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2645

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2646

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2647

"key": "A String", # Required. A 128/192/256 bit key.

2648

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2649

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2650

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2651

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2652

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2653

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2654

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

2655

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

2656

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2657

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2658

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2659

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2660

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2661

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2662

"stringValue": "A String", # string

2663

"timestampValue": "A String", # timestamp

2664

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2665

"dayOfWeekValue": "A String", # day of week

2666

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2667

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2668

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2669

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2670

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2671

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2672

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2673

},

2674

},

2675

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

2676

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

2677

{ # Bucket is represented as a range, along with replacement values.

2678

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

2679

"integerValue": "A String", # integer

2680

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2681

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2682

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2683

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2684

},

2685

"stringValue": "A String", # string

2686

"timestampValue": "A String", # timestamp

2687

"floatValue": 3.14, # float

2688

"dayOfWeekValue": "A String", # day of week

2689

"booleanValue": True or False, # boolean

2690

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2691

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2692

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2693

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2694

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2695

},

2696

},

2697

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

2698

"integerValue": "A String", # integer

2699

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2700

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2701

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2702

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2703

},

2704

"stringValue": "A String", # string

2705

"timestampValue": "A String", # timestamp

2706

"floatValue": 3.14, # float

2707

"dayOfWeekValue": "A String", # day of week

2708

"booleanValue": True or False, # boolean

2709

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2710

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2711

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2712

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2713

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2714

},

2715

},

2716

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

2717

"integerValue": "A String", # integer

2718

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2719

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2720

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2721

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2722

},

2723

"stringValue": "A String", # string

2724

"timestampValue": "A String", # timestamp

2725

"floatValue": 3.14, # float

2726

"dayOfWeekValue": "A String", # day of week

2727

"booleanValue": True or False, # boolean

2728

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2729

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2730

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2731

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2732

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

2739

},

2740

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

2741

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

2742

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

2743

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

2744

"name": "A String", # Name describing the field.

2745

},

2746

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

2747

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2748

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2749

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2750

},

2751

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2752

"key": "A String", # Required. A 128/192/256 bit key.

2753

},

2754

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2755

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

2756

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

2757

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2758

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2759

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

2760

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2761

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2762

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

2763

{ # Type of information detected by the API.

2764

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A transformation error occurs when the requested transformation is incompatible with the data. For example, trying to de-identify an IP address using a `DateShift` transformation would result in a transformation error, since date info cannot be extracted from an IP address. Information about any incompatible transformations, and how they were handled, is returned in the response as part of the `TransformationOverviews`. # Mode for handling transformation errors. If left unspecified, the default mode is `TransformationErrorHandling.ThrowError`.

2771

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would cause an error. For example, if a `DateShift` transformation were applied an an IP address, this mode would leave the IP address unchanged in the response. # Ignore errors

2772

},

2773

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

2774

},

2775

},

2776

"recordTransformations": { # A type of transformation that is applied over structured data such as a table. # Treat the dataset as structured. Transformations can be applied to specific locations within structured datasets, such as transforming a column within a table.

2777

"fieldTransformations": [ # Transform the record by applying various field transformations.

2778

{ # The transformation to apply to the field.

2779

"condition": { # A condition for determining whether a transformation should be applied to a field. # Only apply the transformation if the condition evaluates to true for the given `RecordCondition`. The conditions are allowed to reference fields that are not used in the actual transformation. Example Use Cases: - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range. - Redact a field if the date of birth field is greater than 85.

2780

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

2781

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

2782

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

2783

"conditions": [ # A collection of conditions.

2784

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

2785

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

2786

"name": "A String", # Name describing the field.

2787

},

2788

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

2789

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

2790

"integerValue": "A String", # integer

2791

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2792

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2793

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2794

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2795

},

2796

"stringValue": "A String", # string

2797

"timestampValue": "A String", # timestamp

2798

"floatValue": 3.14, # float

2799

"dayOfWeekValue": "A String", # day of week

2800

"booleanValue": True or False, # boolean

2801

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2802

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2803

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2804

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2805

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

},

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

2813

"fields": [ # Required. Input field(s) to apply the transformation to.

2814

{ # General identifier of a data field in a storage service.

2815

"name": "A String", # Name describing the field.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

2816

},

2817

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

2818

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

2819

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

2820

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

2821

"integerValue": "A String", # integer

2822

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2823

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2824

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2825

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2826

},

2827

"stringValue": "A String", # string

2828

"timestampValue": "A String", # timestamp

2829

"floatValue": 3.14, # float

2830

"dayOfWeekValue": "A String", # day of week

2831

"booleanValue": True or False, # boolean

2832

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2833

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2834

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2835

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2836

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2837

},

2838

},

2839

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

2840

"integerValue": "A String", # integer

2841

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2842

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2843

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2844

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2845

},

2846

"stringValue": "A String", # string

2847

"timestampValue": "A String", # timestamp

2848

"floatValue": 3.14, # float

2849

"dayOfWeekValue": "A String", # day of week

2850

"booleanValue": True or False, # boolean

2851

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2852

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2853

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2854

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2855

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2856

},

2857

},

2858

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

2859

},

2860

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

2861

"partToExtract": "A String", # The part of the time to keep.

2862

},

2863

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

2864

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

2865

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2866

},

2867

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

2868

"name": "A String", # Name describing the field.

2869

},

2870

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

2871

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2872

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2873

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2874

},

2875

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2876

"key": "A String", # Required. A 128/192/256 bit key.

2877

},

2878

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2879

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

2884

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

2885

"name": "A String", # Name describing the field.

2886

},

2887

"commonAlphabet": "A String", # Common alphabets.

2888

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

2889

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

2890

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

2891

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

2892

},

2893

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

2894

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2895

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2896

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2897

},

2898

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2899

"key": "A String", # Required. A 128/192/256 bit key.

2900

},

2901

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2902

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

2907

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

2908

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

2909

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

2910

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

2911

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

2912

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

2913

"charactersToSkip": "A String", # Characters to not transform when masking.

},

],

},

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

2918

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

2919

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

2920

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2921

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2922

},

2923

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

2924

"key": "A String", # Required. A 128/192/256 bit key.

2925

},

2926

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

2927

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

2932

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

2933

"integerValue": "A String", # integer

2934

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2935

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2936

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2937

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2938

},

2939

"stringValue": "A String", # string

2940

"timestampValue": "A String", # timestamp

2941

"floatValue": 3.14, # float

2942

"dayOfWeekValue": "A String", # day of week

2943

"booleanValue": True or False, # boolean

2944

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2945

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2946

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2947

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2948

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

2953

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

2954

{ # Bucket is represented as a range, along with replacement values.

2955

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

2956

"integerValue": "A String", # integer

2957

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2958

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2959

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2960

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2961

},

2962

"stringValue": "A String", # string

2963

"timestampValue": "A String", # timestamp

2964

"floatValue": 3.14, # float

2965

"dayOfWeekValue": "A String", # day of week

2966

"booleanValue": True or False, # boolean

2967

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2968

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2969

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2970

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2971

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2972

},

2973

},

2974

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

2975

"integerValue": "A String", # integer

2976

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2977

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2978

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2979

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2980

},

2981

"stringValue": "A String", # string

2982

"timestampValue": "A String", # timestamp

2983

"floatValue": 3.14, # float

2984

"dayOfWeekValue": "A String", # day of week

2985

"booleanValue": True or False, # boolean

2986

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

2987

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

2988

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2989

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

2990

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2991

},

2992

},

2993

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

2994

"integerValue": "A String", # integer

2995

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

2996

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

2997

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

2998

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

2999

},

3000

"stringValue": "A String", # string

3001

"timestampValue": "A String", # timestamp

3002

"floatValue": 3.14, # float

3003

"dayOfWeekValue": "A String", # day of week

3004

"booleanValue": True or False, # boolean

3005

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3006

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3007

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3008

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3009

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3016

},

3017

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

3018

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

3019

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3020

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

3021

"name": "A String", # Name describing the field.

3022

},

3023

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

3024

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3025

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3026

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3027

},

3028

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3029

"key": "A String", # Required. A 128/192/256 bit key.

3030

},

3031

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3032

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

3037

},

3038

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3039

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the contents of the field as free text, and selectively transform content that matches an `InfoType`.

3040

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

3041

{ # A transformation to apply to text that is identified as a specific info_type.

3042

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3043

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3044

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

3045

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3046

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3047

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3048

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3049

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3050

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3051

"stringValue": "A String", # string

3052

"timestampValue": "A String", # timestamp

3053

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3054

"dayOfWeekValue": "A String", # day of week

3055

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3056

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3057

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3058

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3059

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3060

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3061

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3062

},

3063

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

3064

"integerValue": "A String", # integer

3065

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3066

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3067

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3068

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3069

},

3070

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3071

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3072

"floatValue": 3.14, # float

3073

"dayOfWeekValue": "A String", # day of week

3074

"booleanValue": True or False, # boolean

3075

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3076

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3077

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3078

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3079

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3080

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3081

},

3082

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

3083

},

3084

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

3085

"partToExtract": "A String", # The part of the time to keep.

3086

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3087

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3088

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

3089

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3090

},

3091

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

3092

"name": "A String", # Name describing the field.

3093

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3094

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

3095

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3096

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3097

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3098

},

3099

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3100

"key": "A String", # Required. A 128/192/256 bit key.

3101

},

3102

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3103

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3104

},

3105

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3106

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3107

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

3108

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

3109

"name": "A String", # Name describing the field.

3110

},

3111

"commonAlphabet": "A String", # Common alphabets.

3112

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

3113

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

3114

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

3115

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3116

},

3117

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

3118

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3119

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3120

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3121

},

3122

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3123

"key": "A String", # Required. A 128/192/256 bit key.

3124

},

3125

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3126

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3127

},

3128

},

3129

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3130

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3131

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3132

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3133

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3134

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

3135

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

3136

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

3137

"charactersToSkip": "A String", # Characters to not transform when masking.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3138

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3139

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3140

},

3141

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

3142

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3143

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3144

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3145

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3146

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3147

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3148

"key": "A String", # Required. A 128/192/256 bit key.

3149

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3150

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3151

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3152

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3153

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3154

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3155

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3156

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

3157

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3158

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3159

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3160

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3161

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3162

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3163

"stringValue": "A String", # string

3164

"timestampValue": "A String", # timestamp

3165

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3166

"dayOfWeekValue": "A String", # day of week

3167

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3168

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3169

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3170

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3171

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3172

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3173

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3174

},

3175

},

3176

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

3177

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

3178

{ # Bucket is represented as a range, along with replacement values.

3179

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

3180

"integerValue": "A String", # integer

3181

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3182

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3183

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3184

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3185

},

3186

"stringValue": "A String", # string

3187

"timestampValue": "A String", # timestamp

3188

"floatValue": 3.14, # float

3189

"dayOfWeekValue": "A String", # day of week

3190

"booleanValue": True or False, # boolean

3191

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3192

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3193

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3194

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3195

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3196

},

3197

},

3198

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

3199

"integerValue": "A String", # integer

3200

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3201

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3202

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3203

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3204

},

3205

"stringValue": "A String", # string

3206

"timestampValue": "A String", # timestamp

3207

"floatValue": 3.14, # float

3208

"dayOfWeekValue": "A String", # day of week

3209

"booleanValue": True or False, # boolean

3210

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3211

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3212

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3213

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3214

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3215

},

3216

},

3217

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

3218

"integerValue": "A String", # integer

3219

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3220

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3221

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3222

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3223

},

3224

"stringValue": "A String", # string

3225

"timestampValue": "A String", # timestamp

3226

"floatValue": 3.14, # float

3227

"dayOfWeekValue": "A String", # day of week

3228

"booleanValue": True or False, # boolean

3229

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3230

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3231

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3232

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3233

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3240

},

3241

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

3242

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

3243

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3244

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

3245

"name": "A String", # Name describing the field.

3246

},

3247

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

3248

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3249

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3250

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3251

},

3252

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3253

"key": "A String", # Required. A 128/192/256 bit key.

3254

},

3255

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3256

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3257

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3258

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3259

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3260

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3261

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3262

},

3263

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

3264

{ # Type of information detected by the API.

3265

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3271

},

3272

],

3273

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that match any suppression rule are omitted from the output.

3274

{ # Configuration to suppress records whose suppression conditions evaluate to true.

3275

"condition": { # A condition for determining whether a transformation should be applied to a field. # A condition that when it evaluates to true will result in the record being evaluated to be suppressed from the transformed content.

3276

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3277

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3278

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

3279

"conditions": [ # A collection of conditions.

3280

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3281

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

3282

"name": "A String", # Name describing the field.

3283

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3284

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3285

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

3286

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3287

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3288

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3289

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3290

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3291

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3292

"stringValue": "A String", # string

3293

"timestampValue": "A String", # timestamp

3294

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3295

"dayOfWeekValue": "A String", # day of week

3296

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3297

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3298

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3299

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3300

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3301

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3302

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

},

],

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3312

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3313

},

3314

],

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3315

"nextPageToken": "A String", # If the next page is available then the next page token to be used in following ListDeidentifyTemplates request.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

3321

<pre>Retrieves the next page of results.

3322

3323

Args:

3324

previous_request: The request for the previous page. (required)

3325

previous_response: The response from the request for the previous page. (required)

3326

3327

Returns:

Bu Sun Kim

6502091

2020-05-20 12:08:20 -0700

[diff] [blame]

3328

A request object that you can call 'execute()' on to request the next

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3329

page. Returns None if there are no more items in the collection.

</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3334

<code class="details" id="patch">patch(name, body=None, x__xgafv=None)</code>

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3335

<pre>Updates the DeidentifyTemplate. See https://cloud.google.com/dlp/docs/creating-templates-deid to learn more.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3336

3337

Args:

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3338

name: string, Required. Resource name of organization and deidentify template to be updated, for example `organizations/433245324/deidentifyTemplates/432452342` or projects/project-id/deidentifyTemplates/432452342. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3339

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3340

The object takes the form of:

3341

3342

{ # Request message for UpdateDeidentifyTemplate.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3343

"deidentifyTemplate": { # DeidentifyTemplates contains instructions on how to de-identify content. See https://cloud.google.com/dlp/docs/concepts-templates to learn more. # New DeidentifyTemplate value.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3344

"updateTime": "A String", # Output only. The last update timestamp of an inspectTemplate.

3345

"name": "A String", # Output only. The template name. The template will have one of the following formats: `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`

3346

"createTime": "A String", # Output only. The creation timestamp of an inspectTemplate.

3347

"description": "A String", # Short description (max 256 chars).

3348

"displayName": "A String", # Display name (max 256 chars).

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3349

"deidentifyConfig": { # The configuration that controls how the data will change. # ///////////// // The core content of the template // ///////////////

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3350

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the dataset as free-form text and apply the same free text transformation everywhere.

3351

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

3352

{ # A transformation to apply to text that is identified as a specific info_type.

3353

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3354

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3355

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

3356

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3357

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3358

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3359

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3360

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3361

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3362

"stringValue": "A String", # string

3363

"timestampValue": "A String", # timestamp

3364

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3365

"dayOfWeekValue": "A String", # day of week

3366

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3367

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3368

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3369

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3370

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3371

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3372

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3373

},

3374

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

3375

"integerValue": "A String", # integer

3376

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3377

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3378

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3379

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3380

},

3381

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3382

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3383

"floatValue": 3.14, # float

3384

"dayOfWeekValue": "A String", # day of week

3385

"booleanValue": True or False, # boolean

3386

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3387

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3388

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3389

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3390

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3391

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3392

},

3393

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

3394

},

3395

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

3396

"partToExtract": "A String", # The part of the time to keep.

3397

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3398

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3399

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

3400

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3401

},

3402

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

3403

"name": "A String", # Name describing the field.

3404

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3405

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

3406

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3407

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3408

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3409

},

3410

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3411

"key": "A String", # Required. A 128/192/256 bit key.

3412

},

3413

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3414

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3415

},

3416

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3417

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3418

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

3419

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

3420

"name": "A String", # Name describing the field.

3421

},

3422

"commonAlphabet": "A String", # Common alphabets.

3423

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

3424

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

3425

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

3426

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3427

},

3428

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

3429

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3430

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3431

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3432

},

3433

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3434

"key": "A String", # Required. A 128/192/256 bit key.

3435

},

3436

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3437

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3438

},

3439

},

3440

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3441

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3442

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3443

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3444

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3445

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

3446

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

3447

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

3448

"charactersToSkip": "A String", # Characters to not transform when masking.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

3449

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3450

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3451

},

3452

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

3453

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3454

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3455

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3456

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3457

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3458

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3459

"key": "A String", # Required. A 128/192/256 bit key.

3460

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3461

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3462

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3463

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3464

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3465

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3466

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3467

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

3468

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3469

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3470

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3471

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3472

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3473

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3474

"stringValue": "A String", # string

3475

"timestampValue": "A String", # timestamp

3476

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3477

"dayOfWeekValue": "A String", # day of week

3478

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3479

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3480

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3481

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3482

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3483

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3484

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3485

},

3486

},

3487

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

3488

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

3489

{ # Bucket is represented as a range, along with replacement values.

3490

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

3491

"integerValue": "A String", # integer

3492

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3493

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3494

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3495

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3496

},

3497

"stringValue": "A String", # string

3498

"timestampValue": "A String", # timestamp

3499

"floatValue": 3.14, # float

3500

"dayOfWeekValue": "A String", # day of week

3501

"booleanValue": True or False, # boolean

3502

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3503

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3504

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3505

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3506

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3507

},

3508

},

3509

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

3510

"integerValue": "A String", # integer

3511

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3512

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3513

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3514

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3515

},

3516

"stringValue": "A String", # string

3517

"timestampValue": "A String", # timestamp

3518

"floatValue": 3.14, # float

3519

"dayOfWeekValue": "A String", # day of week

3520

"booleanValue": True or False, # boolean

3521

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3522

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3523

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3524

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3525

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3526

},

3527

},

3528

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

3529

"integerValue": "A String", # integer

3530

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3531

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3532

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3533

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3534

},

3535

"stringValue": "A String", # string

3536

"timestampValue": "A String", # timestamp

3537

"floatValue": 3.14, # float

3538

"dayOfWeekValue": "A String", # day of week

3539

"booleanValue": True or False, # boolean

3540

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3541

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3542

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3543

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3544

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3551

},

3552

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

3553

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

3554

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3555

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

3556

"name": "A String", # Name describing the field.

3557

},

3558

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

3559

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3560

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3561

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3562

},

3563

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3564

"key": "A String", # Required. A 128/192/256 bit key.

3565

},

3566

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3567

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3568

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3569

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3570

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3571

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3572

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3573

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3574

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

3575

{ # Type of information detected by the API.

3576

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A transformation error occurs when the requested transformation is incompatible with the data. For example, trying to de-identify an IP address using a `DateShift` transformation would result in a transformation error, since date info cannot be extracted from an IP address. Information about any incompatible transformations, and how they were handled, is returned in the response as part of the `TransformationOverviews`. # Mode for handling transformation errors. If left unspecified, the default mode is `TransformationErrorHandling.ThrowError`.

3583

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would cause an error. For example, if a `DateShift` transformation were applied an an IP address, this mode would leave the IP address unchanged in the response. # Ignore errors

3584

},

3585

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

3586

},

3587

},

3588

"recordTransformations": { # A type of transformation that is applied over structured data such as a table. # Treat the dataset as structured. Transformations can be applied to specific locations within structured datasets, such as transforming a column within a table.

3589

"fieldTransformations": [ # Transform the record by applying various field transformations.

3590

{ # The transformation to apply to the field.

3591

"condition": { # A condition for determining whether a transformation should be applied to a field. # Only apply the transformation if the condition evaluates to true for the given `RecordCondition`. The conditions are allowed to reference fields that are not used in the actual transformation. Example Use Cases: - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range. - Redact a field if the date of birth field is greater than 85.

3592

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

3593

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

3594

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

3595

"conditions": [ # A collection of conditions.

3596

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

3597

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

3598

"name": "A String", # Name describing the field.

3599

},

3600

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

3601

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

3602

"integerValue": "A String", # integer

3603

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3604

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3605

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3606

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3607

},

3608

"stringValue": "A String", # string

3609

"timestampValue": "A String", # timestamp

3610

"floatValue": 3.14, # float

3611

"dayOfWeekValue": "A String", # day of week

3612

"booleanValue": True or False, # boolean

3613

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3614

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3615

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3616

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3617

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

},

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3625

"fields": [ # Required. Input field(s) to apply the transformation to.

3626

{ # General identifier of a data field in a storage service.

3627

"name": "A String", # Name describing the field.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3628

},

3629

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3630

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

3631

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

3632

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

3633

"integerValue": "A String", # integer

3634

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3635

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3636

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3637

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3638

},

3639

"stringValue": "A String", # string

3640

"timestampValue": "A String", # timestamp

3641

"floatValue": 3.14, # float

3642

"dayOfWeekValue": "A String", # day of week

3643

"booleanValue": True or False, # boolean

3644

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3645

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3646

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3647

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3648

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3649

},

3650

},

3651

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

3652

"integerValue": "A String", # integer

3653

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3654

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3655

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3656

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3657

},

3658

"stringValue": "A String", # string

3659

"timestampValue": "A String", # timestamp

3660

"floatValue": 3.14, # float

3661

"dayOfWeekValue": "A String", # day of week

3662

"booleanValue": True or False, # boolean

3663

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3664

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3665

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3666

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3667

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3668

},

3669

},

3670

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

3671

},

3672

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

3673

"partToExtract": "A String", # The part of the time to keep.

3674

},

3675

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

3676

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

3677

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3678

},

3679

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

3680

"name": "A String", # Name describing the field.

3681

},

3682

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

3683

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3684

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3685

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3686

},

3687

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3688

"key": "A String", # Required. A 128/192/256 bit key.

3689

},

3690

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3691

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

3696

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

3697

"name": "A String", # Name describing the field.

3698

},

3699

"commonAlphabet": "A String", # Common alphabets.

3700

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

3701

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

3702

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

3703

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3704

},

3705

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

3706

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3707

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3708

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3709

},

3710

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3711

"key": "A String", # Required. A 128/192/256 bit key.

3712

},

3713

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3714

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

3719

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

3720

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

3721

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

3722

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

3723

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

3724

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

3725

"charactersToSkip": "A String", # Characters to not transform when masking.

},

],

},

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

3730

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

3731

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3732

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3733

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3734

},

3735

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3736

"key": "A String", # Required. A 128/192/256 bit key.

3737

},

3738

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3739

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3744

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

3745

"integerValue": "A String", # integer

3746

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3747

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3748

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3749

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3750

},

3751

"stringValue": "A String", # string

3752

"timestampValue": "A String", # timestamp

3753

"floatValue": 3.14, # float

3754

"dayOfWeekValue": "A String", # day of week

3755

"booleanValue": True or False, # boolean

3756

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3757

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3758

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3759

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3760

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

3765

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

3766

{ # Bucket is represented as a range, along with replacement values.

3767

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

3768

"integerValue": "A String", # integer

3769

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3770

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3771

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3772

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3773

},

3774

"stringValue": "A String", # string

3775

"timestampValue": "A String", # timestamp

3776

"floatValue": 3.14, # float

3777

"dayOfWeekValue": "A String", # day of week

3778

"booleanValue": True or False, # boolean

3779

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3780

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3781

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3782

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3783

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3784

},

3785

},

3786

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

3787

"integerValue": "A String", # integer

3788

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3789

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3790

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3791

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3792

},

3793

"stringValue": "A String", # string

3794

"timestampValue": "A String", # timestamp

3795

"floatValue": 3.14, # float

3796

"dayOfWeekValue": "A String", # day of week

3797

"booleanValue": True or False, # boolean

3798

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3799

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3800

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3801

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3802

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3803

},

3804

},

3805

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

3806

"integerValue": "A String", # integer

3807

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3808

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3809

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3810

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3811

},

3812

"stringValue": "A String", # string

3813

"timestampValue": "A String", # timestamp

3814

"floatValue": 3.14, # float

3815

"dayOfWeekValue": "A String", # day of week

3816

"booleanValue": True or False, # boolean

3817

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3818

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3819

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3820

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3821

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3828

},

3829

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

3830

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

3831

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3832

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

3833

"name": "A String", # Name describing the field.

3834

},

3835

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

3836

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3837

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3838

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3839

},

3840

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3841

"key": "A String", # Required. A 128/192/256 bit key.

3842

},

3843

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3844

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

3849

},

3850

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3851

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the contents of the field as free text, and selectively transform content that matches an `InfoType`.

3852

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

3853

{ # A transformation to apply to text that is identified as a specific info_type.

3854

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3855

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3856

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

3857

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3858

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3859

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3860

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3861

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3862

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3863

"stringValue": "A String", # string

3864

"timestampValue": "A String", # timestamp

3865

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3866

"dayOfWeekValue": "A String", # day of week

3867

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3868

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3869

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3870

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3871

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3872

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3873

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3874

},

3875

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

3876

"integerValue": "A String", # integer

3877

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3878

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3879

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3880

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3881

},

3882

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3883

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3884

"floatValue": 3.14, # float

3885

"dayOfWeekValue": "A String", # day of week

3886

"booleanValue": True or False, # boolean

3887

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

3888

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

3889

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3890

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3891

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3892

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3893

},

3894

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

3895

},

3896

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

3897

"partToExtract": "A String", # The part of the time to keep.

3898

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3899

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3900

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

3901

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3902

},

3903

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

3904

"name": "A String", # Name describing the field.

3905

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3906

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

3907

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3908

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3909

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3910

},

3911

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3912

"key": "A String", # Required. A 128/192/256 bit key.

3913

},

3914

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3915

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3916

},

3917

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3918

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3919

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

3920

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

3921

"name": "A String", # Name describing the field.

3922

},

3923

"commonAlphabet": "A String", # Common alphabets.

3924

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

3925

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

3926

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

3927

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

3928

},

3929

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

3930

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3931

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3932

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3933

},

3934

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3935

"key": "A String", # Required. A 128/192/256 bit key.

3936

},

3937

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3938

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3939

},

3940

},

3941

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3942

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3943

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3944

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3945

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3946

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

3947

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

3948

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

3949

"charactersToSkip": "A String", # Characters to not transform when masking.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3950

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3951

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3952

},

3953

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

3954

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3955

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

3956

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3957

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3958

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3959

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

3960

"key": "A String", # Required. A 128/192/256 bit key.

3961

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3962

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

3963

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

3964

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

3965

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

3966

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3967

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3968

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

3969

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3970

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3971

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3972

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3973

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3974

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3975

"stringValue": "A String", # string

3976

"timestampValue": "A String", # timestamp

3977

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3978

"dayOfWeekValue": "A String", # day of week

3979

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3980

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

3981

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3982

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3983

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

3984

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

3985

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

3986

},

3987

},

3988

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

3989

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

3990

{ # Bucket is represented as a range, along with replacement values.

3991

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

3992

"integerValue": "A String", # integer

3993

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

3994

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

3995

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

3996

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

3997

},

3998

"stringValue": "A String", # string

3999

"timestampValue": "A String", # timestamp

4000

"floatValue": 3.14, # float

4001

"dayOfWeekValue": "A String", # day of week

4002

"booleanValue": True or False, # boolean

4003

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4004

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4005

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4006

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4007

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4008

},

4009

},

4010

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

4011

"integerValue": "A String", # integer

4012

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4013

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4014

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4015

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4016

},

4017

"stringValue": "A String", # string

4018

"timestampValue": "A String", # timestamp

4019

"floatValue": 3.14, # float

4020

"dayOfWeekValue": "A String", # day of week

4021

"booleanValue": True or False, # boolean

4022

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4023

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4024

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4025

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4026

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4027

},

4028

},

4029

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

4030

"integerValue": "A String", # integer

4031

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4032

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4033

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4034

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4035

},

4036

"stringValue": "A String", # string

4037

"timestampValue": "A String", # timestamp

4038

"floatValue": 3.14, # float

4039

"dayOfWeekValue": "A String", # day of week

4040

"booleanValue": True or False, # boolean

4041

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4042

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4043

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4044

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4045

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

4052

},

4053

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

4054

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

4055

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

4056

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

4057

"name": "A String", # Name describing the field.

4058

},

4059

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

4060

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4061

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4062

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4063

},

4064

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4065

"key": "A String", # Required. A 128/192/256 bit key.

4066

},

4067

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4068

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

4069

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

4070

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4071

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4072

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4073

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

4074

},

4075

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

4076

{ # Type of information detected by the API.

4077

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4083

},

4084

],

4085

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that match any suppression rule are omitted from the output.

4086

{ # Configuration to suppress records whose suppression conditions evaluate to true.

4087

"condition": { # A condition for determining whether a transformation should be applied to a field. # A condition that when it evaluates to true will result in the record being evaluated to be suppressed from the transformed content.

4088

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4089

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4090

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

4091

"conditions": [ # A collection of conditions.

4092

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4093

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

4094

"name": "A String", # Name describing the field.

4095

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4096

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4097

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

4098

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4099

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4100

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4101

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4102

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4103

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4104

"stringValue": "A String", # string

4105

"timestampValue": "A String", # timestamp

4106

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4107

"dayOfWeekValue": "A String", # day of week

4108

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4109

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4110

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4111

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4112

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4113

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4114

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

},

},

},

],

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4124

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4125

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4126

"updateMask": "A String", # Mask to control which fields get updated.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4127

}

4128

4129

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

4136

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

4137

{ # DeidentifyTemplates contains instructions on how to de-identify content. See https://cloud.google.com/dlp/docs/concepts-templates to learn more.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4138

"updateTime": "A String", # Output only. The last update timestamp of an inspectTemplate.

4139

"name": "A String", # Output only. The template name. The template will have one of the following formats: `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`

4140

"createTime": "A String", # Output only. The creation timestamp of an inspectTemplate.

4141

"description": "A String", # Short description (max 256 chars).

4142

"displayName": "A String", # Display name (max 256 chars).

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

4143

"deidentifyConfig": { # The configuration that controls how the data will change. # ///////////// // The core content of the template // ///////////////

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4144

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the dataset as free-form text and apply the same free text transformation everywhere.

4145

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

4146

{ # A transformation to apply to text that is identified as a specific info_type.

4147

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4148

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4149

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

4150

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4151

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4152

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4153

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4154

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4155

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4156

"stringValue": "A String", # string

4157

"timestampValue": "A String", # timestamp

4158

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4159

"dayOfWeekValue": "A String", # day of week

4160

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4161

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4162

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4163

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4164

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4165

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4166

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4167

},

4168

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

4169

"integerValue": "A String", # integer

4170

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4171

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4172

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4173

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4174

},

4175

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4176

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4177

"floatValue": 3.14, # float

4178

"dayOfWeekValue": "A String", # day of week

4179

"booleanValue": True or False, # boolean

4180

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4181

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4182

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4183

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4184

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4185

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4186

},

4187

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

4188

},

4189

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

4190

"partToExtract": "A String", # The part of the time to keep.

4191

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

4192

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4193

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

4194

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

4195

},

4196

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

4197

"name": "A String", # Name describing the field.

4198

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

4199

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

4200

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4201

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4202

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4203

},

4204

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4205

"key": "A String", # Required. A 128/192/256 bit key.

4206

},

4207

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4208

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

4209

},

4210

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4211

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4212

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

4213

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

4214

"name": "A String", # Name describing the field.

4215

},

4216

"commonAlphabet": "A String", # Common alphabets.

4217

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

4218

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

4219

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

4220

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

4221

},

4222

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

4223

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4224

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4225

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4226

},

4227

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4228

"key": "A String", # Required. A 128/192/256 bit key.

4229

},

4230

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4231

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

4232

},

4233

},

4234

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4235

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4236

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4237

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4238

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4239

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

4240

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

4241

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

4242

"charactersToSkip": "A String", # Characters to not transform when masking.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame]

4243

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4244

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4245

},

4246

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

4247

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

4248

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4249

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4250

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4251

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4252

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4253

"key": "A String", # Required. A 128/192/256 bit key.

4254

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4255

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4256

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

4257

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4258

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

4259

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4260

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

4261

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

4262

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4263

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4264

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4265

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4266

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

4267

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4268

"stringValue": "A String", # string

4269

"timestampValue": "A String", # timestamp

4270

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4271

"dayOfWeekValue": "A String", # day of week

4272

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4273

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4274

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4275

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4276

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4277

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

4278

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4279

},

4280

},

4281

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

4282

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

4283

{ # Bucket is represented as a range, along with replacement values.

4284

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

4285

"integerValue": "A String", # integer

4286

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4287

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4288

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4289

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4290

},

4291

"stringValue": "A String", # string

4292

"timestampValue": "A String", # timestamp

4293

"floatValue": 3.14, # float

4294

"dayOfWeekValue": "A String", # day of week

4295

"booleanValue": True or False, # boolean

4296

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4297

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4298

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4299

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4300

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4301

},

4302

},

4303

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

4304

"integerValue": "A String", # integer

4305

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4306

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4307

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4308

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4309

},

4310

"stringValue": "A String", # string

4311

"timestampValue": "A String", # timestamp

4312

"floatValue": 3.14, # float

4313

"dayOfWeekValue": "A String", # day of week

4314

"booleanValue": True or False, # boolean

4315

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4316

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4317

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4318

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4319

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4320

},

4321

},

4322

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

4323

"integerValue": "A String", # integer

4324

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4325

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4326

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4327

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4328

},

4329

"stringValue": "A String", # string

4330

"timestampValue": "A String", # timestamp

4331

"floatValue": 3.14, # float

4332

"dayOfWeekValue": "A String", # day of week

4333

"booleanValue": True or False, # boolean

4334

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4335

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4336

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4337

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4338

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

4345

},

4346

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

4347

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

4348

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

4349

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

4350

"name": "A String", # Name describing the field.

4351

},

4352

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

4353

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4354

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4355

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4356

},

4357

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4358

"key": "A String", # Required. A 128/192/256 bit key.

4359

},

4360

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4361

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

4362

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

4363

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4364

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4365

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4366

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4367

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4368

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

4369

{ # Type of information detected by the API.

4370

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A transformation error occurs when the requested transformation is incompatible with the data. For example, trying to de-identify an IP address using a `DateShift` transformation would result in a transformation error, since date info cannot be extracted from an IP address. Information about any incompatible transformations, and how they were handled, is returned in the response as part of the `TransformationOverviews`. # Mode for handling transformation errors. If left unspecified, the default mode is `TransformationErrorHandling.ThrowError`.

4377

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would cause an error. For example, if a `DateShift` transformation were applied an an IP address, this mode would leave the IP address unchanged in the response. # Ignore errors

4378

},

4379

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

4380

},

4381

},

4382

"recordTransformations": { # A type of transformation that is applied over structured data such as a table. # Treat the dataset as structured. Transformations can be applied to specific locations within structured datasets, such as transforming a column within a table.

4383

"fieldTransformations": [ # Transform the record by applying various field transformations.

4384

{ # The transformation to apply to the field.

4385

"condition": { # A condition for determining whether a transformation should be applied to a field. # Only apply the transformation if the condition evaluates to true for the given `RecordCondition`. The conditions are allowed to reference fields that are not used in the actual transformation. Example Use Cases: - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range. - Redact a field if the date of birth field is greater than 85.

4386

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

4387

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

4388

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

4389

"conditions": [ # A collection of conditions.

4390

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

4391

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

4392

"name": "A String", # Name describing the field.

4393

},

4394

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

4395

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

4396

"integerValue": "A String", # integer

4397

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4398

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4399

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4400

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4401

},

4402

"stringValue": "A String", # string

4403

"timestampValue": "A String", # timestamp

4404

"floatValue": 3.14, # float

4405

"dayOfWeekValue": "A String", # day of week

4406

"booleanValue": True or False, # boolean

4407

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4408

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4409

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4410

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4411

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

},

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4419

"fields": [ # Required. Input field(s) to apply the transformation to.

4420

{ # General identifier of a data field in a storage service.

4421

"name": "A String", # Name describing the field.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

4422

},

4423

],

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4424

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

4425

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

4426

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

4427

"integerValue": "A String", # integer

4428

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4429

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4430

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4431

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4432

},

4433

"stringValue": "A String", # string

4434

"timestampValue": "A String", # timestamp

4435

"floatValue": 3.14, # float

4436

"dayOfWeekValue": "A String", # day of week

4437

"booleanValue": True or False, # boolean

4438

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4439

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4440

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4441

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4442

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4443

},

4444

},

4445

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

4446

"integerValue": "A String", # integer

4447

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4448

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4449

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4450

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4451

},

4452

"stringValue": "A String", # string

4453

"timestampValue": "A String", # timestamp

4454

"floatValue": 3.14, # float

4455

"dayOfWeekValue": "A String", # day of week

4456

"booleanValue": True or False, # boolean

4457

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4458

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4459

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4460

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4461

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4462

},

4463

},

4464

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

4465

},

4466

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

4467

"partToExtract": "A String", # The part of the time to keep.

4468

},

4469

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

4470

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

4471

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

4472

},

4473

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

4474

"name": "A String", # Name describing the field.

4475

},

4476

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

4477

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4478

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4479

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4480

},

4481

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4482

"key": "A String", # Required. A 128/192/256 bit key.

4483

},

4484

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4485

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

4490

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

4491

"name": "A String", # Name describing the field.

4492

},

4493

"commonAlphabet": "A String", # Common alphabets.

4494

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

4495

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

4496

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

4497

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

4498

},

4499

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

4500

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4501

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4502

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4503

},

4504

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4505

"key": "A String", # Required. A 128/192/256 bit key.

4506

},

4507

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4508

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

4513

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

4514

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

4515

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

4516

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

4517

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

4518

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

4519

"charactersToSkip": "A String", # Characters to not transform when masking.

},

],

},

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

4524

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

4525

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4526

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4527

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4528

},

4529

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4530

"key": "A String", # Required. A 128/192/256 bit key.

4531

},

4532

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4533

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

4538

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

4539

"integerValue": "A String", # integer

4540

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4541

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4542

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4543

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4544

},

4545

"stringValue": "A String", # string

4546

"timestampValue": "A String", # timestamp

4547

"floatValue": 3.14, # float

4548

"dayOfWeekValue": "A String", # day of week

4549

"booleanValue": True or False, # boolean

4550

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4551

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4552

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4553

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4554

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

4559

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

4560

{ # Bucket is represented as a range, along with replacement values.

4561

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

4562

"integerValue": "A String", # integer

4563

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4564

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4565

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4566

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4567

},

4568

"stringValue": "A String", # string

4569

"timestampValue": "A String", # timestamp

4570

"floatValue": 3.14, # float

4571

"dayOfWeekValue": "A String", # day of week

4572

"booleanValue": True or False, # boolean

4573

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4574

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4575

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4576

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4577

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4578

},

4579

},

4580

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

4581

"integerValue": "A String", # integer

4582

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4583

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4584

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4585

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4586

},

4587

"stringValue": "A String", # string

4588

"timestampValue": "A String", # timestamp

4589

"floatValue": 3.14, # float

4590

"dayOfWeekValue": "A String", # day of week

4591

"booleanValue": True or False, # boolean

4592

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4593

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4594

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4595

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4596

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4597

},

4598

},

4599

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

4600

"integerValue": "A String", # integer

4601

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4602

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4603

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4604

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4605

},

4606

"stringValue": "A String", # string

4607

"timestampValue": "A String", # timestamp

4608

"floatValue": 3.14, # float

4609

"dayOfWeekValue": "A String", # day of week

4610

"booleanValue": True or False, # boolean

4611

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4612

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4613

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4614

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4615

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

4622

},

4623

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

4624

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

4625

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

4626

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

4627

"name": "A String", # Name describing the field.

4628

},

4629

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

4630

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4631

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4632

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4633

},

4634

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4635

"key": "A String", # Required. A 128/192/256 bit key.

4636

},

4637

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4638

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

4643

},

4644

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

4645

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific info_type. # Treat the contents of the field as free text, and selectively transform content that matches an `InfoType`.

4646

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one for a given infoType.

4647

{ # A transformation to apply to text that is identified as a specific info_type.

4648

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4649

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies. The transformed value will be a hyphenated string of {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20 all values that are within this bucket will be replaced with "10-20". This can be used on data of type: double, long. If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Fixed size bucketing

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4650

"lowerBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Lower bound value of buckets. All values less than `lower_bound` are grouped together into a single bucket; for example if `lower_bound` = 10, then all values less than 10 are replaced with the value "-10".

4651

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4652

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4653

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4654

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4655

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4656

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4657

"stringValue": "A String", # string

4658

"timestampValue": "A String", # timestamp

4659

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4660

"dayOfWeekValue": "A String", # day of week

4661

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4662

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4663

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4664

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4665

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4666

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4667

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4668

},

4669

"upperBound": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if `upper_bound` = 89, then all values greater than 89 are replaced with the value "89+".

4670

"integerValue": "A String", # integer

4671

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4672

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4673

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4674

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4675

},

4676

"stringValue": "A String", # string

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4677

"timestampValue": "A String", # timestamp

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4678

"floatValue": 3.14, # float

4679

"dayOfWeekValue": "A String", # day of week

4680

"booleanValue": True or False, # boolean

4681

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4682

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4683

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4684

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4685

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4686

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4687

},

4688

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

4689

},

4690

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value. # Time extraction

4691

"partToExtract": "A String", # The part of the time to keep.

4692

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

4693

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297. # Deterministic Crypto

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4694

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE.

4695

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

4696

},

4697

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s.

4698

"name": "A String", # Name describing the field.

4699

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

4700

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the encryption function.

4701

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4702

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4703

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4704

},

4705

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4706

"key": "A String", # Required. A 128/192/256 bit key.

4707

},

4708

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4709

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

4710

},

4711

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4712

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4713

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `ReidentifyContent` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. # Ffx-Fpe

4714

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 1. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and non-structured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2

4715

"name": "A String", # Name describing the field.

4716

},

4717

"commonAlphabet": "A String", # Common alphabets.

4718

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

4719

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 95]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: 0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/

4720

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

4721

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

4722

},

4723

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Required. The key used by the encryption algorithm.

4724

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4725

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4726

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4727

},

4728

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4729

"key": "A String", # Required. A 128/192/256 bit key.

4730

},

4731

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4732

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

4733

},

4734

},

4735

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4736

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like **3. # Mask

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4737

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order` is `true`, then the string `12345` is masked as `12***`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4738

"maskingCharacter": "A String", # Character to use to mask the sensitive values—for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4739

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4740

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`.

4741

{ # Characters to skip when doing deidentification of a value. These will be left alone and skipped.

4742

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing punctuation.

4743

"charactersToSkip": "A String", # Characters to not transform when masking.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

4744

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4745

],

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4746

},

4747

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See https://cloud.google.com/dlp/docs/pseudonymization to learn more. # Crypto

4748

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # The key used by the hash function.

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

4749

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4750

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4751

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4752

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4753

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4754

"key": "A String", # Required. A 128/192/256 bit key.

4755

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4756

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4757

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

4758

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4759

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

4760

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4761

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

4762

"newValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to replace it with.

4763

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4764

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4765

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4766

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4767

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

4768

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4769

"stringValue": "A String", # string

4770

"timestampValue": "A String", # timestamp

4771

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4772

"dayOfWeekValue": "A String", # day of week

4773

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4774

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4775

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4776

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4777

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4778

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

4779

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4780

},

4781

},

4782

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH This can be used on data of type: number, long, string, timestamp. If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more. # Bucketing

4783

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

4784

{ # Bucket is represented as a range, along with replacement values.

4785

"max": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Upper bound of the range, exclusive; type must match min.

4786

"integerValue": "A String", # integer

4787

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4788

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4789

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4790

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4791

},

4792

"stringValue": "A String", # string

4793

"timestampValue": "A String", # timestamp

4794

"floatValue": 3.14, # float

4795

"dayOfWeekValue": "A String", # day of week

4796

"booleanValue": True or False, # boolean

4797

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4798

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4799

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4800

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4801

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4802

},

4803

},

4804

"replacementValue": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Required. Replacement value for this bucket.

4805

"integerValue": "A String", # integer

4806

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4807

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4808

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4809

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4810

},

4811

"stringValue": "A String", # string

4812

"timestampValue": "A String", # timestamp

4813

"floatValue": 3.14, # float

4814

"dayOfWeekValue": "A String", # day of week

4815

"booleanValue": True or False, # boolean

4816

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4817

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4818

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4819

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4820

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4821

},

4822

},

4823

"min": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Lower bound of the range, inclusive. Type should be the same as max if used.

4824

"integerValue": "A String", # integer

4825

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4826

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

4827

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

4828

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

4829

},

4830

"stringValue": "A String", # string

4831

"timestampValue": "A String", # timestamp

4832

"floatValue": 3.14, # float

4833

"dayOfWeekValue": "A String", # day of week

4834

"booleanValue": True or False, # boolean

4835

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

4836

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

4837

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4838

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4839

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

},

},

},

],

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

4846

},

4847

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting to learn more. # Date Shift

4848

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future.

4849

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

4850

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context.

4851

"name": "A String", # Name describing the field.

4852

},

4853

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by KMS). When using KMS to wrap/unwrap DEKs, be sure to set an appropriate IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot unwrap the data crypto key. # Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key. If set, must also set context. Can only be applied to table items.

4854

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128/192/256 bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a kms-wrapped crypto key: dlp.kms.encrypt # Kms wrapped key

4855

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4856

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4857

},

4858

"unwrapped": { # Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible. # Unwrapped crypto key

4859

"key": "A String", # Required. A 128/192/256 bit key.

4860

},

4861

"transient": { # Use this to have a random data crypto key generated. It will be discarded after the request finishes. # Transient crypto key

4862

"name": "A String", # Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated).

4863

},

Yoshi Automation Bot

2020-11-24 15:48:03 -0800

[diff] [blame]

4864

},

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4865

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4866

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '. # Redact

Bu Sun Kim

2020-11-16 11:05:03 -0700

[diff] [blame]

4867

},

Dmitry Frenkel

2020-10-06 16:46:05 -0700

[diff] [blame]

4868

},

4869

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`.

4870

{ # Type of information detected by the API.

4871

"name": "A String", # Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. When sending Cloud DLP results to Data Catalog, infoType names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

},

],

},

],

},

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4877

},

4878

],

4879

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that match any suppression rule are omitted from the output.

4880

{ # Configuration to suppress records whose suppression conditions evaluate to true.

4881

"condition": { # A condition for determining whether a transformation should be applied to a field. # A condition that when it evaluates to true will result in the record being evaluated to be suppressed from the transformed content.

4882

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4883

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently only supported value is `AND`.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4884

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

4885

"conditions": [ # A collection of conditions.

4886

{ # The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type: - `string` can be compared against all other types - `boolean` can only be compared against other booleans - `integer` can be compared against doubles or a string if the string value can be parsed as an integer. - `double` can be compared against integers or a string if the string can be parsed as a double. - `Timestamp` can be compared against strings in RFC 3339 date string format. - `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'. If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4887

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

4888

"name": "A String", # Name describing the field.

4889

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4890

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4891

"value": { # Set of primitive values supported by the system. Note that for the purposes of inspection or transformation, the number of bytes considered to comprise a 'Value' is based on its representation as a UTF-8 encoded string. For example, if 'integer_value' is set to 123456789, the number of bytes would be counted as 9, even though an int64 only holds up to 8 bytes of data. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

4892

"integerValue": "A String", # integer

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4893

"dateValue": { # Represents a whole or partial calendar date, such as a birthday. The time of day and time zone are either specified elsewhere or are insignificant. The date is relative to the Gregorian Calendar. This can represent one of the following: * A full date, with non-zero year, month, and day values * A month and day value, with a zero year, such as an anniversary * A year on its own, with zero month and day values * A year and month value, with a zero day, such as a credit card expiration date Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`. # date

4894

"month": 42, # Month of a year. Must be from 1 to 12, or 0 to specify a year without a month and day.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4895

"day": 42, # Day of a month. Must be from 1 to 31 and valid for the year and month, or 0 to specify a year by itself or a year and month where the day isn't significant.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4896

"year": 42, # Year of the date. Must be from 1 to 9999, or 0 to specify a date without a year.

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4897

},

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4898

"stringValue": "A String", # string

4899

"timestampValue": "A String", # timestamp

4900

"floatValue": 3.14, # float

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4901

"dayOfWeekValue": "A String", # day of week

4902

"booleanValue": True or False, # boolean

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4903

"timeValue": { # Represents a time of day. The date and time zone are either not significant or are specified elsewhere. An API may choose to allow leap seconds. Related types are google.type.Date and `google.protobuf.Timestamp`. # time of day

Yoshi Automation Bot

2020-11-25 07:50:41 -0800

[diff] [blame]

4904

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose to allow the value "24:00:00" for scenarios like business closing time.

Yoshi Automation Bot

2020-11-26 17:16:03 -0800

[diff] [blame^]

4905

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4906

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may allow the value 60 if it allows leap-seconds.

4907

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Yoshi Automation Bot