Blame - docs/dyn/dlp_v2.projects.content.html - platform/external/python/google-api-python-client

2020-05-01 07:42:23 -0700

[diff] [blame]

78

<code><a href="#deidentify">deidentify(parent, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

79

<p class="firstline">De-identifies potentially sensitive info from a ContentItem.</p>

80

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

81

<code><a href="#inspect">inspect(parent, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

82

<p class="firstline">Finds potentially sensitive info in content.</p>

83

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

84

<code><a href="#reidentify">reidentify(parent, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

85

<p class="firstline">Re-identifies content that has been de-identified.</p>

86

<h3>Method Details</h3>

87

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

88

<code class="details" id="deidentify">deidentify(parent, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

89

<pre>De-identifies potentially sensitive info from a ContentItem.

90

This method has limits on input size and output size.

91

See https://cloud.google.com/dlp/docs/deidentify-sensitive-data to

92

learn more.

93

94

When no InfoTypes or CustomInfoTypes are specified in this request, the

95

system will automatically choose what detectors to run. By default this may

96

be all types, but may change over time as detectors are updated.

97

98

Args:

99

parent: string, The parent resource name, for example projects/my-project-id. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

100

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

101

The object takes the form of:

102

103

{ # Request to de-identify a list of items.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

104

"item": { # Container structure for the content to inspect. # The item to de-identify. Will be treated as text.

105

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

106

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

107

"data": "A String", # Content data to inspect or redact.

108

},

109

"value": "A String", # String data to inspect or redact.

110

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

111

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

112

# learn more.

113

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

114

# learn more.

115

"rows": [ # Rows of the table.

116

{ # Values of the row.

117

"values": [ # Individual cells.

118

{ # Set of primitive values supported by the system.

119

# Note that for the purposes of inspection or transformation, the number

120

# of bytes considered to comprise a 'Value' is based on its representation

121

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

122

# 123456789, the number of bytes would be counted as 9, even though an

123

# int64 only holds up to 8 bytes of data.

124

"booleanValue": True or False, # boolean

125

"floatValue": 3.14, # float

126

"dayOfWeekValue": "A String", # day of week

127

"timestampValue": "A String", # timestamp

128

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

129

# and time zone are either specified elsewhere or are not significant. The date

130

# is relative to the Proleptic Gregorian Calendar. This can represent:

131

#

132

# * A full date, with non-zero year, month and day values

133

# * A month and day value, with a zero year, e.g. an anniversary

134

# * A year on its own, with zero month and day values

135

# * A year and month value, with a zero day, e.g. a credit card expiration date

136

#

137

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

138

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

139

# a year.

140

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

141

# month and day.

142

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

143

# if specifying a year by itself or a year and month where the day is not

144

# significant.

145

},

146

"stringValue": "A String", # string

147

"integerValue": "A String", # integer

148

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

149

# or are specified elsewhere. An API may choose to allow leap seconds. Related

150

# types are google.type.Date and `google.protobuf.Timestamp`.

151

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

152

# allow the value 60 if it allows leap-seconds.

153

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

154

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

155

# to allow the value "24:00:00" for scenarios like business closing time.

156

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

],

},

],

"headers": [ # Headers of the table.

163

{ # General identifier of a data field in a storage service.

164

"name": "A String", # Name describing the field.

},

],

},

},

"inspectTemplateName": "A String", # Template to use. Any configuration directly specified in

170

# inspect_config will override those set in the template. Singular fields

171

# that are set in this request will replace their corresponding fields in the

172

# template. Repeated fields are appended. Singular sub-messages and groups

173

# are recursively merged.

174

"deidentifyTemplateName": "A String", # Template to use. Any configuration directly specified in

175

# deidentify_config will override those set in the template. Singular fields

176

# that are set in this request will replace their corresponding fields in the

177

# template. Repeated fields are appended. Singular sub-messages and groups

178

# are recursively merged.

179

"inspectConfig": { # Configuration description of the scanning process. # Configuration for the inspector.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

180

# Items specified here will override the template referenced by the

181

# inspect_template_name argument.

182

# When used with redactContent only info_types and min_likelihood are currently

183

# used.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

184

"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is

185

# included in the response; see Finding.quote.

186

"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig.

187

# Exclusion rules, contained in the set are executed in the end, other

188

# rules are executed in the order they are specified for each info type.

189

{ # Rule set for modifying a set of infoTypes to alter behavior under certain

190

# circumstances, depending on the specific details of the rules within the set.

191

"infoTypes": [ # List of infoTypes this rule set is applied to.

192

{ # Type of information detected by the API.

193

"name": "A String", # Name of the information type. Either a name of your choosing when

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

194

# creating a CustomInfoType, or one of the names listed

195

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

196

# a built-in type. InfoType names should conform to the pattern

197

# `[a-zA-Z0-9_]{1,64}`.

198

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

199

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

200

"rules": [ # Set of rules to be applied to infoTypes. The rules are applied in order.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

201

{ # A single inspection rule to be applied to infoTypes, specified in

202

# `InspectionRuleSet`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

203

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

204

# proximity of hotwords.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

205

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

206

# part of a detection rule.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

207

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

208

# levels. For example, if a finding would be `POSSIBLE` without the

209

# detection rule and `relative_likelihood` is 1, then it is upgraded to

210

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

211

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

212

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

213

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

214

# a final likelihood of `LIKELY`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

215

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

216

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

217

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

218

"groupIndexes": [ # The index of the submatch to extract as findings. When not

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

219

# specified, the entire match is returned. No more than 3 may be included.

220

42,

221

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

222

"pattern": "A String", # Pattern defining the regular expression. Its syntax

223

# (https://github.com/google/re2/wiki/Syntax) can be found under the

224

# google/re2 repository on GitHub.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

225

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

226

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

227

# The total length of the window cannot exceed 1000 characters. Note that

228

# the finding itself will be included in the window, so that hotwords may

229

# be used to match substrings of the finding itself. For example, the

230

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

231

# adjusted upwards if the area code is known to be the local area code of

232

# a company office using the hotword regex "\(xxx\)", where "xxx"

233

# is the area code in question.

234

# rule.

235

"windowBefore": 42, # Number of characters before the finding to consider.

236

"windowAfter": 42, # Number of characters after the finding to consider.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

237

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

238

},

239

"exclusionRule": { # The rule that specifies conditions when findings of infoTypes specified in # Exclusion rule.

240

# `InspectionRuleSet` are removed from results.

241

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # Dictionary which defines the rule.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

242

# be used to match sensitive information specific to the data, such as a list

243

# of employee IDs or job titles.

244

#

245

# Dictionary words are case-insensitive and all characters other than letters

246

# and digits in the unicode [Basic Multilingual

247

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

248

# will be replaced with whitespace when scanning for matches, so the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

249

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

250

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

251

# surrounding any match must be of a different type than the adjacent

252

# characters within the word, so letters must be next to non-letters and

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

253

# digits next to non-digits. For example, the dictionary word "jen" will

254

# match the first three letters of the text "jen123" but will return no

255

# matches for "jennifer".

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

256

#

257

# Dictionary words containing a large number of characters that are not

258

# letters or digits may result in unexpected findings because such characters

259

# are treated as whitespace. The

260

# [limits](https://cloud.google.com/dlp/limits) page contains details about

261

# the size limits of dictionaries. For dictionaries that do not fit within

262

# these constraints, consider using `LargeCustomDictionaryConfig` in the

263

# `StoredInfoType` API.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

264

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

265

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

266

# at least one phrase and every phrase must contain at least 2 characters

267

# that are letters or digits. [required]

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

268

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

269

],

270

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

271

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

272

# is accepted.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

273

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

274

# Example: gs://[BUCKET_NAME]/dictionary.txt

275

},

276

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

277

"regex": { # Message defining a custom regular expression. # Regular expression which defines the rule.

278

"groupIndexes": [ # The index of the submatch to extract as findings. When not

279

# specified, the entire match is returned. No more than 3 may be included.

280

42,

281

],

282

"pattern": "A String", # Pattern defining the regular expression. Its syntax

283

# (https://github.com/google/re2/wiki/Syntax) can be found under the

284

# google/re2 repository on GitHub.

285

},

286

"excludeInfoTypes": { # List of exclude infoTypes. # Set of infoTypes for which findings would affect this rule.

287

"infoTypes": [ # InfoType list in ExclusionRule rule drops a finding when it overlaps or

288

# contained within with a finding of an infoType from this list. For

289

# example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and

290

# `exclusion_rule` containing `exclude_info_types.info_types` with

291

# "EMAIL_ADDRESS" the phone number findings are dropped if they overlap

292

# with EMAIL_ADDRESS finding.

293

# That leads to "555-222-2222@example.org" to generate only a single

294

# finding, namely email address.

295

{ # Type of information detected by the API.

296

"name": "A String", # Name of the information type. Either a name of your choosing when

297

# creating a CustomInfoType, or one of the names listed

298

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

299

# a built-in type. InfoType names should conform to the pattern

300

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

"matchingType": "A String", # How the rule is applied, see MatchingType documentation for details.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

305

},

306

},

307

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

308

},

309

],

310

"limits": { # Configuration to control the number of findings returned. # Configuration to control the number of findings returned.

311

"maxFindingsPerItem": 42, # Max number of findings that will be returned for each item scanned.

312

# When set within `InspectJobConfig`,

313

# the maximum returned is 2000 regardless if this is set higher.

314

# When set within `InspectContentRequest`, this field is ignored.

315

"maxFindingsPerInfoType": [ # Configuration of findings limit given for specified infoTypes.

316

{ # Max findings configuration per infoType, per content item or long

317

# running DlpJob.

318

"maxFindings": 42, # Max findings limit for the given infoType.

319

"infoType": { # Type of information detected by the API. # Type of information the findings limit applies to. Only one limit per

320

# info_type should be provided. If InfoTypeLimit does not have an

321

# info_type, the DLP API applies the limit against all info_types that

322

# are found but not specified in another InfoTypeLimit.

323

"name": "A String", # Name of the information type. Either a name of your choosing when

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

324

# creating a CustomInfoType, or one of the names listed

325

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

326

# a built-in type. InfoType names should conform to the pattern

327

# `[a-zA-Z0-9_]{1,64}`.

328

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

329

},

330

],

331

"maxFindingsPerRequest": 42, # Max number of findings that will be returned per request/job.

332

# When set within `InspectContentRequest`, the maximum returned is 2000

333

# regardless if this is set higher.

334

},

335

"contentOptions": [ # List of options defining data content to scan.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

336

# If empty, text, images, and other content will be included.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

337

"A String",

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

338

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

339

"infoTypes": [ # Restricts what info_types to look for. The values must correspond to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

340

# InfoType values returned by ListInfoTypes or listed at

341

# https://cloud.google.com/dlp/docs/infotypes-reference.

342

#

343

# When no InfoTypes or CustomInfoTypes are specified in a request, the

344

# system may automatically choose what detectors to run. By default this may

345

# be all types, but may change over time as detectors are updated.

346

#

347

# If you need precise control and predictability as to what detectors are

348

# run you should specify specific InfoTypes listed in the reference,

349

# otherwise a default list will be used, which may change over time.

350

{ # Type of information detected by the API.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

351

"name": "A String", # Name of the information type. Either a name of your choosing when

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

352

# creating a CustomInfoType, or one of the names listed

353

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

354

# a built-in type. InfoType names should conform to the pattern

355

# `[a-zA-Z0-9_]{1,64}`.

356

},

357

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

358

"minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is

359

# POSSIBLE.

360

# See https://cloud.google.com/dlp/docs/likelihood to learn more.

361

"excludeInfoTypes": True or False, # When true, excludes type information of the findings.

362

"customInfoTypes": [ # CustomInfoTypes provided by the user. See

363

# https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

364

{ # Custom information type provided by the user. Used to find domain-specific

365

# sensitive information configurable to the data in question.

366

"likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be

367

# altered by a detection rule if the finding meets the criteria specified by

368

# the rule. Defaults to `VERY_LIKELY` if not specified.

369

"infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in

370

# infoType, when the name matches one of existing infoTypes and that infoType

371

# is specified in `InspectContent.info_types` field. Specifying the latter

372

# adds findings to the one detected by the system. If built-in info type is

373

# not specified in `InspectContent.info_types` list then the name is treated

374

# as a custom info type.

375

"name": "A String", # Name of the information type. Either a name of your choosing when

376

# creating a CustomInfoType, or one of the names listed

377

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

378

# a built-in type. InfoType names should conform to the pattern

379

# `[a-zA-Z0-9_]{1,64}`.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

380

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

381

"regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.

382

"groupIndexes": [ # The index of the submatch to extract as findings. When not

383

# specified, the entire match is returned. No more than 3 may be included.

384

42,

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

385

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

386

"pattern": "A String", # Pattern defining the regular expression. Its syntax

387

# (https://github.com/google/re2/wiki/Syntax) can be found under the

388

# google/re2 repository on GitHub.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

389

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

390

"detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.

391

# Rules are applied in order that they are specified. Not supported for the

392

# `surrogate_type` CustomInfoType.

393

{ # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a

394

# `CustomInfoType` to alter behavior under certain circumstances, depending

395

# on the specific details of the rule. Not supported for the `surrogate_type`

396

# custom infoType.

397

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

398

# proximity of hotwords.

399

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

400

# part of a detection rule.

401

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

402

# levels. For example, if a finding would be `POSSIBLE` without the

403

# detection rule and `relative_likelihood` is 1, then it is upgraded to

404

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

405

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

406

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

407

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

408

# a final likelihood of `LIKELY`.

409

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

410

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

411

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

412

"groupIndexes": [ # The index of the submatch to extract as findings. When not

413

# specified, the entire match is returned. No more than 3 may be included.

414

42,

415

],

416

"pattern": "A String", # Pattern defining the regular expression. Its syntax

417

# (https://github.com/google/re2/wiki/Syntax) can be found under the

418

# google/re2 repository on GitHub.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

419

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

420

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

421

# The total length of the window cannot exceed 1000 characters. Note that

422

# the finding itself will be included in the window, so that hotwords may

423

# be used to match substrings of the finding itself. For example, the

424

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

425

# adjusted upwards if the area code is known to be the local area code of

426

# a company office using the hotword regex "\(xxx\)", where "xxx"

427

# is the area code in question.

428

# rule.

429

"windowBefore": 42, # Number of characters before the finding to consider.

430

"windowAfter": 42, # Number of characters after the finding to consider.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

431

},

432

},

433

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

434

],

435

"exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding

436

# to be returned. It still can be used for rules matching.

437

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.

438

# be used to match sensitive information specific to the data, such as a list

439

# of employee IDs or job titles.

440

#

441

# Dictionary words are case-insensitive and all characters other than letters

442

# and digits in the unicode [Basic Multilingual

443

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

444

# will be replaced with whitespace when scanning for matches, so the

445

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

446

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

447

# surrounding any match must be of a different type than the adjacent

448

# characters within the word, so letters must be next to non-letters and

449

# digits next to non-digits. For example, the dictionary word "jen" will

450

# match the first three letters of the text "jen123" but will return no

451

# matches for "jennifer".

452

#

453

# Dictionary words containing a large number of characters that are not

454

# letters or digits may result in unexpected findings because such characters

455

# are treated as whitespace. The

456

# [limits](https://cloud.google.com/dlp/limits) page contains details about

457

# the size limits of dictionaries. For dictionaries that do not fit within

458

# these constraints, consider using `LargeCustomDictionaryConfig` in the

459

# `StoredInfoType` API.

460

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

461

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

462

# at least one phrase and every phrase must contain at least 2 characters

463

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

468

# is accepted.

469

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

470

# Example: gs://[BUCKET_NAME]/dictionary.txt

471

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

472

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

473

"storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in

474

# `InspectDataSource`. Not currently supported in `InspectContent`.

475

"name": "A String", # Resource name of the requested `StoredInfoType`, for example

476

# `organizations/433245324/storedInfoTypes/432452342` or

477

# `projects/project-id/storedInfoTypes/432452342`.

478

"createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for

479

# inspection was created. Output-only field, populated by the system.

480

},

481

"surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that

482

# support reversing.

483

# such as

484

# [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).

485

# These types of transformations are

486

# those that perform pseudonymization, thereby producing a "surrogate" as

487

# output. This should be used in conjunction with a field on the

488

# transformation such as `surrogate_info_type`. This CustomInfoType does

489

# not support the use of `detection_rules`.

},

},

],

},

"deidentifyConfig": { # The configuration that controls how the data will change. # Configuration for the de-identification of the content item.

495

# Items specified here will override the template referenced by the

496

# deidentify_template_name argument.

497

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default

498

# mode is `TransformationErrorHandling.ThrowError`.

499

# transformation error occurs when the requested transformation is incompatible

500

# with the data. For example, trying to de-identify an IP address using a

501

# `DateShift` transformation would result in a transformation error, since date

502

# info cannot be extracted from an IP address.

503

# Information about any incompatible transformations, and how they were

504

# handled, is returned in the response as part of the

505

# `TransformationOverviews`.

506

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

507

},

508

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would # Ignore errors

509

# cause an error. For example, if a `DateShift` transformation were applied

510

# an an IP address, this mode would leave the IP address unchanged in the

511

# response.

512

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

513

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

514

"recordTransformations": { # A type of transformation that is applied over structured data such as a # Treat the dataset as structured. Transformations can be applied to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

515

# specific locations within structured datasets, such as transforming

516

# a column within a table.

517

# table.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

518

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

519

# match any suppression rule are omitted from the output.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

520

{ # Configuration to suppress records whose suppression conditions evaluate to

521

# true.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

522

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

523

# evaluated to be suppressed from the transformed content.

524

# a field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

525

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

526

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

527

# only supported value is `AND`.

528

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

529

"conditions": [ # A collection of conditions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

530

{ # The field type of `value` and `field` do not need to match to be

531

# considered equal, but not all comparisons are possible.

532

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

533

# but all other comparisons are invalid with incompatible types.

534

# A `value` of type:

535

#

536

# - `string` can be compared against all other types

537

# - `boolean` can only be compared against other booleans

538

# - `integer` can be compared against doubles or a string if the string value

539

# can be parsed as an integer.

540

# - `double` can be compared against integers or a string if the string can

541

# be parsed as a double.

542

# - `Timestamp` can be compared against strings in RFC 3339 date string

543

# format.

544

# - `TimeOfDay` can be compared against timestamps and strings in the format

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

545

# of 'HH:mm:ss'.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

546

#

547

# If we fail to compare do to type mismatch, a warning will be given and

548

# the condition will evaluate to false.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

549

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

550

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

551

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

552

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

553

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

554

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

555

# of bytes considered to comprise a 'Value' is based on its representation

556

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

557

# 123456789, the number of bytes would be counted as 9, even though an

558

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

559

"booleanValue": True or False, # boolean

560

"floatValue": 3.14, # float

561

"dayOfWeekValue": "A String", # day of week

562

"timestampValue": "A String", # timestamp

563

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

564

# and time zone are either specified elsewhere or are not significant. The date

565

# is relative to the Proleptic Gregorian Calendar. This can represent:

566

#

567

# * A full date, with non-zero year, month and day values

568

# * A month and day value, with a zero year, e.g. an anniversary

569

# * A year on its own, with zero month and day values

570

# * A year and month value, with a zero day, e.g. a credit card expiration date

571

#

572

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

573

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

574

# a year.

575

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

576

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

577

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

578

# if specifying a year by itself or a year and month where the day is not

579

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

580

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

581

"stringValue": "A String", # string

582

"integerValue": "A String", # integer

583

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

584

# or are specified elsewhere. An API may choose to allow leap seconds. Related

585

# types are google.type.Date and `google.protobuf.Timestamp`.

586

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

587

# allow the value 60 if it allows leap-seconds.

588

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

589

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

590

# to allow the value "24:00:00" for scenarios like business closing time.

591

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

592

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

},

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

601

"fieldTransformations": [ # Transform the record by applying various field transformations.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

602

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

603

"fields": [ # Required. Input field(s) to apply the transformation to.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

604

{ # General identifier of a data field in a storage service.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

605

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

606

},

607

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

608

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

609

# transform content that matches an `InfoType`.

610

# apply various `PrimitiveTransformation`s to each finding, where the

611

# transformation is applied to only values that were identified as a specific

612

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

613

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

614

# for a given infoType.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

615

{ # A transformation to apply to text that is identified as a specific

616

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

617

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

618

# this transformation to apply to all findings that correspond to

619

# infoTypes that were requested in `InspectConfig`.

620

{ # Type of information detected by the API.

621

"name": "A String", # Name of the information type. Either a name of your choosing when

622

# creating a CustomInfoType, or one of the names listed

623

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

624

# a built-in type. InfoType names should conform to the pattern

625

# `[a-zA-Z0-9_]{1,64}`.

626

},

627

],

628

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

629

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

630

# portion of the value.

631

"partToExtract": "A String", # The part of the time to keep.

632

},

633

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

634

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

635

# to learn more.

636

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

637

# If set, must also set cryptoKey. If set, shift will be consistent for the

638

# given context.

639

"name": "A String", # Name describing the field.

640

},

641

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

642

# range (inclusive ends). Negative means shift to earlier in time. Must not

643

# be more than 365250 days (1000 years) each direction.

644

#

645

# For example, 3 means shift date to at most 3 days into the future.

646

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

647

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

648

# results in the same shift for the same context and crypto_key. If

649

# set, must also set context. Can only be applied to table items.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

650

# a key encryption key (KEK) stored by KMS).

651

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

652

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

653

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

654

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

655

# The wrapped key must be a 128/192/256 bit key.

656

# Authorization requires the following IAM permissions when sending a request

657

# to perform a crypto transformation using a kms-wrapped crypto key:

658

# dlp.kms.encrypt

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

659

"wrappedKey": "A String", # Required. The wrapped data crypto key.

660

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

661

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

662

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

663

# leaking the key. Choose another type of key if possible.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

664

"key": "A String", # Required. A 128/192/256 bit key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

665

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

666

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

667

# It will be discarded after the request finishes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

668

"name": "A String", # Required. Name of the key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

669

# This is an arbitrary string used to differentiate different keys.

670

# A unique key is generated per name: two separate `TransientCryptoKey`

671

# protos share the same generated key if their names are the same.

672

# When the data crypto key is generated, this name is not used in any way

673

# (repeating the api call will result in a different key being generated).

674

},

675

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

676

},

677

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

678

},

679

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

680

# Uses SHA-256.

681

# The key size must be either 32 or 64 bytes.

682

# Outputs a base64 encoded representation of the hashed output

683

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

684

# Currently, only string and integer values can be hashed.

685

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

686

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

687

# a key encryption key (KEK) stored by KMS).

688

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

689

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

690

# unwrap the data crypto key.

691

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

692

# The wrapped key must be a 128/192/256 bit key.

693

# Authorization requires the following IAM permissions when sending a request

694

# to perform a crypto transformation using a kms-wrapped crypto key:

695

# dlp.kms.encrypt

696

"wrappedKey": "A String", # Required. The wrapped data crypto key.

697

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

698

},

699

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

700

# leaking the key. Choose another type of key if possible.

701

"key": "A String", # Required. A 128/192/256 bit key.

702

},

703

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

704

# It will be discarded after the request finishes.

705

"name": "A String", # Required. Name of the key.

706

# This is an arbitrary string used to differentiate different keys.

707

# A unique key is generated per name: two separate `TransientCryptoKey`

708

# protos share the same generated key if their names are the same.

709

# When the data crypto key is generated, this name is not used in any way

710

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

715

# (FPE) with the FFX mode of operation; however when used in the

716

# `ReidentifyContent` API method, it serves the opposite function by reversing

717

# the surrogate back into the original identifier. The identifier must be

718

# encoded as ASCII. For a given crypto key and context, the same identifier

719

# will be replaced with the same surrogate. Identifiers must be at least two

720

# characters long. In the case that the identifier is the empty string, it will

721

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

722

# more.

723

#

724

# Note: We recommend using CryptoDeterministicConfig for all use cases which

725

# do not require preserving the input alphabet space and size, plus warrant

726

# referential integrity.

727

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

728

# that the FFX mode natively supports. This happens before/after

729

# encryption/decryption.

730

# Each character listed must appear only once.

731

# Number of characters must be in the range [2, 95].

732

# This must be encoded as ASCII.

733

# The order of characters does not matter.

734

"commonAlphabet": "A String", # Common alphabets.

735

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

736

# This annotation will be applied to the surrogate by prefixing it with

737

# the name of the custom infoType followed by the number of

738

# characters comprising the surrogate. The following scheme defines the

739

# format: info_type_name(surrogate_character_count):surrogate

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

740

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

741

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

742

# the surrogate is 'abc', the full replacement value

743

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

744

#

745

# This annotation identifies the surrogate when inspecting content using the

746

# custom infoType

747

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

748

# This facilitates reversal of the surrogate when it occurs in free text.

749

#

750

# In order for inspection to work properly, the name of this infoType must

751

# not occur naturally anywhere in your data; otherwise, inspection may

752

# find a surrogate that does not correspond to an actual identifier.

753

# Therefore, choose your custom infoType name carefully after considering

754

# what your data looks like. One way to select a name that has a high chance

755

# of yielding reliable detection is to include one or more unicode characters

756

# that are highly improbable to exist in your data.

757

# For example, assuming your data is entered from a regular ASCII keyboard,

758

# the symbol with the hex code point 29DD might be used like so:

759

# ⧝MY_TOKEN_TYPE

760

"name": "A String", # Name of the information type. Either a name of your choosing when

761

# creating a CustomInfoType, or one of the names listed

762

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

763

# a built-in type. InfoType names should conform to the pattern

764

# `[a-zA-Z0-9_]{1,64}`.

765

},

766

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

767

# identifier in two different contexts won't be given the same surrogate. If

768

# the context is not set, a default tweak will be used.

769

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

770

# If the context is set but:

771

#

772

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

773

# 1. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

774

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

775

# a default tweak will be used.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

776

#

777

# Note that case (1) is expected when an `InfoTypeTransformation` is

778

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

779

# Currently, the referenced field may be of value type integer or string.

780

#

781

# The tweak is constructed as a sequence of bytes in big endian byte order

782

# such that:

783

#

784

# - a 64 bit integer is encoded followed by a single byte of value 1

785

# - a string is encoded in UTF-8 format followed by a single byte of value 2

786

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

787

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

788

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

789

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

790

# a key encryption key (KEK) stored by KMS).

791

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

792

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

793

# unwrap the data crypto key.

794

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

795

# The wrapped key must be a 128/192/256 bit key.

796

# Authorization requires the following IAM permissions when sending a request

797

# to perform a crypto transformation using a kms-wrapped crypto key:

798

# dlp.kms.encrypt

799

"wrappedKey": "A String", # Required. The wrapped data crypto key.

800

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

801

},

802

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

803

# leaking the key. Choose another type of key if possible.

804

"key": "A String", # Required. A 128/192/256 bit key.

805

},

806

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

807

# It will be discarded after the request finishes.

808

"name": "A String", # Required. Name of the key.

809

# This is an arbitrary string used to differentiate different keys.

810

# A unique key is generated per name: two separate `TransientCryptoKey`

811

# protos share the same generated key if their names are the same.

812

# When the data crypto key is generated, this name is not used in any way

813

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

818

# input. Outputs a base64 encoded representation of the encrypted output.

819

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

820

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

821

# This annotation will be applied to the surrogate by prefixing it with

822

# the name of the custom info type followed by the number of

823

# characters comprising the surrogate. The following scheme defines the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

824

# format: {info type name}({surrogate character count}):{surrogate}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

825

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

826

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

827

# the surrogate is 'abc', the full replacement value

828

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

829

#

830

# This annotation identifies the surrogate when inspecting content using the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

831

# custom info type 'Surrogate'. This facilitates reversal of the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

832

# surrogate when it occurs in free text.

833

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

834

# Note: For record transformations where the entire cell in a table is being

835

# transformed, surrogates are not mandatory. Surrogates are used to denote

836

# the location of the token and are necessary for re-identification in free

837

# form text.

838

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

839

# In order for inspection to work properly, the name of this info type must

840

# not occur naturally anywhere in your data; otherwise, inspection may either

841

#

842

# - reverse a surrogate that does not correspond to an actual identifier

843

# - be unable to parse the surrogate and result in an error

844

#

845

# Therefore, choose your custom info type name carefully after considering

846

# what your data looks like. One way to select a name that has a high chance

847

# of yielding reliable detection is to include one or more unicode characters

848

# that are highly improbable to exist in your data.

849

# For example, assuming your data is entered from a regular ASCII keyboard,

850

# the symbol with the hex code point 29DD might be used like so:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

851

# ⧝MY_TOKEN_TYPE.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

852

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

853

# creating a CustomInfoType, or one of the names listed

854

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

855

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

856

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

857

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

858

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

859

# referential integrity such that the same identifier in two different

860

# contexts will be given a distinct surrogate. The context is appended to

861

# plaintext value being encrypted. On decryption the provided context is

862

# validated against the value used during encryption. If a context was

863

# provided during encryption, same context must be provided during decryption

864

# as well.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

865

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

866

# If the context is not set, plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

867

# If the context is set but:

868

#

869

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

870

# 2. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

871

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

872

# plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

873

#

874

# Note that case (1) is expected when an `InfoTypeTransformation` is

875

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

876

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

877

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

878

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

879

# a key encryption key (KEK) stored by KMS).

880

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

881

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

882

# unwrap the data crypto key.

883

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

884

# The wrapped key must be a 128/192/256 bit key.

885

# Authorization requires the following IAM permissions when sending a request

886

# to perform a crypto transformation using a kms-wrapped crypto key:

887

# dlp.kms.encrypt

888

"wrappedKey": "A String", # Required. The wrapped data crypto key.

889

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

890

},

891

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

892

# leaking the key. Choose another type of key if possible.

893

"key": "A String", # Required. A 128/192/256 bit key.

894

},

895

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

896

# It will be discarded after the request finishes.

897

"name": "A String", # Required. Name of the key.

898

# This is an arbitrary string used to differentiate different keys.

899

# A unique key is generated per name: two separate `TransientCryptoKey`

900

# protos share the same generated key if their names are the same.

901

# When the data crypto key is generated, this name is not used in any way

902

# (repeating the api call will result in a different key being generated).

903

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

904

},

905

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

906

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

907

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

908

# output would be 'My phone number is '.

909

},

910

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

911

# replacement values are dynamically provided by the user for custom behavior,

912

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

913

# This can be used on

914

# data of type: number, long, string, timestamp.

915

# If the bound `Value` type differs from the type of data being transformed, we

916

# will first attempt converting the type of the data to be transformed to match

917

# the type of the bound before comparing.

918

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

919

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

920

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

921

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

922

# used.

923

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

924

# of bytes considered to comprise a 'Value' is based on its representation

925

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

926

# 123456789, the number of bytes would be counted as 9, even though an

927

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

928

"booleanValue": True or False, # boolean

929

"floatValue": 3.14, # float

930

"dayOfWeekValue": "A String", # day of week

931

"timestampValue": "A String", # timestamp

932

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

933

# and time zone are either specified elsewhere or are not significant. The date

934

# is relative to the Proleptic Gregorian Calendar. This can represent:

935

#

936

# * A full date, with non-zero year, month and day values

937

# * A month and day value, with a zero year, e.g. an anniversary

938

# * A year on its own, with zero month and day values

939

# * A year and month value, with a zero day, e.g. a credit card expiration date

940

#

941

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

942

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

943

# a year.

944

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

945

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

946

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

947

# if specifying a year by itself or a year and month where the day is not

948

# significant.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

949

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

950

"stringValue": "A String", # string

951

"integerValue": "A String", # integer

952

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

953

# or are specified elsewhere. An API may choose to allow leap seconds. Related

954

# types are google.type.Date and `google.protobuf.Timestamp`.

955

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

956

# allow the value 60 if it allows leap-seconds.

957

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

958

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

959

# to allow the value "24:00:00" for scenarios like business closing time.

960

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

961

},

962

},

963

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

964

# Note that for the purposes of inspection or transformation, the number

965

# of bytes considered to comprise a 'Value' is based on its representation

966

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

967

# 123456789, the number of bytes would be counted as 9, even though an

968

# int64 only holds up to 8 bytes of data.

969

"booleanValue": True or False, # boolean

970

"floatValue": 3.14, # float

971

"dayOfWeekValue": "A String", # day of week

972

"timestampValue": "A String", # timestamp

973

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

974

# and time zone are either specified elsewhere or are not significant. The date

975

# is relative to the Proleptic Gregorian Calendar. This can represent:

976

#

977

# * A full date, with non-zero year, month and day values

978

# * A month and day value, with a zero year, e.g. an anniversary

979

# * A year on its own, with zero month and day values

980

# * A year and month value, with a zero day, e.g. a credit card expiration date

981

#

982

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

983

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

984

# a year.

985

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

986

# month and day.

987

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

988

# if specifying a year by itself or a year and month where the day is not

989

# significant.

990

},

991

"stringValue": "A String", # string

992

"integerValue": "A String", # integer

993

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

994

# or are specified elsewhere. An API may choose to allow leap seconds. Related

995

# types are google.type.Date and `google.protobuf.Timestamp`.

996

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

997

# allow the value 60 if it allows leap-seconds.

998

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

999

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1000

# to allow the value "24:00:00" for scenarios like business closing time.

1001

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1002

},

1003

},

1004

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

1005

# the default behavior will be to hyphenate the min-max range.

1006

# Note that for the purposes of inspection or transformation, the number

1007

# of bytes considered to comprise a 'Value' is based on its representation

1008

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1009

# 123456789, the number of bytes would be counted as 9, even though an

1010

# int64 only holds up to 8 bytes of data.

1011

"booleanValue": True or False, # boolean

1012

"floatValue": 3.14, # float

1013

"dayOfWeekValue": "A String", # day of week

1014

"timestampValue": "A String", # timestamp

1015

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1016

# and time zone are either specified elsewhere or are not significant. The date

1017

# is relative to the Proleptic Gregorian Calendar. This can represent:

1018

#

1019

# * A full date, with non-zero year, month and day values

1020

# * A month and day value, with a zero year, e.g. an anniversary

1021

# * A year on its own, with zero month and day values

1022

# * A year and month value, with a zero day, e.g. a credit card expiration date

1023

#

1024

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1025

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1026

# a year.

1027

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1028

# month and day.

1029

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1030

# if specifying a year by itself or a year and month where the day is not

1031

# significant.

1032

},

1033

"stringValue": "A String", # string

1034

"integerValue": "A String", # integer

1035

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1036

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1037

# types are google.type.Date and `google.protobuf.Timestamp`.

1038

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1039

# allow the value 60 if it allows leap-seconds.

1040

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1041

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1042

# to allow the value "24:00:00" for scenarios like business closing time.

1043

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1044

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1049

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

1050

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1051

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1052

# of bytes considered to comprise a 'Value' is based on its representation

1053

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1054

# 123456789, the number of bytes would be counted as 9, even though an

1055

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1056

"booleanValue": True or False, # boolean

1057

"floatValue": 3.14, # float

1058

"dayOfWeekValue": "A String", # day of week

1059

"timestampValue": "A String", # timestamp

1060

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1061

# and time zone are either specified elsewhere or are not significant. The date

1062

# is relative to the Proleptic Gregorian Calendar. This can represent:

1063

#

1064

# * A full date, with non-zero year, month and day values

1065

# * A month and day value, with a zero year, e.g. an anniversary

1066

# * A year on its own, with zero month and day values

1067

# * A year and month value, with a zero day, e.g. a credit card expiration date

1068

#

1069

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1070

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1071

# a year.

1072

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1073

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1074

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1075

# if specifying a year by itself or a year and month where the day is not

1076

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1077

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1078

"stringValue": "A String", # string

1079

"integerValue": "A String", # integer

1080

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1081

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1082

# types are google.type.Date and `google.protobuf.Timestamp`.

1083

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1084

# allow the value 60 if it allows leap-seconds.

1085

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1086

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1087

# to allow the value "24:00:00" for scenarios like business closing time.

1088

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1089

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1090

},

1091

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1092

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

1093

# fixed character. Masking can start from the beginning or end of the string.

1094

# This can be used on data of any type (numbers, longs, and so on) and when

1095

# de-identifying structured data we'll attempt to preserve the original data's

1096

# type. (This allows you to take a long like 123 and modify it to a string like

1097

# **3.

1098

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

1099

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

1100

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

1101

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

1102

# is `true`, then the string `12345` is masked as `12***`.

1103

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

1104

# characters. For example, if the input string is `555-555-5555` and you

1105

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

1106

# returns `***-**5-5555`.

1107

{ # Characters to skip when doing deidentification of a value. These will be left

1108

# alone and skipped.

1109

"charactersToSkip": "A String", # Characters to not transform when masking.

1110

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

1115

# masked. Skipped characters do not count towards this tally.

1116

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

1117

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

1118

# code or credit card number. This string must have a length of 1. If not

1119

# supplied, this value defaults to `*` for strings, and `0` for digits.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1120

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1121

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

1122

# Bucketing transformation can provide all of this functionality,

1123

# but requires more configuration. This message is provided as a convenience to

1124

# the user for simple bucketing strategies.

1125

#

1126

# The transformed value will be a hyphenated string of

1127

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

1128

# all values that are within this bucket will be replaced with "10-20".

1129

#

1130

# This can be used on data of type: double, long.

1131

#

1132

# If the bound Value type differs from the type of data

1133

# being transformed, we will first attempt converting the type of the data to

1134

# be transformed to match the type of the bound before comparing.

1135

#

1136

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

1137

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

1138

# grouped together into a single bucket; for example if `lower_bound` = 10,

1139

# then all values less than 10 are replaced with the value "-10".

1140

# Note that for the purposes of inspection or transformation, the number

1141

# of bytes considered to comprise a 'Value' is based on its representation

1142

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1143

# 123456789, the number of bytes would be counted as 9, even though an

1144

# int64 only holds up to 8 bytes of data.

1145

"booleanValue": True or False, # boolean

1146

"floatValue": 3.14, # float

1147

"dayOfWeekValue": "A String", # day of week

1148

"timestampValue": "A String", # timestamp

1149

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1150

# and time zone are either specified elsewhere or are not significant. The date

1151

# is relative to the Proleptic Gregorian Calendar. This can represent:

1152

#

1153

# * A full date, with non-zero year, month and day values

1154

# * A month and day value, with a zero year, e.g. an anniversary

1155

# * A year on its own, with zero month and day values

1156

# * A year and month value, with a zero day, e.g. a credit card expiration date

1157

#

1158

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1159

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1160

# a year.

1161

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1162

# month and day.

1163

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1164

# if specifying a year by itself or a year and month where the day is not

1165

# significant.

1166

},

1167

"stringValue": "A String", # string

1168

"integerValue": "A String", # integer

1169

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1170

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1171

# types are google.type.Date and `google.protobuf.Timestamp`.

1172

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1173

# allow the value 60 if it allows leap-seconds.

1174

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1175

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1176

# to allow the value "24:00:00" for scenarios like business closing time.

1177

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1178

},

1179

},

1180

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

1181

# grouped together into a single bucket; for example if `upper_bound` = 89,

1182

# then all values greater than 89 are replaced with the value "89+".

1183

# Note that for the purposes of inspection or transformation, the number

1184

# of bytes considered to comprise a 'Value' is based on its representation

1185

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1186

# 123456789, the number of bytes would be counted as 9, even though an

1187

# int64 only holds up to 8 bytes of data.

1188

"booleanValue": True or False, # boolean

1189

"floatValue": 3.14, # float

1190

"dayOfWeekValue": "A String", # day of week

1191

"timestampValue": "A String", # timestamp

1192

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1193

# and time zone are either specified elsewhere or are not significant. The date

1194

# is relative to the Proleptic Gregorian Calendar. This can represent:

1195

#

1196

# * A full date, with non-zero year, month and day values

1197

# * A month and day value, with a zero year, e.g. an anniversary

1198

# * A year on its own, with zero month and day values

1199

# * A year and month value, with a zero day, e.g. a credit card expiration date

1200

#

1201

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1202

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1203

# a year.

1204

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1205

# month and day.

1206

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1207

# if specifying a year by itself or a year and month where the day is not

1208

# significant.

1209

},

1210

"stringValue": "A String", # string

1211

"integerValue": "A String", # integer

1212

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1213

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1214

# types are google.type.Date and `google.protobuf.Timestamp`.

1215

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1216

# allow the value 60 if it allows leap-seconds.

1217

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1218

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1219

# to allow the value "24:00:00" for scenarios like business closing time.

1220

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1221

},

1222

},

1223

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

1224

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

1225

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

1226

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

1227

},

1228

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1229

},

1230

],

1231

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1232

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

1233

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

1234

# portion of the value.

1235

"partToExtract": "A String", # The part of the time to keep.

1236

},

1237

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

1238

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

1239

# to learn more.

1240

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

1241

# If set, must also set cryptoKey. If set, shift will be consistent for the

1242

# given context.

1243

"name": "A String", # Name describing the field.

1244

},

1245

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

1246

# range (inclusive ends). Negative means shift to earlier in time. Must not

1247

# be more than 365250 days (1000 years) each direction.

1248

#

1249

# For example, 3 means shift date to at most 3 days into the future.

1250

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1251

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

1252

# results in the same shift for the same context and crypto_key. If

1253

# set, must also set context. Can only be applied to table items.

1254

# a key encryption key (KEK) stored by KMS).

1255

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1256

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1257

# unwrap the data crypto key.

1258

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1259

# The wrapped key must be a 128/192/256 bit key.

1260

# Authorization requires the following IAM permissions when sending a request

1261

# to perform a crypto transformation using a kms-wrapped crypto key:

1262

# dlp.kms.encrypt

1263

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1264

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1265

},

1266

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1267

# leaking the key. Choose another type of key if possible.

1268

"key": "A String", # Required. A 128/192/256 bit key.

1269

},

1270

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1271

# It will be discarded after the request finishes.

1272

"name": "A String", # Required. Name of the key.

1273

# This is an arbitrary string used to differentiate different keys.

1274

# A unique key is generated per name: two separate `TransientCryptoKey`

1275

# protos share the same generated key if their names are the same.

1276

# When the data crypto key is generated, this name is not used in any way

1277

# (repeating the api call will result in a different key being generated).

},

},

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1282

},

1283

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

1284

# Uses SHA-256.

1285

# The key size must be either 32 or 64 bytes.

1286

# Outputs a base64 encoded representation of the hashed output

1287

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

1288

# Currently, only string and integer values can be hashed.

1289

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

1290

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

1291

# a key encryption key (KEK) stored by KMS).

1292

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1293

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1294

# unwrap the data crypto key.

1295

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1296

# The wrapped key must be a 128/192/256 bit key.

1297

# Authorization requires the following IAM permissions when sending a request

1298

# to perform a crypto transformation using a kms-wrapped crypto key:

1299

# dlp.kms.encrypt

1300

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1301

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1302

},

1303

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1304

# leaking the key. Choose another type of key if possible.

1305

"key": "A String", # Required. A 128/192/256 bit key.

1306

},

1307

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1308

# It will be discarded after the request finishes.

1309

"name": "A String", # Required. Name of the key.

1310

# This is an arbitrary string used to differentiate different keys.

1311

# A unique key is generated per name: two separate `TransientCryptoKey`

1312

# protos share the same generated key if their names are the same.

1313

# When the data crypto key is generated, this name is not used in any way

1314

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

1319

# (FPE) with the FFX mode of operation; however when used in the

1320

# `ReidentifyContent` API method, it serves the opposite function by reversing

1321

# the surrogate back into the original identifier. The identifier must be

1322

# encoded as ASCII. For a given crypto key and context, the same identifier

1323

# will be replaced with the same surrogate. Identifiers must be at least two

1324

# characters long. In the case that the identifier is the empty string, it will

1325

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

1326

# more.

1327

#

1328

# Note: We recommend using CryptoDeterministicConfig for all use cases which

1329

# do not require preserving the input alphabet space and size, plus warrant

1330

# referential integrity.

1331

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

1332

# that the FFX mode natively supports. This happens before/after

1333

# encryption/decryption.

1334

# Each character listed must appear only once.

1335

# Number of characters must be in the range [2, 95].

1336

# This must be encoded as ASCII.

1337

# The order of characters does not matter.

1338

"commonAlphabet": "A String", # Common alphabets.

1339

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

1340

# This annotation will be applied to the surrogate by prefixing it with

1341

# the name of the custom infoType followed by the number of

1342

# characters comprising the surrogate. The following scheme defines the

1343

# format: info_type_name(surrogate_character_count):surrogate

1344

#

1345

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

1346

# the surrogate is 'abc', the full replacement value

1347

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1348

#

1349

# This annotation identifies the surrogate when inspecting content using the

1350

# custom infoType

1351

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

1352

# This facilitates reversal of the surrogate when it occurs in free text.

1353

#

1354

# In order for inspection to work properly, the name of this infoType must

1355

# not occur naturally anywhere in your data; otherwise, inspection may

1356

# find a surrogate that does not correspond to an actual identifier.

1357

# Therefore, choose your custom infoType name carefully after considering

1358

# what your data looks like. One way to select a name that has a high chance

1359

# of yielding reliable detection is to include one or more unicode characters

1360

# that are highly improbable to exist in your data.

1361

# For example, assuming your data is entered from a regular ASCII keyboard,

1362

# the symbol with the hex code point 29DD might be used like so:

1363

# ⧝MY_TOKEN_TYPE

1364

"name": "A String", # Name of the information type. Either a name of your choosing when

1365

# creating a CustomInfoType, or one of the names listed

1366

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1367

# a built-in type. InfoType names should conform to the pattern

1368

# `[a-zA-Z0-9_]{1,64}`.

1369

},

1370

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

1371

# identifier in two different contexts won't be given the same surrogate. If

1372

# the context is not set, a default tweak will be used.

1373

#

1374

# If the context is set but:

1375

#

1376

# 1. there is no record present when transforming a given value or

1377

# 1. the field is not present when transforming a given value,

1378

#

1379

# a default tweak will be used.

1380

#

1381

# Note that case (1) is expected when an `InfoTypeTransformation` is

1382

# applied to both structured and non-structured `ContentItem`s.

1383

# Currently, the referenced field may be of value type integer or string.

1384

#

1385

# The tweak is constructed as a sequence of bytes in big endian byte order

1386

# such that:

1387

#

1388

# - a 64 bit integer is encoded followed by a single byte of value 1

1389

# - a string is encoded in UTF-8 format followed by a single byte of value 2

1390

"name": "A String", # Name describing the field.

1391

},

1392

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

1393

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

1394

# a key encryption key (KEK) stored by KMS).

1395

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1396

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1397

# unwrap the data crypto key.

1398

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1399

# The wrapped key must be a 128/192/256 bit key.

1400

# Authorization requires the following IAM permissions when sending a request

1401

# to perform a crypto transformation using a kms-wrapped crypto key:

1402

# dlp.kms.encrypt

1403

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1404

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1405

},

1406

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1407

# leaking the key. Choose another type of key if possible.

1408

"key": "A String", # Required. A 128/192/256 bit key.

1409

},

1410

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1411

# It will be discarded after the request finishes.

1412

"name": "A String", # Required. Name of the key.

1413

# This is an arbitrary string used to differentiate different keys.

1414

# A unique key is generated per name: two separate `TransientCryptoKey`

1415

# protos share the same generated key if their names are the same.

1416

# When the data crypto key is generated, this name is not used in any way

1417

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

1422

# input. Outputs a base64 encoded representation of the encrypted output.

1423

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

1424

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

1425

# This annotation will be applied to the surrogate by prefixing it with

1426

# the name of the custom info type followed by the number of

1427

# characters comprising the surrogate. The following scheme defines the

1428

# format: {info type name}({surrogate character count}):{surrogate}

1429

#

1430

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

1431

# the surrogate is 'abc', the full replacement value

1432

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1433

#

1434

# This annotation identifies the surrogate when inspecting content using the

1435

# custom info type 'Surrogate'. This facilitates reversal of the

1436

# surrogate when it occurs in free text.

1437

#

1438

# Note: For record transformations where the entire cell in a table is being

1439

# transformed, surrogates are not mandatory. Surrogates are used to denote

1440

# the location of the token and are necessary for re-identification in free

1441

# form text.

1442

#

1443

# In order for inspection to work properly, the name of this info type must

1444

# not occur naturally anywhere in your data; otherwise, inspection may either

1445

#

1446

# - reverse a surrogate that does not correspond to an actual identifier

1447

# - be unable to parse the surrogate and result in an error

1448

#

1449

# Therefore, choose your custom info type name carefully after considering

1450

# what your data looks like. One way to select a name that has a high chance

1451

# of yielding reliable detection is to include one or more unicode characters

1452

# that are highly improbable to exist in your data.

1453

# For example, assuming your data is entered from a regular ASCII keyboard,

1454

# the symbol with the hex code point 29DD might be used like so:

1455

# ⧝MY_TOKEN_TYPE.

1456

"name": "A String", # Name of the information type. Either a name of your choosing when

1457

# creating a CustomInfoType, or one of the names listed

1458

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1459

# a built-in type. InfoType names should conform to the pattern

1460

# `[a-zA-Z0-9_]{1,64}`.

1461

},

1462

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

1463

# referential integrity such that the same identifier in two different

1464

# contexts will be given a distinct surrogate. The context is appended to

1465

# plaintext value being encrypted. On decryption the provided context is

1466

# validated against the value used during encryption. If a context was

1467

# provided during encryption, same context must be provided during decryption

1468

# as well.

1469

#

1470

# If the context is not set, plaintext would be used as is for encryption.

1471

# If the context is set but:

1472

#

1473

# 1. there is no record present when transforming a given value or

1474

# 2. the field is not present when transforming a given value,

1475

#

1476

# plaintext would be used as is for encryption.

1477

#

1478

# Note that case (1) is expected when an `InfoTypeTransformation` is

1479

# applied to both structured and non-structured `ContentItem`s.

1480

"name": "A String", # Name describing the field.

1481

},

1482

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

1483

# a key encryption key (KEK) stored by KMS).

1484

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1485

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1486

# unwrap the data crypto key.

1487

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1488

# The wrapped key must be a 128/192/256 bit key.

1489

# Authorization requires the following IAM permissions when sending a request

1490

# to perform a crypto transformation using a kms-wrapped crypto key:

1491

# dlp.kms.encrypt

1492

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1493

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1494

},

1495

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1496

# leaking the key. Choose another type of key if possible.

1497

"key": "A String", # Required. A 128/192/256 bit key.

1498

},

1499

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1500

# It will be discarded after the request finishes.

1501

"name": "A String", # Required. Name of the key.

1502

# This is an arbitrary string used to differentiate different keys.

1503

# A unique key is generated per name: two separate `TransientCryptoKey`

1504

# protos share the same generated key if their names are the same.

1505

# When the data crypto key is generated, this name is not used in any way

1506

# (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

1511

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

1512

# output would be 'My phone number is '.

1513

},

1514

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

1515

# replacement values are dynamically provided by the user for custom behavior,

1516

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

1517

# This can be used on

1518

# data of type: number, long, string, timestamp.

1519

# If the bound `Value` type differs from the type of data being transformed, we

1520

# will first attempt converting the type of the data to be transformed to match

1521

# the type of the bound before comparing.

1522

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

1523

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

1524

{ # Bucket is represented as a range, along with replacement values.

1525

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

1526

# used.

1527

# Note that for the purposes of inspection or transformation, the number

1528

# of bytes considered to comprise a 'Value' is based on its representation

1529

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1530

# 123456789, the number of bytes would be counted as 9, even though an

1531

# int64 only holds up to 8 bytes of data.

1532

"booleanValue": True or False, # boolean

1533

"floatValue": 3.14, # float

1534

"dayOfWeekValue": "A String", # day of week

1535

"timestampValue": "A String", # timestamp

1536

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1537

# and time zone are either specified elsewhere or are not significant. The date

1538

# is relative to the Proleptic Gregorian Calendar. This can represent:

1539

#

1540

# * A full date, with non-zero year, month and day values

1541

# * A month and day value, with a zero year, e.g. an anniversary

1542

# * A year on its own, with zero month and day values

1543

# * A year and month value, with a zero day, e.g. a credit card expiration date

1544

#

1545

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1546

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1547

# a year.

1548

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1549

# month and day.

1550

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1551

# if specifying a year by itself or a year and month where the day is not

1552

# significant.

1553

},

1554

"stringValue": "A String", # string

1555

"integerValue": "A String", # integer

1556

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1557

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1558

# types are google.type.Date and `google.protobuf.Timestamp`.

1559

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1560

# allow the value 60 if it allows leap-seconds.

1561

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1562

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1563

# to allow the value "24:00:00" for scenarios like business closing time.

1564

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1565

},

1566

},

1567

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

1568

# Note that for the purposes of inspection or transformation, the number

1569

# of bytes considered to comprise a 'Value' is based on its representation

1570

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1571

# 123456789, the number of bytes would be counted as 9, even though an

1572

# int64 only holds up to 8 bytes of data.

1573

"booleanValue": True or False, # boolean

1574

"floatValue": 3.14, # float

1575

"dayOfWeekValue": "A String", # day of week

1576

"timestampValue": "A String", # timestamp

1577

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1578

# and time zone are either specified elsewhere or are not significant. The date

1579

# is relative to the Proleptic Gregorian Calendar. This can represent:

1580

#

1581

# * A full date, with non-zero year, month and day values

1582

# * A month and day value, with a zero year, e.g. an anniversary

1583

# * A year on its own, with zero month and day values

1584

# * A year and month value, with a zero day, e.g. a credit card expiration date

1585

#

1586

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1587

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1588

# a year.

1589

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1590

# month and day.

1591

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1592

# if specifying a year by itself or a year and month where the day is not

1593

# significant.

1594

},

1595

"stringValue": "A String", # string

1596

"integerValue": "A String", # integer

1597

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1598

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1599

# types are google.type.Date and `google.protobuf.Timestamp`.

1600

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1601

# allow the value 60 if it allows leap-seconds.

1602

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1603

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1604

# to allow the value "24:00:00" for scenarios like business closing time.

1605

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1606

},

1607

},

1608

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

1609

# the default behavior will be to hyphenate the min-max range.

1610

# Note that for the purposes of inspection or transformation, the number

1611

# of bytes considered to comprise a 'Value' is based on its representation

1612

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1613

# 123456789, the number of bytes would be counted as 9, even though an

1614

# int64 only holds up to 8 bytes of data.

1615

"booleanValue": True or False, # boolean

1616

"floatValue": 3.14, # float

1617

"dayOfWeekValue": "A String", # day of week

1618

"timestampValue": "A String", # timestamp

1619

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1620

# and time zone are either specified elsewhere or are not significant. The date

1621

# is relative to the Proleptic Gregorian Calendar. This can represent:

1622

#

1623

# * A full date, with non-zero year, month and day values

1624

# * A month and day value, with a zero year, e.g. an anniversary

1625

# * A year on its own, with zero month and day values

1626

# * A year and month value, with a zero day, e.g. a credit card expiration date

1627

#

1628

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1629

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1630

# a year.

1631

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1632

# month and day.

1633

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1634

# if specifying a year by itself or a year and month where the day is not

1635

# significant.

1636

},

1637

"stringValue": "A String", # string

1638

"integerValue": "A String", # integer

1639

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1640

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1641

# types are google.type.Date and `google.protobuf.Timestamp`.

1642

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1643

# allow the value 60 if it allows leap-seconds.

1644

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1645

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1646

# to allow the value "24:00:00" for scenarios like business closing time.

1647

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

],

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

1654

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

1655

# Note that for the purposes of inspection or transformation, the number

1656

# of bytes considered to comprise a 'Value' is based on its representation

1657

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1658

# 123456789, the number of bytes would be counted as 9, even though an

1659

# int64 only holds up to 8 bytes of data.

1660

"booleanValue": True or False, # boolean

1661

"floatValue": 3.14, # float

1662

"dayOfWeekValue": "A String", # day of week

1663

"timestampValue": "A String", # timestamp

1664

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1665

# and time zone are either specified elsewhere or are not significant. The date

1666

# is relative to the Proleptic Gregorian Calendar. This can represent:

1667

#

1668

# * A full date, with non-zero year, month and day values

1669

# * A month and day value, with a zero year, e.g. an anniversary

1670

# * A year on its own, with zero month and day values

1671

# * A year and month value, with a zero day, e.g. a credit card expiration date

1672

#

1673

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1674

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1675

# a year.

1676

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1677

# month and day.

1678

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1679

# if specifying a year by itself or a year and month where the day is not

1680

# significant.

1681

},

1682

"stringValue": "A String", # string

1683

"integerValue": "A String", # integer

1684

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1685

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1686

# types are google.type.Date and `google.protobuf.Timestamp`.

1687

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1688

# allow the value 60 if it allows leap-seconds.

1689

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1690

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1691

# to allow the value "24:00:00" for scenarios like business closing time.

1692

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

1697

# fixed character. Masking can start from the beginning or end of the string.

1698

# This can be used on data of any type (numbers, longs, and so on) and when

1699

# de-identifying structured data we'll attempt to preserve the original data's

1700

# type. (This allows you to take a long like 123 and modify it to a string like

1701

# **3.

1702

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

1703

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

1704

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

1705

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

1706

# is `true`, then the string `12345` is masked as `12***`.

1707

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

1708

# characters. For example, if the input string is `555-555-5555` and you

1709

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

1710

# returns `***-**5-5555`.

1711

{ # Characters to skip when doing deidentification of a value. These will be left

1712

# alone and skipped.

1713

"charactersToSkip": "A String", # Characters to not transform when masking.

1714

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

1719

# masked. Skipped characters do not count towards this tally.

1720

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

1721

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

1722

# code or credit card number. This string must have a length of 1. If not

1723

# supplied, this value defaults to `*` for strings, and `0` for digits.

1724

},

1725

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

1726

# Bucketing transformation can provide all of this functionality,

1727

# but requires more configuration. This message is provided as a convenience to

1728

# the user for simple bucketing strategies.

1729

#

1730

# The transformed value will be a hyphenated string of

1731

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

1732

# all values that are within this bucket will be replaced with "10-20".

1733

#

1734

# This can be used on data of type: double, long.

1735

#

1736

# If the bound Value type differs from the type of data

1737

# being transformed, we will first attempt converting the type of the data to

1738

# be transformed to match the type of the bound before comparing.

1739

#

1740

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

1741

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

1742

# grouped together into a single bucket; for example if `lower_bound` = 10,

1743

# then all values less than 10 are replaced with the value "-10".

1744

# Note that for the purposes of inspection or transformation, the number

1745

# of bytes considered to comprise a 'Value' is based on its representation

1746

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1747

# 123456789, the number of bytes would be counted as 9, even though an

1748

# int64 only holds up to 8 bytes of data.

1749

"booleanValue": True or False, # boolean

1750

"floatValue": 3.14, # float

1751

"dayOfWeekValue": "A String", # day of week

1752

"timestampValue": "A String", # timestamp

1753

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1754

# and time zone are either specified elsewhere or are not significant. The date

1755

# is relative to the Proleptic Gregorian Calendar. This can represent:

1756

#

1757

# * A full date, with non-zero year, month and day values

1758

# * A month and day value, with a zero year, e.g. an anniversary

1759

# * A year on its own, with zero month and day values

1760

# * A year and month value, with a zero day, e.g. a credit card expiration date

1761

#

1762

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1763

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1764

# a year.

1765

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1766

# month and day.

1767

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1768

# if specifying a year by itself or a year and month where the day is not

1769

# significant.

1770

},

1771

"stringValue": "A String", # string

1772

"integerValue": "A String", # integer

1773

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1774

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1775

# types are google.type.Date and `google.protobuf.Timestamp`.

1776

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1777

# allow the value 60 if it allows leap-seconds.

1778

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1779

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1780

# to allow the value "24:00:00" for scenarios like business closing time.

1781

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1782

},

1783

},

1784

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

1785

# grouped together into a single bucket; for example if `upper_bound` = 89,

1786

# then all values greater than 89 are replaced with the value "89+".

1787

# Note that for the purposes of inspection or transformation, the number

1788

# of bytes considered to comprise a 'Value' is based on its representation

1789

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1790

# 123456789, the number of bytes would be counted as 9, even though an

1791

# int64 only holds up to 8 bytes of data.

1792

"booleanValue": True or False, # boolean

1793

"floatValue": 3.14, # float

1794

"dayOfWeekValue": "A String", # day of week

1795

"timestampValue": "A String", # timestamp

1796

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1797

# and time zone are either specified elsewhere or are not significant. The date

1798

# is relative to the Proleptic Gregorian Calendar. This can represent:

1799

#

1800

# * A full date, with non-zero year, month and day values

1801

# * A month and day value, with a zero year, e.g. an anniversary

1802

# * A year on its own, with zero month and day values

1803

# * A year and month value, with a zero day, e.g. a credit card expiration date

1804

#

1805

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1806

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1807

# a year.

1808

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1809

# month and day.

1810

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1811

# if specifying a year by itself or a year and month where the day is not

1812

# significant.

1813

},

1814

"stringValue": "A String", # string

1815

"integerValue": "A String", # integer

1816

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1817

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1818

# types are google.type.Date and `google.protobuf.Timestamp`.

1819

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1820

# allow the value 60 if it allows leap-seconds.

1821

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1822

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1823

# to allow the value "24:00:00" for scenarios like business closing time.

1824

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1825

},

1826

},

1827

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

1828

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

1829

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

1830

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

1831

},

1832

},

1833

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

1834

# given `RecordCondition`. The conditions are allowed to reference fields

1835

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

1840

# column for the same record is within a specific range.

1841

# - Redact a field if the date of birth field is greater than 85.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1842

# a field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1843

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

1844

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

1845

# only supported value is `AND`.

1846

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

1847

"conditions": [ # A collection of conditions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1848

{ # The field type of `value` and `field` do not need to match to be

1849

# considered equal, but not all comparisons are possible.

1850

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

1851

# but all other comparisons are invalid with incompatible types.

1852

# A `value` of type:

1853

#

1854

# - `string` can be compared against all other types

1855

# - `boolean` can only be compared against other booleans

1856

# - `integer` can be compared against doubles or a string if the string value

1857

# can be parsed as an integer.

1858

# - `double` can be compared against integers or a string if the string can

1859

# be parsed as a double.

1860

# - `Timestamp` can be compared against strings in RFC 3339 date string

1861

# format.

1862

# - `TimeOfDay` can be compared against timestamps and strings in the format

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1863

# of 'HH:mm:ss'.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1864

#

1865

# If we fail to compare do to type mismatch, a warning will be given and

1866

# the condition will evaluate to false.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1867

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

1868

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1869

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1870

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

1871

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1872

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1873

# of bytes considered to comprise a 'Value' is based on its representation

1874

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1875

# 123456789, the number of bytes would be counted as 9, even though an

1876

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1877

"booleanValue": True or False, # boolean

1878

"floatValue": 3.14, # float

1879

"dayOfWeekValue": "A String", # day of week

1880

"timestampValue": "A String", # timestamp

1881

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1882

# and time zone are either specified elsewhere or are not significant. The date

1883

# is relative to the Proleptic Gregorian Calendar. This can represent:

1884

#

1885

# * A full date, with non-zero year, month and day values

1886

# * A month and day value, with a zero year, e.g. an anniversary

1887

# * A year on its own, with zero month and day values

1888

# * A year and month value, with a zero day, e.g. a credit card expiration date

1889

#

1890

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1891

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1892

# a year.

1893

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

1894

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1895

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1896

# if specifying a year by itself or a year and month where the day is not

1897

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1898

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1899

"stringValue": "A String", # string

1900

"integerValue": "A String", # integer

1901

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1902

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1903

# types are google.type.Date and `google.protobuf.Timestamp`.

1904

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1905

# allow the value 60 if it allows leap-seconds.

1906

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1907

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1908

# to allow the value "24:00:00" for scenarios like business closing time.

1909

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1910

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

1915

},

1916

},

1917

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1918

],

1919

},

1920

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text

1921

# transformation everywhere.

1922

# apply various `PrimitiveTransformation`s to each finding, where the

1923

# transformation is applied to only values that were identified as a specific

1924

# info_type.

1925

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

1926

# for a given infoType.

1927

{ # A transformation to apply to text that is identified as a specific

1928

# info_type.

1929

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

1930

# this transformation to apply to all findings that correspond to

1931

# infoTypes that were requested in `InspectConfig`.

1932

{ # Type of information detected by the API.

1933

"name": "A String", # Name of the information type. Either a name of your choosing when

1934

# creating a CustomInfoType, or one of the names listed

1935

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

1936

# a built-in type. InfoType names should conform to the pattern

1937

# `[a-zA-Z0-9_]{1,64}`.

1938

},

1939

],

1940

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

1941

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

1942

# portion of the value.

1943

"partToExtract": "A String", # The part of the time to keep.

1944

},

1945

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

1946

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

1947

# to learn more.

1948

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

1949

# If set, must also set cryptoKey. If set, shift will be consistent for the

1950

# given context.

1951

"name": "A String", # Name describing the field.

1952

},

1953

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

1954

# range (inclusive ends). Negative means shift to earlier in time. Must not

1955

# be more than 365250 days (1000 years) each direction.

1956

#

1957

# For example, 3 means shift date to at most 3 days into the future.

1958

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1959

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

1960

# results in the same shift for the same context and crypto_key. If

1961

# set, must also set context. Can only be applied to table items.

1962

# a key encryption key (KEK) stored by KMS).

1963

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1964

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1965

# unwrap the data crypto key.

1966

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1967

# The wrapped key must be a 128/192/256 bit key.

1968

# Authorization requires the following IAM permissions when sending a request

1969

# to perform a crypto transformation using a kms-wrapped crypto key:

1970

# dlp.kms.encrypt

1971

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1972

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1973

},

1974

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1975

# leaking the key. Choose another type of key if possible.

1976

"key": "A String", # Required. A 128/192/256 bit key.

1977

},

1978

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1979

# It will be discarded after the request finishes.

1980

"name": "A String", # Required. Name of the key.

1981

# This is an arbitrary string used to differentiate different keys.

1982

# A unique key is generated per name: two separate `TransientCryptoKey`

1983

# protos share the same generated key if their names are the same.

1984

# When the data crypto key is generated, this name is not used in any way

1985

# (repeating the api call will result in a different key being generated).

},

},

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1990

},

1991

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

1992

# Uses SHA-256.

1993

# The key size must be either 32 or 64 bytes.

1994

# Outputs a base64 encoded representation of the hashed output

1995

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

1996

# Currently, only string and integer values can be hashed.

1997

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

1998

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

1999

# a key encryption key (KEK) stored by KMS).

2000

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2001

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2002

# unwrap the data crypto key.

2003

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2004

# The wrapped key must be a 128/192/256 bit key.

2005

# Authorization requires the following IAM permissions when sending a request

2006

# to perform a crypto transformation using a kms-wrapped crypto key:

2007

# dlp.kms.encrypt

2008

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2009

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2010

},

2011

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2012

# leaking the key. Choose another type of key if possible.

2013

"key": "A String", # Required. A 128/192/256 bit key.

2014

},

2015

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2016

# It will be discarded after the request finishes.

2017

"name": "A String", # Required. Name of the key.

2018

# This is an arbitrary string used to differentiate different keys.

2019

# A unique key is generated per name: two separate `TransientCryptoKey`

2020

# protos share the same generated key if their names are the same.

2021

# When the data crypto key is generated, this name is not used in any way

2022

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

2027

# (FPE) with the FFX mode of operation; however when used in the

2028

# `ReidentifyContent` API method, it serves the opposite function by reversing

2029

# the surrogate back into the original identifier. The identifier must be

2030

# encoded as ASCII. For a given crypto key and context, the same identifier

2031

# will be replaced with the same surrogate. Identifiers must be at least two

2032

# characters long. In the case that the identifier is the empty string, it will

2033

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

2034

# more.

2035

#

2036

# Note: We recommend using CryptoDeterministicConfig for all use cases which

2037

# do not require preserving the input alphabet space and size, plus warrant

2038

# referential integrity.

2039

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

2040

# that the FFX mode natively supports. This happens before/after

2041

# encryption/decryption.

2042

# Each character listed must appear only once.

2043

# Number of characters must be in the range [2, 95].

2044

# This must be encoded as ASCII.

2045

# The order of characters does not matter.

2046

"commonAlphabet": "A String", # Common alphabets.

2047

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

2048

# This annotation will be applied to the surrogate by prefixing it with

2049

# the name of the custom infoType followed by the number of

2050

# characters comprising the surrogate. The following scheme defines the

2051

# format: info_type_name(surrogate_character_count):surrogate

2052

#

2053

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

2054

# the surrogate is 'abc', the full replacement value

2055

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

2056

#

2057

# This annotation identifies the surrogate when inspecting content using the

2058

# custom infoType

2059

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

2060

# This facilitates reversal of the surrogate when it occurs in free text.

2061

#

2062

# In order for inspection to work properly, the name of this infoType must

2063

# not occur naturally anywhere in your data; otherwise, inspection may

2064

# find a surrogate that does not correspond to an actual identifier.

2065

# Therefore, choose your custom infoType name carefully after considering

2066

# what your data looks like. One way to select a name that has a high chance

2067

# of yielding reliable detection is to include one or more unicode characters

2068

# that are highly improbable to exist in your data.

2069

# For example, assuming your data is entered from a regular ASCII keyboard,

2070

# the symbol with the hex code point 29DD might be used like so:

2071

# ⧝MY_TOKEN_TYPE

2072

"name": "A String", # Name of the information type. Either a name of your choosing when

2073

# creating a CustomInfoType, or one of the names listed

2074

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2075

# a built-in type. InfoType names should conform to the pattern

2076

# `[a-zA-Z0-9_]{1,64}`.

2077

},

2078

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

2079

# identifier in two different contexts won't be given the same surrogate. If

2080

# the context is not set, a default tweak will be used.

2081

#

2082

# If the context is set but:

2083

#

2084

# 1. there is no record present when transforming a given value or

2085

# 1. the field is not present when transforming a given value,

2086

#

2087

# a default tweak will be used.

2088

#

2089

# Note that case (1) is expected when an `InfoTypeTransformation` is

2090

# applied to both structured and non-structured `ContentItem`s.

2091

# Currently, the referenced field may be of value type integer or string.

2092

#

2093

# The tweak is constructed as a sequence of bytes in big endian byte order

2094

# such that:

2095

#

2096

# - a 64 bit integer is encoded followed by a single byte of value 1

2097

# - a string is encoded in UTF-8 format followed by a single byte of value 2

2098

"name": "A String", # Name describing the field.

2099

},

2100

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

2101

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

2102

# a key encryption key (KEK) stored by KMS).

2103

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2104

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2105

# unwrap the data crypto key.

2106

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2107

# The wrapped key must be a 128/192/256 bit key.

2108

# Authorization requires the following IAM permissions when sending a request

2109

# to perform a crypto transformation using a kms-wrapped crypto key:

2110

# dlp.kms.encrypt

2111

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2112

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2113

},

2114

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2115

# leaking the key. Choose another type of key if possible.

2116

"key": "A String", # Required. A 128/192/256 bit key.

2117

},

2118

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2119

# It will be discarded after the request finishes.

2120

"name": "A String", # Required. Name of the key.

2121

# This is an arbitrary string used to differentiate different keys.

2122

# A unique key is generated per name: two separate `TransientCryptoKey`

2123

# protos share the same generated key if their names are the same.

2124

# When the data crypto key is generated, this name is not used in any way

2125

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

2130

# input. Outputs a base64 encoded representation of the encrypted output.

2131

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

2132

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

2133

# This annotation will be applied to the surrogate by prefixing it with

2134

# the name of the custom info type followed by the number of

2135

# characters comprising the surrogate. The following scheme defines the

2136

# format: {info type name}({surrogate character count}):{surrogate}

2137

#

2138

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

2139

# the surrogate is 'abc', the full replacement value

2140

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

2141

#

2142

# This annotation identifies the surrogate when inspecting content using the

2143

# custom info type 'Surrogate'. This facilitates reversal of the

2144

# surrogate when it occurs in free text.

2145

#

2146

# Note: For record transformations where the entire cell in a table is being

2147

# transformed, surrogates are not mandatory. Surrogates are used to denote

2148

# the location of the token and are necessary for re-identification in free

2149

# form text.

2150

#

2151

# In order for inspection to work properly, the name of this info type must

2152

# not occur naturally anywhere in your data; otherwise, inspection may either

2153

#

2154

# - reverse a surrogate that does not correspond to an actual identifier

2155

# - be unable to parse the surrogate and result in an error

2156

#

2157

# Therefore, choose your custom info type name carefully after considering

2158

# what your data looks like. One way to select a name that has a high chance

2159

# of yielding reliable detection is to include one or more unicode characters

2160

# that are highly improbable to exist in your data.

2161

# For example, assuming your data is entered from a regular ASCII keyboard,

2162

# the symbol with the hex code point 29DD might be used like so:

2163

# ⧝MY_TOKEN_TYPE.

2164

"name": "A String", # Name of the information type. Either a name of your choosing when

2165

# creating a CustomInfoType, or one of the names listed

2166

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2167

# a built-in type. InfoType names should conform to the pattern

2168

# `[a-zA-Z0-9_]{1,64}`.

2169

},

2170

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

2171

# referential integrity such that the same identifier in two different

2172

# contexts will be given a distinct surrogate. The context is appended to

2173

# plaintext value being encrypted. On decryption the provided context is

2174

# validated against the value used during encryption. If a context was

2175

# provided during encryption, same context must be provided during decryption

2176

# as well.

2177

#

2178

# If the context is not set, plaintext would be used as is for encryption.

2179

# If the context is set but:

2180

#

2181

# 1. there is no record present when transforming a given value or

2182

# 2. the field is not present when transforming a given value,

2183

#

2184

# plaintext would be used as is for encryption.

2185

#

2186

# Note that case (1) is expected when an `InfoTypeTransformation` is

2187

# applied to both structured and non-structured `ContentItem`s.

2188

"name": "A String", # Name describing the field.

2189

},

2190

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

2191

# a key encryption key (KEK) stored by KMS).

2192

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2193

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2194

# unwrap the data crypto key.

2195

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2196

# The wrapped key must be a 128/192/256 bit key.

2197

# Authorization requires the following IAM permissions when sending a request

2198

# to perform a crypto transformation using a kms-wrapped crypto key:

2199

# dlp.kms.encrypt

2200

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2201

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2202

},

2203

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2204

# leaking the key. Choose another type of key if possible.

2205

"key": "A String", # Required. A 128/192/256 bit key.

2206

},

2207

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2208

# It will be discarded after the request finishes.

2209

"name": "A String", # Required. Name of the key.

2210

# This is an arbitrary string used to differentiate different keys.

2211

# A unique key is generated per name: two separate `TransientCryptoKey`

2212

# protos share the same generated key if their names are the same.

2213

# When the data crypto key is generated, this name is not used in any way

2214

# (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

2219

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

2220

# output would be 'My phone number is '.

2221

},

2222

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

2223

# replacement values are dynamically provided by the user for custom behavior,

2224

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

2225

# This can be used on

2226

# data of type: number, long, string, timestamp.

2227

# If the bound `Value` type differs from the type of data being transformed, we

2228

# will first attempt converting the type of the data to be transformed to match

2229

# the type of the bound before comparing.

2230

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

2231

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

2232

{ # Bucket is represented as a range, along with replacement values.

2233

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

2234

# used.

2235

# Note that for the purposes of inspection or transformation, the number

2236

# of bytes considered to comprise a 'Value' is based on its representation

2237

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2238

# 123456789, the number of bytes would be counted as 9, even though an

2239

# int64 only holds up to 8 bytes of data.

2240

"booleanValue": True or False, # boolean

2241

"floatValue": 3.14, # float

2242

"dayOfWeekValue": "A String", # day of week

2243

"timestampValue": "A String", # timestamp

2244

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2245

# and time zone are either specified elsewhere or are not significant. The date

2246

# is relative to the Proleptic Gregorian Calendar. This can represent:

2247

#

2248

# * A full date, with non-zero year, month and day values

2249

# * A month and day value, with a zero year, e.g. an anniversary

2250

# * A year on its own, with zero month and day values

2251

# * A year and month value, with a zero day, e.g. a credit card expiration date

2252

#

2253

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2254

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2255

# a year.

2256

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2257

# month and day.

2258

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2259

# if specifying a year by itself or a year and month where the day is not

2260

# significant.

2261

},

2262

"stringValue": "A String", # string

2263

"integerValue": "A String", # integer

2264

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2265

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2266

# types are google.type.Date and `google.protobuf.Timestamp`.

2267

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2268

# allow the value 60 if it allows leap-seconds.

2269

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2270

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2271

# to allow the value "24:00:00" for scenarios like business closing time.

2272

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2273

},

2274

},

2275

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

2276

# Note that for the purposes of inspection or transformation, the number

2277

# of bytes considered to comprise a 'Value' is based on its representation

2278

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2279

# 123456789, the number of bytes would be counted as 9, even though an

2280

# int64 only holds up to 8 bytes of data.

2281

"booleanValue": True or False, # boolean

2282

"floatValue": 3.14, # float

2283

"dayOfWeekValue": "A String", # day of week

2284

"timestampValue": "A String", # timestamp

2285

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2286

# and time zone are either specified elsewhere or are not significant. The date

2287

# is relative to the Proleptic Gregorian Calendar. This can represent:

2288

#

2289

# * A full date, with non-zero year, month and day values

2290

# * A month and day value, with a zero year, e.g. an anniversary

2291

# * A year on its own, with zero month and day values

2292

# * A year and month value, with a zero day, e.g. a credit card expiration date

2293

#

2294

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2295

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2296

# a year.

2297

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2298

# month and day.

2299

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2300

# if specifying a year by itself or a year and month where the day is not

2301

# significant.

2302

},

2303

"stringValue": "A String", # string

2304

"integerValue": "A String", # integer

2305

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2306

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2307

# types are google.type.Date and `google.protobuf.Timestamp`.

2308

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2309

# allow the value 60 if it allows leap-seconds.

2310

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2311

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2312

# to allow the value "24:00:00" for scenarios like business closing time.

2313

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2314

},

2315

},

2316

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

2317

# the default behavior will be to hyphenate the min-max range.

2318

# Note that for the purposes of inspection or transformation, the number

2319

# of bytes considered to comprise a 'Value' is based on its representation

2320

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2321

# 123456789, the number of bytes would be counted as 9, even though an

2322

# int64 only holds up to 8 bytes of data.

2323

"booleanValue": True or False, # boolean

2324

"floatValue": 3.14, # float

2325

"dayOfWeekValue": "A String", # day of week

2326

"timestampValue": "A String", # timestamp

2327

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2328

# and time zone are either specified elsewhere or are not significant. The date

2329

# is relative to the Proleptic Gregorian Calendar. This can represent:

2330

#

2331

# * A full date, with non-zero year, month and day values

2332

# * A month and day value, with a zero year, e.g. an anniversary

2333

# * A year on its own, with zero month and day values

2334

# * A year and month value, with a zero day, e.g. a credit card expiration date

2335

#

2336

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2337

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2338

# a year.

2339

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2340

# month and day.

2341

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2342

# if specifying a year by itself or a year and month where the day is not

2343

# significant.

2344

},

2345

"stringValue": "A String", # string

2346

"integerValue": "A String", # integer

2347

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2348

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2349

# types are google.type.Date and `google.protobuf.Timestamp`.

2350

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2351

# allow the value 60 if it allows leap-seconds.

2352

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2353

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2354

# to allow the value "24:00:00" for scenarios like business closing time.

2355

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

],

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

2362

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

2363

# Note that for the purposes of inspection or transformation, the number

2364

# of bytes considered to comprise a 'Value' is based on its representation

2365

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2366

# 123456789, the number of bytes would be counted as 9, even though an

2367

# int64 only holds up to 8 bytes of data.

2368

"booleanValue": True or False, # boolean

2369

"floatValue": 3.14, # float

2370

"dayOfWeekValue": "A String", # day of week

2371

"timestampValue": "A String", # timestamp

2372

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2373

# and time zone are either specified elsewhere or are not significant. The date

2374

# is relative to the Proleptic Gregorian Calendar. This can represent:

2375

#

2376

# * A full date, with non-zero year, month and day values

2377

# * A month and day value, with a zero year, e.g. an anniversary

2378

# * A year on its own, with zero month and day values

2379

# * A year and month value, with a zero day, e.g. a credit card expiration date

2380

#

2381

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2382

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2383

# a year.

2384

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2385

# month and day.

2386

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2387

# if specifying a year by itself or a year and month where the day is not

2388

# significant.

2389

},

2390

"stringValue": "A String", # string

2391

"integerValue": "A String", # integer

2392

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2393

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2394

# types are google.type.Date and `google.protobuf.Timestamp`.

2395

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2396

# allow the value 60 if it allows leap-seconds.

2397

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2398

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2399

# to allow the value "24:00:00" for scenarios like business closing time.

2400

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

2405

# fixed character. Masking can start from the beginning or end of the string.

2406

# This can be used on data of any type (numbers, longs, and so on) and when

2407

# de-identifying structured data we'll attempt to preserve the original data's

2408

# type. (This allows you to take a long like 123 and modify it to a string like

2409

# **3.

2410

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

2411

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

2412

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

2413

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

2414

# is `true`, then the string `12345` is masked as `12***`.

2415

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

2416

# characters. For example, if the input string is `555-555-5555` and you

2417

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

2418

# returns `***-**5-5555`.

2419

{ # Characters to skip when doing deidentification of a value. These will be left

2420

# alone and skipped.

2421

"charactersToSkip": "A String", # Characters to not transform when masking.

2422

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

2427

# masked. Skipped characters do not count towards this tally.

2428

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

2429

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

2430

# code or credit card number. This string must have a length of 1. If not

2431

# supplied, this value defaults to `*` for strings, and `0` for digits.

2432

},

2433

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

2434

# Bucketing transformation can provide all of this functionality,

2435

# but requires more configuration. This message is provided as a convenience to

2436

# the user for simple bucketing strategies.

2437

#

2438

# The transformed value will be a hyphenated string of

2439

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

2440

# all values that are within this bucket will be replaced with "10-20".

2441

#

2442

# This can be used on data of type: double, long.

2443

#

2444

# If the bound Value type differs from the type of data

2445

# being transformed, we will first attempt converting the type of the data to

2446

# be transformed to match the type of the bound before comparing.

2447

#

2448

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

2449

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

2450

# grouped together into a single bucket; for example if `lower_bound` = 10,

2451

# then all values less than 10 are replaced with the value "-10".

2452

# Note that for the purposes of inspection or transformation, the number

2453

# of bytes considered to comprise a 'Value' is based on its representation

2454

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2455

# 123456789, the number of bytes would be counted as 9, even though an

2456

# int64 only holds up to 8 bytes of data.

2457

"booleanValue": True or False, # boolean

2458

"floatValue": 3.14, # float

2459

"dayOfWeekValue": "A String", # day of week

2460

"timestampValue": "A String", # timestamp

2461

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2462

# and time zone are either specified elsewhere or are not significant. The date

2463

# is relative to the Proleptic Gregorian Calendar. This can represent:

2464

#

2465

# * A full date, with non-zero year, month and day values

2466

# * A month and day value, with a zero year, e.g. an anniversary

2467

# * A year on its own, with zero month and day values

2468

# * A year and month value, with a zero day, e.g. a credit card expiration date

2469

#

2470

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2471

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2472

# a year.

2473

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2474

# month and day.

2475

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2476

# if specifying a year by itself or a year and month where the day is not

2477

# significant.

2478

},

2479

"stringValue": "A String", # string

2480

"integerValue": "A String", # integer

2481

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2482

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2483

# types are google.type.Date and `google.protobuf.Timestamp`.

2484

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2485

# allow the value 60 if it allows leap-seconds.

2486

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2487

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2488

# to allow the value "24:00:00" for scenarios like business closing time.

2489

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2490

},

2491

},

2492

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

2493

# grouped together into a single bucket; for example if `upper_bound` = 89,

2494

# then all values greater than 89 are replaced with the value "89+".

2495

# Note that for the purposes of inspection or transformation, the number

2496

# of bytes considered to comprise a 'Value' is based on its representation

2497

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2498

# 123456789, the number of bytes would be counted as 9, even though an

2499

# int64 only holds up to 8 bytes of data.

2500

"booleanValue": True or False, # boolean

2501

"floatValue": 3.14, # float

2502

"dayOfWeekValue": "A String", # day of week

2503

"timestampValue": "A String", # timestamp

2504

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2505

# and time zone are either specified elsewhere or are not significant. The date

2506

# is relative to the Proleptic Gregorian Calendar. This can represent:

2507

#

2508

# * A full date, with non-zero year, month and day values

2509

# * A month and day value, with a zero year, e.g. an anniversary

2510

# * A year on its own, with zero month and day values

2511

# * A year and month value, with a zero day, e.g. a credit card expiration date

2512

#

2513

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2514

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2515

# a year.

2516

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2517

# month and day.

2518

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2519

# if specifying a year by itself or a year and month where the day is not

2520

# significant.

2521

},

2522

"stringValue": "A String", # string

2523

"integerValue": "A String", # integer

2524

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2525

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2526

# types are google.type.Date and `google.protobuf.Timestamp`.

2527

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2528

# allow the value 60 if it allows leap-seconds.

2529

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2530

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2531

# to allow the value "24:00:00" for scenarios like business closing time.

2532

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2533

},

2534

},

2535

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

2536

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

2537

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

2538

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

2539

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2540

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2541

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

],

},

},

"locationId": "A String", # The geographic location to process de-identification. Reserved for future

# extensions.

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2556

2557

{ # Results of de-identifying a ContentItem.

2558

"item": { # Container structure for the content to inspect. # The de-identified item.

2559

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

2560

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

2561

"data": "A String", # Content data to inspect or redact.

2562

},

2563

"value": "A String", # String data to inspect or redact.

2564

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

2565

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

2566

# learn more.

2567

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

2568

# learn more.

2569

"rows": [ # Rows of the table.

2570

{ # Values of the row.

2571

"values": [ # Individual cells.

2572

{ # Set of primitive values supported by the system.

2573

# Note that for the purposes of inspection or transformation, the number

2574

# of bytes considered to comprise a 'Value' is based on its representation

2575

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2576

# 123456789, the number of bytes would be counted as 9, even though an

2577

# int64 only holds up to 8 bytes of data.

2578

"booleanValue": True or False, # boolean

2579

"floatValue": 3.14, # float

2580

"dayOfWeekValue": "A String", # day of week

2581

"timestampValue": "A String", # timestamp

2582

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2583

# and time zone are either specified elsewhere or are not significant. The date

2584

# is relative to the Proleptic Gregorian Calendar. This can represent:

2585

#

2586

# * A full date, with non-zero year, month and day values

2587

# * A month and day value, with a zero year, e.g. an anniversary

2588

# * A year on its own, with zero month and day values

2589

# * A year and month value, with a zero day, e.g. a credit card expiration date

2590

#

2591

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2592

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2593

# a year.

2594

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2595

# month and day.

2596

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2597

# if specifying a year by itself or a year and month where the day is not

2598

# significant.

2599

},

2600

"stringValue": "A String", # string

2601

"integerValue": "A String", # integer

2602

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2603

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2604

# types are google.type.Date and `google.protobuf.Timestamp`.

2605

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2606

# allow the value 60 if it allows leap-seconds.

2607

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2608

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2609

# to allow the value "24:00:00" for scenarios like business closing time.

2610

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

],

},

],

"headers": [ # Headers of the table.

2617

{ # General identifier of a data field in a storage service.

2618

"name": "A String", # Name describing the field.

},

],

},

},

"overview": { # Overview of the modifications that occurred. # An overview of the changes that were made on the `item`.

2624

"transformationSummaries": [ # Transformations applied to the dataset.

2625

{ # Summary of a single transformation.

2626

# Only one of 'transformation', 'field_transformation', or 'record_suppress'

2627

# will be set.

2628

"fieldTransformations": [ # The field transformation that was applied.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

2629

# If multiple field transformations are requested for a single field,

2630

# this list will contain all of them; otherwise, only one is supplied.

2631

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2632

"fields": [ # Required. Input field(s) to apply the transformation to.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2633

{ # General identifier of a data field in a storage service.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2634

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2635

},

2636

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2637

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2638

# transform content that matches an `InfoType`.

2639

# apply various `PrimitiveTransformation`s to each finding, where the

2640

# transformation is applied to only values that were identified as a specific

2641

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2642

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2643

# for a given infoType.

2644

{ # A transformation to apply to text that is identified as a specific

2645

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2646

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

2647

# this transformation to apply to all findings that correspond to

2648

# infoTypes that were requested in `InspectConfig`.

2649

{ # Type of information detected by the API.

2650

"name": "A String", # Name of the information type. Either a name of your choosing when

2651

# creating a CustomInfoType, or one of the names listed

2652

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2653

# a built-in type. InfoType names should conform to the pattern

2654

# `[a-zA-Z0-9_]{1,64}`.

2655

},

2656

],

2657

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

2658

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

2659

# portion of the value.

2660

"partToExtract": "A String", # The part of the time to keep.

2661

},

2662

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

2663

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

2664

# to learn more.

2665

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

2666

# If set, must also set cryptoKey. If set, shift will be consistent for the

2667

# given context.

2668

"name": "A String", # Name describing the field.

2669

},

2670

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

2671

# range (inclusive ends). Negative means shift to earlier in time. Must not

2672

# be more than 365250 days (1000 years) each direction.

2673

#

2674

# For example, 3 means shift date to at most 3 days into the future.

2675

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

2676

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

2677

# results in the same shift for the same context and crypto_key. If

2678

# set, must also set context. Can only be applied to table items.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2679

# a key encryption key (KEK) stored by KMS).

2680

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2681

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2682

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2683

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2684

# The wrapped key must be a 128/192/256 bit key.

2685

# Authorization requires the following IAM permissions when sending a request

2686

# to perform a crypto transformation using a kms-wrapped crypto key:

2687

# dlp.kms.encrypt

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2688

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2689

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2690

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2691

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2692

# leaking the key. Choose another type of key if possible.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2693

"key": "A String", # Required. A 128/192/256 bit key.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2694

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2695

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2696

# It will be discarded after the request finishes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2697

"name": "A String", # Required. Name of the key.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2698

# This is an arbitrary string used to differentiate different keys.

2699

# A unique key is generated per name: two separate `TransientCryptoKey`

2700

# protos share the same generated key if their names are the same.

2701

# When the data crypto key is generated, this name is not used in any way

2702

# (repeating the api call will result in a different key being generated).

2703

},

2704

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2705

},

2706

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

2707

},

2708

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

2709

# Uses SHA-256.

2710

# The key size must be either 32 or 64 bytes.

2711

# Outputs a base64 encoded representation of the hashed output

2712

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

2713

# Currently, only string and integer values can be hashed.

2714

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

2715

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

2716

# a key encryption key (KEK) stored by KMS).

2717

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2718

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2719

# unwrap the data crypto key.

2720

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2721

# The wrapped key must be a 128/192/256 bit key.

2722

# Authorization requires the following IAM permissions when sending a request

2723

# to perform a crypto transformation using a kms-wrapped crypto key:

2724

# dlp.kms.encrypt

2725

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2726

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2727

},

2728

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2729

# leaking the key. Choose another type of key if possible.

2730

"key": "A String", # Required. A 128/192/256 bit key.

2731

},

2732

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2733

# It will be discarded after the request finishes.

2734

"name": "A String", # Required. Name of the key.

2735

# This is an arbitrary string used to differentiate different keys.

2736

# A unique key is generated per name: two separate `TransientCryptoKey`

2737

# protos share the same generated key if their names are the same.

2738

# When the data crypto key is generated, this name is not used in any way

2739

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

2744

# (FPE) with the FFX mode of operation; however when used in the

2745

# `ReidentifyContent` API method, it serves the opposite function by reversing

2746

# the surrogate back into the original identifier. The identifier must be

2747

# encoded as ASCII. For a given crypto key and context, the same identifier

2748

# will be replaced with the same surrogate. Identifiers must be at least two

2749

# characters long. In the case that the identifier is the empty string, it will

2750

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

2751

# more.

2752

#

2753

# Note: We recommend using CryptoDeterministicConfig for all use cases which

2754

# do not require preserving the input alphabet space and size, plus warrant

2755

# referential integrity.

2756

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

2757

# that the FFX mode natively supports. This happens before/after

2758

# encryption/decryption.

2759

# Each character listed must appear only once.

2760

# Number of characters must be in the range [2, 95].

2761

# This must be encoded as ASCII.

2762

# The order of characters does not matter.

2763

"commonAlphabet": "A String", # Common alphabets.

2764

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

2765

# This annotation will be applied to the surrogate by prefixing it with

2766

# the name of the custom infoType followed by the number of

2767

# characters comprising the surrogate. The following scheme defines the

2768

# format: info_type_name(surrogate_character_count):surrogate

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2769

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2770

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

2771

# the surrogate is 'abc', the full replacement value

2772

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

2773

#

2774

# This annotation identifies the surrogate when inspecting content using the

2775

# custom infoType

2776

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

2777

# This facilitates reversal of the surrogate when it occurs in free text.

2778

#

2779

# In order for inspection to work properly, the name of this infoType must

2780

# not occur naturally anywhere in your data; otherwise, inspection may

2781

# find a surrogate that does not correspond to an actual identifier.

2782

# Therefore, choose your custom infoType name carefully after considering

2783

# what your data looks like. One way to select a name that has a high chance

2784

# of yielding reliable detection is to include one or more unicode characters

2785

# that are highly improbable to exist in your data.

2786

# For example, assuming your data is entered from a regular ASCII keyboard,

2787

# the symbol with the hex code point 29DD might be used like so:

2788

# ⧝MY_TOKEN_TYPE

2789

"name": "A String", # Name of the information type. Either a name of your choosing when

2790

# creating a CustomInfoType, or one of the names listed

2791

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2792

# a built-in type. InfoType names should conform to the pattern

2793

# `[a-zA-Z0-9_]{1,64}`.

2794

},

2795

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

2796

# identifier in two different contexts won't be given the same surrogate. If

2797

# the context is not set, a default tweak will be used.

2798

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2799

# If the context is set but:

2800

#

2801

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2802

# 1. the field is not present when transforming a given value,

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2803

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2804

# a default tweak will be used.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2805

#

2806

# Note that case (1) is expected when an `InfoTypeTransformation` is

2807

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2808

# Currently, the referenced field may be of value type integer or string.

2809

#

2810

# The tweak is constructed as a sequence of bytes in big endian byte order

2811

# such that:

2812

#

2813

# - a 64 bit integer is encoded followed by a single byte of value 1

2814

# - a string is encoded in UTF-8 format followed by a single byte of value 2

2815

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2816

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2817

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

2818

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

2819

# a key encryption key (KEK) stored by KMS).

2820

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2821

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2822

# unwrap the data crypto key.

2823

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2824

# The wrapped key must be a 128/192/256 bit key.

2825

# Authorization requires the following IAM permissions when sending a request

2826

# to perform a crypto transformation using a kms-wrapped crypto key:

2827

# dlp.kms.encrypt

2828

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2829

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2830

},

2831

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2832

# leaking the key. Choose another type of key if possible.

2833

"key": "A String", # Required. A 128/192/256 bit key.

2834

},

2835

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2836

# It will be discarded after the request finishes.

2837

"name": "A String", # Required. Name of the key.

2838

# This is an arbitrary string used to differentiate different keys.

2839

# A unique key is generated per name: two separate `TransientCryptoKey`

2840

# protos share the same generated key if their names are the same.

2841

# When the data crypto key is generated, this name is not used in any way

2842

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

2847

# input. Outputs a base64 encoded representation of the encrypted output.

2848

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

2849

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2850

# This annotation will be applied to the surrogate by prefixing it with

2851

# the name of the custom info type followed by the number of

2852

# characters comprising the surrogate. The following scheme defines the

2853

# format: {info type name}({surrogate character count}):{surrogate}

2854

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2855

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

2856

# the surrogate is 'abc', the full replacement value

2857

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2858

#

2859

# This annotation identifies the surrogate when inspecting content using the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2860

# custom info type 'Surrogate'. This facilitates reversal of the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2861

# surrogate when it occurs in free text.

2862

#

2863

# Note: For record transformations where the entire cell in a table is being

2864

# transformed, surrogates are not mandatory. Surrogates are used to denote

2865

# the location of the token and are necessary for re-identification in free

2866

# form text.

2867

#

2868

# In order for inspection to work properly, the name of this info type must

2869

# not occur naturally anywhere in your data; otherwise, inspection may either

2870

#

2871

# - reverse a surrogate that does not correspond to an actual identifier

2872

# - be unable to parse the surrogate and result in an error

2873

#

2874

# Therefore, choose your custom info type name carefully after considering

2875

# what your data looks like. One way to select a name that has a high chance

2876

# of yielding reliable detection is to include one or more unicode characters

2877

# that are highly improbable to exist in your data.

2878

# For example, assuming your data is entered from a regular ASCII keyboard,

2879

# the symbol with the hex code point 29DD might be used like so:

2880

# ⧝MY_TOKEN_TYPE.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2881

"name": "A String", # Name of the information type. Either a name of your choosing when

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2882

# creating a CustomInfoType, or one of the names listed

2883

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2884

# a built-in type. InfoType names should conform to the pattern

2885

# `[a-zA-Z0-9_]{1,64}`.

2886

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2887

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

2888

# referential integrity such that the same identifier in two different

2889

# contexts will be given a distinct surrogate. The context is appended to

2890

# plaintext value being encrypted. On decryption the provided context is

2891

# validated against the value used during encryption. If a context was

2892

# provided during encryption, same context must be provided during decryption

2893

# as well.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2894

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2895

# If the context is not set, plaintext would be used as is for encryption.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2896

# If the context is set but:

2897

#

2898

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2899

# 2. the field is not present when transforming a given value,

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2900

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2901

# plaintext would be used as is for encryption.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2902

#

2903

# Note that case (1) is expected when an `InfoTypeTransformation` is

2904

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2905

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2906

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2907

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

2908

# a key encryption key (KEK) stored by KMS).

2909

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2910

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2911

# unwrap the data crypto key.

2912

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2913

# The wrapped key must be a 128/192/256 bit key.

2914

# Authorization requires the following IAM permissions when sending a request

2915

# to perform a crypto transformation using a kms-wrapped crypto key:

2916

# dlp.kms.encrypt

2917

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2918

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2919

},

2920

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2921

# leaking the key. Choose another type of key if possible.

2922

"key": "A String", # Required. A 128/192/256 bit key.

2923

},

2924

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2925

# It will be discarded after the request finishes.

2926

"name": "A String", # Required. Name of the key.

2927

# This is an arbitrary string used to differentiate different keys.

2928

# A unique key is generated per name: two separate `TransientCryptoKey`

2929

# protos share the same generated key if their names are the same.

2930

# When the data crypto key is generated, this name is not used in any way

2931

# (repeating the api call will result in a different key being generated).

2932

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2933

},

2934

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2935

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

2936

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

2937

# output would be 'My phone number is '.

2938

},

2939

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2940

# replacement values are dynamically provided by the user for custom behavior,

2941

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

2942

# This can be used on

2943

# data of type: number, long, string, timestamp.

2944

# If the bound `Value` type differs from the type of data being transformed, we

2945

# will first attempt converting the type of the data to be transformed to match

2946

# the type of the bound before comparing.

2947

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2948

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2949

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2950

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2951

# used.

2952

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2953

# of bytes considered to comprise a 'Value' is based on its representation

2954

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2955

# 123456789, the number of bytes would be counted as 9, even though an

2956

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2957

"booleanValue": True or False, # boolean

2958

"floatValue": 3.14, # float

2959

"dayOfWeekValue": "A String", # day of week

2960

"timestampValue": "A String", # timestamp

2961

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2962

# and time zone are either specified elsewhere or are not significant. The date

2963

# is relative to the Proleptic Gregorian Calendar. This can represent:

2964

#

2965

# * A full date, with non-zero year, month and day values

2966

# * A month and day value, with a zero year, e.g. an anniversary

2967

# * A year on its own, with zero month and day values

2968

# * A year and month value, with a zero day, e.g. a credit card expiration date

2969

#

2970

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2971

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2972

# a year.

2973

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2974

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2975

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2976

# if specifying a year by itself or a year and month where the day is not

2977

# significant.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

2978

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2979

"stringValue": "A String", # string

2980

"integerValue": "A String", # integer

2981

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2982

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2983

# types are google.type.Date and `google.protobuf.Timestamp`.

2984

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2985

# allow the value 60 if it allows leap-seconds.

2986

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2987

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2988

# to allow the value "24:00:00" for scenarios like business closing time.

2989

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2990

},

2991

},

2992

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

2993

# Note that for the purposes of inspection or transformation, the number

2994

# of bytes considered to comprise a 'Value' is based on its representation

2995

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2996

# 123456789, the number of bytes would be counted as 9, even though an

2997

# int64 only holds up to 8 bytes of data.

2998

"booleanValue": True or False, # boolean

2999

"floatValue": 3.14, # float

3000

"dayOfWeekValue": "A String", # day of week

3001

"timestampValue": "A String", # timestamp

3002

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3003

# and time zone are either specified elsewhere or are not significant. The date

3004

# is relative to the Proleptic Gregorian Calendar. This can represent:

3005

#

3006

# * A full date, with non-zero year, month and day values

3007

# * A month and day value, with a zero year, e.g. an anniversary

3008

# * A year on its own, with zero month and day values

3009

# * A year and month value, with a zero day, e.g. a credit card expiration date

3010

#

3011

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3012

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3013

# a year.

3014

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3015

# month and day.

3016

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3017

# if specifying a year by itself or a year and month where the day is not

3018

# significant.

3019

},

3020

"stringValue": "A String", # string

3021

"integerValue": "A String", # integer

3022

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3023

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3024

# types are google.type.Date and `google.protobuf.Timestamp`.

3025

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3026

# allow the value 60 if it allows leap-seconds.

3027

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3028

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3029

# to allow the value "24:00:00" for scenarios like business closing time.

3030

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3031

},

3032

},

3033

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

3034

# the default behavior will be to hyphenate the min-max range.

3035

# Note that for the purposes of inspection or transformation, the number

3036

# of bytes considered to comprise a 'Value' is based on its representation

3037

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3038

# 123456789, the number of bytes would be counted as 9, even though an

3039

# int64 only holds up to 8 bytes of data.

3040

"booleanValue": True or False, # boolean

3041

"floatValue": 3.14, # float

3042

"dayOfWeekValue": "A String", # day of week

3043

"timestampValue": "A String", # timestamp

3044

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3045

# and time zone are either specified elsewhere or are not significant. The date

3046

# is relative to the Proleptic Gregorian Calendar. This can represent:

3047

#

3048

# * A full date, with non-zero year, month and day values

3049

# * A month and day value, with a zero year, e.g. an anniversary

3050

# * A year on its own, with zero month and day values

3051

# * A year and month value, with a zero day, e.g. a credit card expiration date

3052

#

3053

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3054

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3055

# a year.

3056

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3057

# month and day.

3058

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3059

# if specifying a year by itself or a year and month where the day is not

3060

# significant.

3061

},

3062

"stringValue": "A String", # string

3063

"integerValue": "A String", # integer

3064

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3065

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3066

# types are google.type.Date and `google.protobuf.Timestamp`.

3067

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3068

# allow the value 60 if it allows leap-seconds.

3069

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3070

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3071

# to allow the value "24:00:00" for scenarios like business closing time.

3072

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3073

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3078

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3079

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3080

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3081

# of bytes considered to comprise a 'Value' is based on its representation

3082

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3083

# 123456789, the number of bytes would be counted as 9, even though an

3084

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3085

"booleanValue": True or False, # boolean

3086

"floatValue": 3.14, # float

3087

"dayOfWeekValue": "A String", # day of week

3088

"timestampValue": "A String", # timestamp

3089

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3090

# and time zone are either specified elsewhere or are not significant. The date

3091

# is relative to the Proleptic Gregorian Calendar. This can represent:

3092

#

3093

# * A full date, with non-zero year, month and day values

3094

# * A month and day value, with a zero year, e.g. an anniversary

3095

# * A year on its own, with zero month and day values

3096

# * A year and month value, with a zero day, e.g. a credit card expiration date

3097

#

3098

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3099

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3100

# a year.

3101

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3102

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3103

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3104

# if specifying a year by itself or a year and month where the day is not

3105

# significant.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3106

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3107

"stringValue": "A String", # string

3108

"integerValue": "A String", # integer

3109

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3110

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3111

# types are google.type.Date and `google.protobuf.Timestamp`.

3112

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3113

# allow the value 60 if it allows leap-seconds.

3114

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3115

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3116

# to allow the value "24:00:00" for scenarios like business closing time.

3117

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3118

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3119

},

3120

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3121

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

3122

# fixed character. Masking can start from the beginning or end of the string.

3123

# This can be used on data of any type (numbers, longs, and so on) and when

3124

# de-identifying structured data we'll attempt to preserve the original data's

3125

# type. (This allows you to take a long like 123 and modify it to a string like

3126

# **3.

3127

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

3128

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

3129

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

3130

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

3131

# is `true`, then the string `12345` is masked as `12***`.

3132

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

3133

# characters. For example, if the input string is `555-555-5555` and you

3134

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

3135

# returns `***-**5-5555`.

3136

{ # Characters to skip when doing deidentification of a value. These will be left

3137

# alone and skipped.

3138

"charactersToSkip": "A String", # Characters to not transform when masking.

3139

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

3144

# masked. Skipped characters do not count towards this tally.

3145

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

3146

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

3147

# code or credit card number. This string must have a length of 1. If not

3148

# supplied, this value defaults to `*` for strings, and `0` for digits.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3149

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3150

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

3151

# Bucketing transformation can provide all of this functionality,

3152

# but requires more configuration. This message is provided as a convenience to

3153

# the user for simple bucketing strategies.

3154

#

3155

# The transformed value will be a hyphenated string of

3156

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

3157

# all values that are within this bucket will be replaced with "10-20".

3158

#

3159

# This can be used on data of type: double, long.

3160

#

3161

# If the bound Value type differs from the type of data

3162

# being transformed, we will first attempt converting the type of the data to

3163

# be transformed to match the type of the bound before comparing.

3164

#

3165

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

3166

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

3167

# grouped together into a single bucket; for example if `lower_bound` = 10,

3168

# then all values less than 10 are replaced with the value "-10".

3169

# Note that for the purposes of inspection or transformation, the number

3170

# of bytes considered to comprise a 'Value' is based on its representation

3171

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3172

# 123456789, the number of bytes would be counted as 9, even though an

3173

# int64 only holds up to 8 bytes of data.

3174

"booleanValue": True or False, # boolean

3175

"floatValue": 3.14, # float

3176

"dayOfWeekValue": "A String", # day of week

3177

"timestampValue": "A String", # timestamp

3178

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3179

# and time zone are either specified elsewhere or are not significant. The date

3180

# is relative to the Proleptic Gregorian Calendar. This can represent:

3181

#

3182

# * A full date, with non-zero year, month and day values

3183

# * A month and day value, with a zero year, e.g. an anniversary

3184

# * A year on its own, with zero month and day values

3185

# * A year and month value, with a zero day, e.g. a credit card expiration date

3186

#

3187

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3188

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3189

# a year.

3190

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3191

# month and day.

3192

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3193

# if specifying a year by itself or a year and month where the day is not

3194

# significant.

3195

},

3196

"stringValue": "A String", # string

3197

"integerValue": "A String", # integer

3198

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3199

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3200

# types are google.type.Date and `google.protobuf.Timestamp`.

3201

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3202

# allow the value 60 if it allows leap-seconds.

3203

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3204

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3205

# to allow the value "24:00:00" for scenarios like business closing time.

3206

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3207

},

3208

},

3209

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

3210

# grouped together into a single bucket; for example if `upper_bound` = 89,

3211

# then all values greater than 89 are replaced with the value "89+".

3212

# Note that for the purposes of inspection or transformation, the number

3213

# of bytes considered to comprise a 'Value' is based on its representation

3214

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3215

# 123456789, the number of bytes would be counted as 9, even though an

3216

# int64 only holds up to 8 bytes of data.

3217

"booleanValue": True or False, # boolean

3218

"floatValue": 3.14, # float

3219

"dayOfWeekValue": "A String", # day of week

3220

"timestampValue": "A String", # timestamp

3221

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3222

# and time zone are either specified elsewhere or are not significant. The date

3223

# is relative to the Proleptic Gregorian Calendar. This can represent:

3224

#

3225

# * A full date, with non-zero year, month and day values

3226

# * A month and day value, with a zero year, e.g. an anniversary

3227

# * A year on its own, with zero month and day values

3228

# * A year and month value, with a zero day, e.g. a credit card expiration date

3229

#

3230

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3231

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3232

# a year.

3233

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3234

# month and day.

3235

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3236

# if specifying a year by itself or a year and month where the day is not

3237

# significant.

3238

},

3239

"stringValue": "A String", # string

3240

"integerValue": "A String", # integer

3241

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3242

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3243

# types are google.type.Date and `google.protobuf.Timestamp`.

3244

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3245

# allow the value 60 if it allows leap-seconds.

3246

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3247

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3248

# to allow the value "24:00:00" for scenarios like business closing time.

3249

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3250

},

3251

},

3252

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

3253

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

3254

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

3255

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

3256

},

3257

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

3258

},

3259

],

3260

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3261

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

3262

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

3263

# portion of the value.

3264

"partToExtract": "A String", # The part of the time to keep.

3265

},

3266

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

3267

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

3268

# to learn more.

3269

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

3270

# If set, must also set cryptoKey. If set, shift will be consistent for the

3271

# given context.

3272

"name": "A String", # Name describing the field.

3273

},

3274

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

3275

# range (inclusive ends). Negative means shift to earlier in time. Must not

3276

# be more than 365250 days (1000 years) each direction.

3277

#

3278

# For example, 3 means shift date to at most 3 days into the future.

3279

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3280

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

3281

# results in the same shift for the same context and crypto_key. If

3282

# set, must also set context. Can only be applied to table items.

3283

# a key encryption key (KEK) stored by KMS).

3284

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3285

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3286

# unwrap the data crypto key.

3287

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3288

# The wrapped key must be a 128/192/256 bit key.

3289

# Authorization requires the following IAM permissions when sending a request

3290

# to perform a crypto transformation using a kms-wrapped crypto key:

3291

# dlp.kms.encrypt

3292

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3293

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3294

},

3295

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3296

# leaking the key. Choose another type of key if possible.

3297

"key": "A String", # Required. A 128/192/256 bit key.

3298

},

3299

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3300

# It will be discarded after the request finishes.

3301

"name": "A String", # Required. Name of the key.

3302

# This is an arbitrary string used to differentiate different keys.

3303

# A unique key is generated per name: two separate `TransientCryptoKey`

3304

# protos share the same generated key if their names are the same.

3305

# When the data crypto key is generated, this name is not used in any way

3306

# (repeating the api call will result in a different key being generated).

},

},

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3311

},

3312

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

3313

# Uses SHA-256.

3314

# The key size must be either 32 or 64 bytes.

3315

# Outputs a base64 encoded representation of the hashed output

3316

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

3317

# Currently, only string and integer values can be hashed.

3318

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

3319

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

3320

# a key encryption key (KEK) stored by KMS).

3321

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3322

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3323

# unwrap the data crypto key.

3324

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3325

# The wrapped key must be a 128/192/256 bit key.

3326

# Authorization requires the following IAM permissions when sending a request

3327

# to perform a crypto transformation using a kms-wrapped crypto key:

3328

# dlp.kms.encrypt

3329

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3330

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3331

},

3332

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3333

# leaking the key. Choose another type of key if possible.

3334

"key": "A String", # Required. A 128/192/256 bit key.

3335

},

3336

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3337

# It will be discarded after the request finishes.

3338

"name": "A String", # Required. Name of the key.

3339

# This is an arbitrary string used to differentiate different keys.

3340

# A unique key is generated per name: two separate `TransientCryptoKey`

3341

# protos share the same generated key if their names are the same.

3342

# When the data crypto key is generated, this name is not used in any way

3343

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

3348

# (FPE) with the FFX mode of operation; however when used in the

3349

# `ReidentifyContent` API method, it serves the opposite function by reversing

3350

# the surrogate back into the original identifier. The identifier must be

3351

# encoded as ASCII. For a given crypto key and context, the same identifier

3352

# will be replaced with the same surrogate. Identifiers must be at least two

3353

# characters long. In the case that the identifier is the empty string, it will

3354

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

3355

# more.

3356

#

3357

# Note: We recommend using CryptoDeterministicConfig for all use cases which

3358

# do not require preserving the input alphabet space and size, plus warrant

3359

# referential integrity.

3360

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

3361

# that the FFX mode natively supports. This happens before/after

3362

# encryption/decryption.

3363

# Each character listed must appear only once.

3364

# Number of characters must be in the range [2, 95].

3365

# This must be encoded as ASCII.

3366

# The order of characters does not matter.

3367

"commonAlphabet": "A String", # Common alphabets.

3368

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

3369

# This annotation will be applied to the surrogate by prefixing it with

3370

# the name of the custom infoType followed by the number of

3371

# characters comprising the surrogate. The following scheme defines the

3372

# format: info_type_name(surrogate_character_count):surrogate

3373

#

3374

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

3375

# the surrogate is 'abc', the full replacement value

3376

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

3377

#

3378

# This annotation identifies the surrogate when inspecting content using the

3379

# custom infoType

3380

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

3381

# This facilitates reversal of the surrogate when it occurs in free text.

3382

#

3383

# In order for inspection to work properly, the name of this infoType must

3384

# not occur naturally anywhere in your data; otherwise, inspection may

3385

# find a surrogate that does not correspond to an actual identifier.

3386

# Therefore, choose your custom infoType name carefully after considering

3387

# what your data looks like. One way to select a name that has a high chance

3388

# of yielding reliable detection is to include one or more unicode characters

3389

# that are highly improbable to exist in your data.

3390

# For example, assuming your data is entered from a regular ASCII keyboard,

3391

# the symbol with the hex code point 29DD might be used like so:

3392

# ⧝MY_TOKEN_TYPE

3393

"name": "A String", # Name of the information type. Either a name of your choosing when

3394

# creating a CustomInfoType, or one of the names listed

3395

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

3396

# a built-in type. InfoType names should conform to the pattern

3397

# `[a-zA-Z0-9_]{1,64}`.

3398

},

3399

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

3400

# identifier in two different contexts won't be given the same surrogate. If

3401

# the context is not set, a default tweak will be used.

3402

#

3403

# If the context is set but:

3404

#

3405

# 1. there is no record present when transforming a given value or

3406

# 1. the field is not present when transforming a given value,

3407

#

3408

# a default tweak will be used.

3409

#

3410

# Note that case (1) is expected when an `InfoTypeTransformation` is

3411

# applied to both structured and non-structured `ContentItem`s.

3412

# Currently, the referenced field may be of value type integer or string.

3413

#

3414

# The tweak is constructed as a sequence of bytes in big endian byte order

3415

# such that:

3416

#

3417

# - a 64 bit integer is encoded followed by a single byte of value 1

3418

# - a string is encoded in UTF-8 format followed by a single byte of value 2

3419

"name": "A String", # Name describing the field.

3420

},

3421

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

3422

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

3423

# a key encryption key (KEK) stored by KMS).

3424

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3425

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3426

# unwrap the data crypto key.

3427

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3428

# The wrapped key must be a 128/192/256 bit key.

3429

# Authorization requires the following IAM permissions when sending a request

3430

# to perform a crypto transformation using a kms-wrapped crypto key:

3431

# dlp.kms.encrypt

3432

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3433

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3434

},

3435

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3436

# leaking the key. Choose another type of key if possible.

3437

"key": "A String", # Required. A 128/192/256 bit key.

3438

},

3439

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3440

# It will be discarded after the request finishes.

3441

"name": "A String", # Required. Name of the key.

3442

# This is an arbitrary string used to differentiate different keys.

3443

# A unique key is generated per name: two separate `TransientCryptoKey`

3444

# protos share the same generated key if their names are the same.

3445

# When the data crypto key is generated, this name is not used in any way

3446

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

3451

# input. Outputs a base64 encoded representation of the encrypted output.

3452

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

3453

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

3454

# This annotation will be applied to the surrogate by prefixing it with

3455

# the name of the custom info type followed by the number of

3456

# characters comprising the surrogate. The following scheme defines the

3457

# format: {info type name}({surrogate character count}):{surrogate}

3458

#

3459

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

3460

# the surrogate is 'abc', the full replacement value

3461

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

3462

#

3463

# This annotation identifies the surrogate when inspecting content using the

3464

# custom info type 'Surrogate'. This facilitates reversal of the

3465

# surrogate when it occurs in free text.

3466

#

3467

# Note: For record transformations where the entire cell in a table is being

3468

# transformed, surrogates are not mandatory. Surrogates are used to denote

3469

# the location of the token and are necessary for re-identification in free

3470

# form text.

3471

#

3472

# In order for inspection to work properly, the name of this info type must

3473

# not occur naturally anywhere in your data; otherwise, inspection may either

3474

#

3475

# - reverse a surrogate that does not correspond to an actual identifier

3476

# - be unable to parse the surrogate and result in an error

3477

#

3478

# Therefore, choose your custom info type name carefully after considering

3479

# what your data looks like. One way to select a name that has a high chance

3480

# of yielding reliable detection is to include one or more unicode characters

3481

# that are highly improbable to exist in your data.

3482

# For example, assuming your data is entered from a regular ASCII keyboard,

3483

# the symbol with the hex code point 29DD might be used like so:

3484

# ⧝MY_TOKEN_TYPE.

3485

"name": "A String", # Name of the information type. Either a name of your choosing when

3486

# creating a CustomInfoType, or one of the names listed

3487

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

3488

# a built-in type. InfoType names should conform to the pattern

3489

# `[a-zA-Z0-9_]{1,64}`.

3490

},

3491

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

3492

# referential integrity such that the same identifier in two different

3493

# contexts will be given a distinct surrogate. The context is appended to

3494

# plaintext value being encrypted. On decryption the provided context is

3495

# validated against the value used during encryption. If a context was

3496

# provided during encryption, same context must be provided during decryption

3497

# as well.

3498

#

3499

# If the context is not set, plaintext would be used as is for encryption.

3500

# If the context is set but:

3501

#

3502

# 1. there is no record present when transforming a given value or

3503

# 2. the field is not present when transforming a given value,

3504

#

3505

# plaintext would be used as is for encryption.

3506

#

3507

# Note that case (1) is expected when an `InfoTypeTransformation` is

3508

# applied to both structured and non-structured `ContentItem`s.

3509

"name": "A String", # Name describing the field.

3510

},

3511

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

3512

# a key encryption key (KEK) stored by KMS).

3513

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3514

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3515

# unwrap the data crypto key.

3516

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3517

# The wrapped key must be a 128/192/256 bit key.

3518

# Authorization requires the following IAM permissions when sending a request

3519

# to perform a crypto transformation using a kms-wrapped crypto key:

3520

# dlp.kms.encrypt

3521

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3522

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3523

},

3524

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3525

# leaking the key. Choose another type of key if possible.

3526

"key": "A String", # Required. A 128/192/256 bit key.

3527

},

3528

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3529

# It will be discarded after the request finishes.

3530

"name": "A String", # Required. Name of the key.

3531

# This is an arbitrary string used to differentiate different keys.

3532

# A unique key is generated per name: two separate `TransientCryptoKey`

3533

# protos share the same generated key if their names are the same.

3534

# When the data crypto key is generated, this name is not used in any way

3535

# (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

3540

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

3541

# output would be 'My phone number is '.

3542

},

3543

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

3544

# replacement values are dynamically provided by the user for custom behavior,

3545

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

3546

# This can be used on

3547

# data of type: number, long, string, timestamp.

3548

# If the bound `Value` type differs from the type of data being transformed, we

3549

# will first attempt converting the type of the data to be transformed to match

3550

# the type of the bound before comparing.

3551

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

3552

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

3553

{ # Bucket is represented as a range, along with replacement values.

3554

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

3555

# used.

3556

# Note that for the purposes of inspection or transformation, the number

3557

# of bytes considered to comprise a 'Value' is based on its representation

3558

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3559

# 123456789, the number of bytes would be counted as 9, even though an

3560

# int64 only holds up to 8 bytes of data.

3561

"booleanValue": True or False, # boolean

3562

"floatValue": 3.14, # float

3563

"dayOfWeekValue": "A String", # day of week

3564

"timestampValue": "A String", # timestamp

3565

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3566

# and time zone are either specified elsewhere or are not significant. The date

3567

# is relative to the Proleptic Gregorian Calendar. This can represent:

3568

#

3569

# * A full date, with non-zero year, month and day values

3570

# * A month and day value, with a zero year, e.g. an anniversary

3571

# * A year on its own, with zero month and day values

3572

# * A year and month value, with a zero day, e.g. a credit card expiration date

3573

#

3574

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3575

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3576

# a year.

3577

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3578

# month and day.

3579

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3580

# if specifying a year by itself or a year and month where the day is not

3581

# significant.

3582

},

3583

"stringValue": "A String", # string

3584

"integerValue": "A String", # integer

3585

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3586

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3587

# types are google.type.Date and `google.protobuf.Timestamp`.

3588

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3589

# allow the value 60 if it allows leap-seconds.

3590

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3591

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3592

# to allow the value "24:00:00" for scenarios like business closing time.

3593

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3594

},

3595

},

3596

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

3597

# Note that for the purposes of inspection or transformation, the number

3598

# of bytes considered to comprise a 'Value' is based on its representation

3599

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3600

# 123456789, the number of bytes would be counted as 9, even though an

3601

# int64 only holds up to 8 bytes of data.

3602

"booleanValue": True or False, # boolean

3603

"floatValue": 3.14, # float

3604

"dayOfWeekValue": "A String", # day of week

3605

"timestampValue": "A String", # timestamp

3606

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3607

# and time zone are either specified elsewhere or are not significant. The date

3608

# is relative to the Proleptic Gregorian Calendar. This can represent:

3609

#

3610

# * A full date, with non-zero year, month and day values

3611

# * A month and day value, with a zero year, e.g. an anniversary

3612

# * A year on its own, with zero month and day values

3613

# * A year and month value, with a zero day, e.g. a credit card expiration date

3614

#

3615

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3616

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3617

# a year.

3618

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3619

# month and day.

3620

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3621

# if specifying a year by itself or a year and month where the day is not

3622

# significant.

3623

},

3624

"stringValue": "A String", # string

3625

"integerValue": "A String", # integer

3626

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3627

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3628

# types are google.type.Date and `google.protobuf.Timestamp`.

3629

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3630

# allow the value 60 if it allows leap-seconds.

3631

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3632

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3633

# to allow the value "24:00:00" for scenarios like business closing time.

3634

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3635

},

3636

},

3637

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

3638

# the default behavior will be to hyphenate the min-max range.

3639

# Note that for the purposes of inspection or transformation, the number

3640

# of bytes considered to comprise a 'Value' is based on its representation

3641

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3642

# 123456789, the number of bytes would be counted as 9, even though an

3643

# int64 only holds up to 8 bytes of data.

3644

"booleanValue": True or False, # boolean

3645

"floatValue": 3.14, # float

3646

"dayOfWeekValue": "A String", # day of week

3647

"timestampValue": "A String", # timestamp

3648

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3649

# and time zone are either specified elsewhere or are not significant. The date

3650

# is relative to the Proleptic Gregorian Calendar. This can represent:

3651

#

3652

# * A full date, with non-zero year, month and day values

3653

# * A month and day value, with a zero year, e.g. an anniversary

3654

# * A year on its own, with zero month and day values

3655

# * A year and month value, with a zero day, e.g. a credit card expiration date

3656

#

3657

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3658

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3659

# a year.

3660

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3661

# month and day.

3662

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3663

# if specifying a year by itself or a year and month where the day is not

3664

# significant.

3665

},

3666

"stringValue": "A String", # string

3667

"integerValue": "A String", # integer

3668

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3669

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3670

# types are google.type.Date and `google.protobuf.Timestamp`.

3671

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3672

# allow the value 60 if it allows leap-seconds.

3673

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3674

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3675

# to allow the value "24:00:00" for scenarios like business closing time.

3676

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

],

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3683

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

3684

# Note that for the purposes of inspection or transformation, the number

3685

# of bytes considered to comprise a 'Value' is based on its representation

3686

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3687

# 123456789, the number of bytes would be counted as 9, even though an

3688

# int64 only holds up to 8 bytes of data.

3689

"booleanValue": True or False, # boolean

3690

"floatValue": 3.14, # float

3691

"dayOfWeekValue": "A String", # day of week

3692

"timestampValue": "A String", # timestamp

3693

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3694

# and time zone are either specified elsewhere or are not significant. The date

3695

# is relative to the Proleptic Gregorian Calendar. This can represent:

3696

#

3697

# * A full date, with non-zero year, month and day values

3698

# * A month and day value, with a zero year, e.g. an anniversary

3699

# * A year on its own, with zero month and day values

3700

# * A year and month value, with a zero day, e.g. a credit card expiration date

3701

#

3702

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3703

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3704

# a year.

3705

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3706

# month and day.

3707

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3708

# if specifying a year by itself or a year and month where the day is not

3709

# significant.

3710

},

3711

"stringValue": "A String", # string

3712

"integerValue": "A String", # integer

3713

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3714

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3715

# types are google.type.Date and `google.protobuf.Timestamp`.

3716

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3717

# allow the value 60 if it allows leap-seconds.

3718

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3719

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3720

# to allow the value "24:00:00" for scenarios like business closing time.

3721

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

3726

# fixed character. Masking can start from the beginning or end of the string.

3727

# This can be used on data of any type (numbers, longs, and so on) and when

3728

# de-identifying structured data we'll attempt to preserve the original data's

3729

# type. (This allows you to take a long like 123 and modify it to a string like

3730

# **3.

3731

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

3732

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

3733

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

3734

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

3735

# is `true`, then the string `12345` is masked as `12***`.

3736

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

3737

# characters. For example, if the input string is `555-555-5555` and you

3738

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

3739

# returns `***-**5-5555`.

3740

{ # Characters to skip when doing deidentification of a value. These will be left

3741

# alone and skipped.

3742

"charactersToSkip": "A String", # Characters to not transform when masking.

3743

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

3748

# masked. Skipped characters do not count towards this tally.

3749

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

3750

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

3751

# code or credit card number. This string must have a length of 1. If not

3752

# supplied, this value defaults to `*` for strings, and `0` for digits.

3753

},

3754

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

3755

# Bucketing transformation can provide all of this functionality,

3756

# but requires more configuration. This message is provided as a convenience to

3757

# the user for simple bucketing strategies.

3758

#

3759

# The transformed value will be a hyphenated string of

3760

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

3761

# all values that are within this bucket will be replaced with "10-20".

3762

#

3763

# This can be used on data of type: double, long.

3764

#

3765

# If the bound Value type differs from the type of data

3766

# being transformed, we will first attempt converting the type of the data to

3767

# be transformed to match the type of the bound before comparing.

3768

#

3769

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

3770

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

3771

# grouped together into a single bucket; for example if `lower_bound` = 10,

3772

# then all values less than 10 are replaced with the value "-10".

3773

# Note that for the purposes of inspection or transformation, the number

3774

# of bytes considered to comprise a 'Value' is based on its representation

3775

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3776

# 123456789, the number of bytes would be counted as 9, even though an

3777

# int64 only holds up to 8 bytes of data.

3778

"booleanValue": True or False, # boolean

3779

"floatValue": 3.14, # float

3780

"dayOfWeekValue": "A String", # day of week

3781

"timestampValue": "A String", # timestamp

3782

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3783

# and time zone are either specified elsewhere or are not significant. The date

3784

# is relative to the Proleptic Gregorian Calendar. This can represent:

3785

#

3786

# * A full date, with non-zero year, month and day values

3787

# * A month and day value, with a zero year, e.g. an anniversary

3788

# * A year on its own, with zero month and day values

3789

# * A year and month value, with a zero day, e.g. a credit card expiration date

3790

#

3791

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3792

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3793

# a year.

3794

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3795

# month and day.

3796

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3797

# if specifying a year by itself or a year and month where the day is not

3798

# significant.

3799

},

3800

"stringValue": "A String", # string

3801

"integerValue": "A String", # integer

3802

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3803

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3804

# types are google.type.Date and `google.protobuf.Timestamp`.

3805

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3806

# allow the value 60 if it allows leap-seconds.

3807

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3808

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3809

# to allow the value "24:00:00" for scenarios like business closing time.

3810

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3811

},

3812

},

3813

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

3814

# grouped together into a single bucket; for example if `upper_bound` = 89,

3815

# then all values greater than 89 are replaced with the value "89+".

3816

# Note that for the purposes of inspection or transformation, the number

3817

# of bytes considered to comprise a 'Value' is based on its representation

3818

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3819

# 123456789, the number of bytes would be counted as 9, even though an

3820

# int64 only holds up to 8 bytes of data.

3821

"booleanValue": True or False, # boolean

3822

"floatValue": 3.14, # float

3823

"dayOfWeekValue": "A String", # day of week

3824

"timestampValue": "A String", # timestamp

3825

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3826

# and time zone are either specified elsewhere or are not significant. The date

3827

# is relative to the Proleptic Gregorian Calendar. This can represent:

3828

#

3829

# * A full date, with non-zero year, month and day values

3830

# * A month and day value, with a zero year, e.g. an anniversary

3831

# * A year on its own, with zero month and day values

3832

# * A year and month value, with a zero day, e.g. a credit card expiration date

3833

#

3834

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3835

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3836

# a year.

3837

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3838

# month and day.

3839

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3840

# if specifying a year by itself or a year and month where the day is not

3841

# significant.

3842

},

3843

"stringValue": "A String", # string

3844

"integerValue": "A String", # integer

3845

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3846

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3847

# types are google.type.Date and `google.protobuf.Timestamp`.

3848

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3849

# allow the value 60 if it allows leap-seconds.

3850

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3851

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3852

# to allow the value "24:00:00" for scenarios like business closing time.

3853

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3854

},

3855

},

3856

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

3857

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

3858

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

3859

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

3860

},

3861

},

3862

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

3863

# given `RecordCondition`. The conditions are allowed to reference fields

3864

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

3869

# column for the same record is within a specific range.

3870

# - Redact a field if the date of birth field is greater than 85.

3871

# a field.

3872

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

3873

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

3874

# only supported value is `AND`.

3875

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

3876

"conditions": [ # A collection of conditions.

3877

{ # The field type of `value` and `field` do not need to match to be

3878

# considered equal, but not all comparisons are possible.

3879

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

3880

# but all other comparisons are invalid with incompatible types.

3881

# A `value` of type:

3882

#

3883

# - `string` can be compared against all other types

3884

# - `boolean` can only be compared against other booleans

3885

# - `integer` can be compared against doubles or a string if the string value

3886

# can be parsed as an integer.

3887

# - `double` can be compared against integers or a string if the string can

3888

# be parsed as a double.

3889

# - `Timestamp` can be compared against strings in RFC 3339 date string

3890

# format.

3891

# - `TimeOfDay` can be compared against timestamps and strings in the format

3892

# of 'HH:mm:ss'.

3893

#

3894

# If we fail to compare do to type mismatch, a warning will be given and

3895

# the condition will evaluate to false.

3896

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

3897

"name": "A String", # Name describing the field.

3898

},

3899

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

3900

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

3901

# Note that for the purposes of inspection or transformation, the number

3902

# of bytes considered to comprise a 'Value' is based on its representation

3903

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3904

# 123456789, the number of bytes would be counted as 9, even though an

3905

# int64 only holds up to 8 bytes of data.

3906

"booleanValue": True or False, # boolean

3907

"floatValue": 3.14, # float

3908

"dayOfWeekValue": "A String", # day of week

3909

"timestampValue": "A String", # timestamp

3910

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3911

# and time zone are either specified elsewhere or are not significant. The date

3912

# is relative to the Proleptic Gregorian Calendar. This can represent:

3913

#

3914

# * A full date, with non-zero year, month and day values

3915

# * A month and day value, with a zero year, e.g. an anniversary

3916

# * A year on its own, with zero month and day values

3917

# * A year and month value, with a zero day, e.g. a credit card expiration date

3918

#

3919

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3920

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3921

# a year.

3922

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3923

# month and day.

3924

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3925

# if specifying a year by itself or a year and month where the day is not

3926

# significant.

3927

},

3928

"stringValue": "A String", # string

3929

"integerValue": "A String", # integer

3930

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3931

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3932

# types are google.type.Date and `google.protobuf.Timestamp`.

3933

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3934

# allow the value 60 if it allows leap-seconds.

3935

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3936

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3937

# to allow the value "24:00:00" for scenarios like business closing time.

3938

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

],

},

},

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3946

},

3947

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3948

"field": { # General identifier of a data field in a storage service. # Set if the transformation was limited to a specific FieldId.

3949

"name": "A String", # Name describing the field.

3950

},

3951

"transformation": { # A rule for transforming a value. # The specific transformation these stats apply to.

3952

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

3953

# portion of the value.

3954

"partToExtract": "A String", # The part of the time to keep.

3955

},

3956

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

3957

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

3958

# to learn more.

3959

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

3960

# If set, must also set cryptoKey. If set, shift will be consistent for the

3961

# given context.

3962

"name": "A String", # Name describing the field.

3963

},

3964

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

3965

# range (inclusive ends). Negative means shift to earlier in time. Must not

3966

# be more than 365250 days (1000 years) each direction.

3967

#

3968

# For example, 3 means shift date to at most 3 days into the future.

3969

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3970

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

3971

# results in the same shift for the same context and crypto_key. If

3972

# set, must also set context. Can only be applied to table items.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3973

# a key encryption key (KEK) stored by KMS).

3974

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3975

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3976

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3977

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3978

# The wrapped key must be a 128/192/256 bit key.

3979

# Authorization requires the following IAM permissions when sending a request

3980

# to perform a crypto transformation using a kms-wrapped crypto key:

3981

# dlp.kms.encrypt

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3982

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3983

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3984

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3985

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3986

# leaking the key. Choose another type of key if possible.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3987

"key": "A String", # Required. A 128/192/256 bit key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3988

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3989

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3990

# It will be discarded after the request finishes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3991

"name": "A String", # Required. Name of the key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

3992

# This is an arbitrary string used to differentiate different keys.

3993

# A unique key is generated per name: two separate `TransientCryptoKey`

3994

# protos share the same generated key if their names are the same.

3995

# When the data crypto key is generated, this name is not used in any way

3996

# (repeating the api call will result in a different key being generated).

3997

},

3998

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3999

},

4000

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

4001

},

4002

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

4003

# Uses SHA-256.

4004

# The key size must be either 32 or 64 bytes.

4005

# Outputs a base64 encoded representation of the hashed output

4006

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

4007

# Currently, only string and integer values can be hashed.

4008

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

4009

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

4010

# a key encryption key (KEK) stored by KMS).

4011

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

4012

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

4013

# unwrap the data crypto key.

4014

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

4015

# The wrapped key must be a 128/192/256 bit key.

4016

# Authorization requires the following IAM permissions when sending a request

4017

# to perform a crypto transformation using a kms-wrapped crypto key:

4018

# dlp.kms.encrypt

4019

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4020

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4021

},

4022

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

4023

# leaking the key. Choose another type of key if possible.

4024

"key": "A String", # Required. A 128/192/256 bit key.

4025

},

4026

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

4027

# It will be discarded after the request finishes.

4028

"name": "A String", # Required. Name of the key.

4029

# This is an arbitrary string used to differentiate different keys.

4030

# A unique key is generated per name: two separate `TransientCryptoKey`

4031

# protos share the same generated key if their names are the same.

4032

# When the data crypto key is generated, this name is not used in any way

4033

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

4038

# (FPE) with the FFX mode of operation; however when used in the

4039

# `ReidentifyContent` API method, it serves the opposite function by reversing

4040

# the surrogate back into the original identifier. The identifier must be

4041

# encoded as ASCII. For a given crypto key and context, the same identifier

4042

# will be replaced with the same surrogate. Identifiers must be at least two

4043

# characters long. In the case that the identifier is the empty string, it will

4044

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

4045

# more.

4046

#

4047

# Note: We recommend using CryptoDeterministicConfig for all use cases which

4048

# do not require preserving the input alphabet space and size, plus warrant

4049

# referential integrity.

4050

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

4051

# that the FFX mode natively supports. This happens before/after

4052

# encryption/decryption.

4053

# Each character listed must appear only once.

4054

# Number of characters must be in the range [2, 95].

4055

# This must be encoded as ASCII.

4056

# The order of characters does not matter.

4057

"commonAlphabet": "A String", # Common alphabets.

4058

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

4059

# This annotation will be applied to the surrogate by prefixing it with

4060

# the name of the custom infoType followed by the number of

4061

# characters comprising the surrogate. The following scheme defines the

4062

# format: info_type_name(surrogate_character_count):surrogate

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4063

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4064

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

4065

# the surrogate is 'abc', the full replacement value

4066

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

4067

#

4068

# This annotation identifies the surrogate when inspecting content using the

4069

# custom infoType

4070

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

4071

# This facilitates reversal of the surrogate when it occurs in free text.

4072

#

4073

# In order for inspection to work properly, the name of this infoType must

4074

# not occur naturally anywhere in your data; otherwise, inspection may

4075

# find a surrogate that does not correspond to an actual identifier.

4076

# Therefore, choose your custom infoType name carefully after considering

4077

# what your data looks like. One way to select a name that has a high chance

4078

# of yielding reliable detection is to include one or more unicode characters

4079

# that are highly improbable to exist in your data.

4080

# For example, assuming your data is entered from a regular ASCII keyboard,

4081

# the symbol with the hex code point 29DD might be used like so:

4082

# ⧝MY_TOKEN_TYPE

4083

"name": "A String", # Name of the information type. Either a name of your choosing when

4084

# creating a CustomInfoType, or one of the names listed

4085

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4086

# a built-in type. InfoType names should conform to the pattern

4087

# `[a-zA-Z0-9_]{1,64}`.

4088

},

4089

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

4090

# identifier in two different contexts won't be given the same surrogate. If

4091

# the context is not set, a default tweak will be used.

4092

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4093

# If the context is set but:

4094

#

4095

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4096

# 1. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4097

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4098

# a default tweak will be used.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4099

#

4100

# Note that case (1) is expected when an `InfoTypeTransformation` is

4101

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4102

# Currently, the referenced field may be of value type integer or string.

4103

#

4104

# The tweak is constructed as a sequence of bytes in big endian byte order

4105

# such that:

4106

#

4107

# - a 64 bit integer is encoded followed by a single byte of value 1

4108

# - a string is encoded in UTF-8 format followed by a single byte of value 2

4109

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4110

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4111

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

4112

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

4113

# a key encryption key (KEK) stored by KMS).

4114

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

4115

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

4116

# unwrap the data crypto key.

4117

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

4118

# The wrapped key must be a 128/192/256 bit key.

4119

# Authorization requires the following IAM permissions when sending a request

4120

# to perform a crypto transformation using a kms-wrapped crypto key:

4121

# dlp.kms.encrypt

4122

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4123

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4124

},

4125

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

4126

# leaking the key. Choose another type of key if possible.

4127

"key": "A String", # Required. A 128/192/256 bit key.

4128

},

4129

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

4130

# It will be discarded after the request finishes.

4131

"name": "A String", # Required. Name of the key.

4132

# This is an arbitrary string used to differentiate different keys.

4133

# A unique key is generated per name: two separate `TransientCryptoKey`

4134

# protos share the same generated key if their names are the same.

4135

# When the data crypto key is generated, this name is not used in any way

4136

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

4141

# input. Outputs a base64 encoded representation of the encrypted output.

4142

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

4143

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4144

# This annotation will be applied to the surrogate by prefixing it with

4145

# the name of the custom info type followed by the number of

4146

# characters comprising the surrogate. The following scheme defines the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4147

# format: {info type name}({surrogate character count}):{surrogate}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4148

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4149

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

4150

# the surrogate is 'abc', the full replacement value

4151

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4152

#

4153

# This annotation identifies the surrogate when inspecting content using the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4154

# custom info type 'Surrogate'. This facilitates reversal of the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4155

# surrogate when it occurs in free text.

4156

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4157

# Note: For record transformations where the entire cell in a table is being

4158

# transformed, surrogates are not mandatory. Surrogates are used to denote

4159

# the location of the token and are necessary for re-identification in free

4160

# form text.

4161

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4162

# In order for inspection to work properly, the name of this info type must

4163

# not occur naturally anywhere in your data; otherwise, inspection may either

4164

#

4165

# - reverse a surrogate that does not correspond to an actual identifier

4166

# - be unable to parse the surrogate and result in an error

4167

#

4168

# Therefore, choose your custom info type name carefully after considering

4169

# what your data looks like. One way to select a name that has a high chance

4170

# of yielding reliable detection is to include one or more unicode characters

4171

# that are highly improbable to exist in your data.

4172

# For example, assuming your data is entered from a regular ASCII keyboard,

4173

# the symbol with the hex code point 29DD might be used like so:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4174

# ⧝MY_TOKEN_TYPE.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4175

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4176

# creating a CustomInfoType, or one of the names listed

4177

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4178

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4179

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4180

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4181

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

4182

# referential integrity such that the same identifier in two different

4183

# contexts will be given a distinct surrogate. The context is appended to

4184

# plaintext value being encrypted. On decryption the provided context is

4185

# validated against the value used during encryption. If a context was

4186

# provided during encryption, same context must be provided during decryption

4187

# as well.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4188

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4189

# If the context is not set, plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4190

# If the context is set but:

4191

#

4192

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4193

# 2. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4194

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4195

# plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4196

#

4197

# Note that case (1) is expected when an `InfoTypeTransformation` is

4198

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4199

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4200

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4201

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

4202

# a key encryption key (KEK) stored by KMS).

4203

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

4204

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

4205

# unwrap the data crypto key.

4206

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

4207

# The wrapped key must be a 128/192/256 bit key.

4208

# Authorization requires the following IAM permissions when sending a request

4209

# to perform a crypto transformation using a kms-wrapped crypto key:

4210

# dlp.kms.encrypt

4211

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4212

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4213

},

4214

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

4215

# leaking the key. Choose another type of key if possible.

4216

"key": "A String", # Required. A 128/192/256 bit key.

4217

},

4218

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

4219

# It will be discarded after the request finishes.

4220

"name": "A String", # Required. Name of the key.

4221

# This is an arbitrary string used to differentiate different keys.

4222

# A unique key is generated per name: two separate `TransientCryptoKey`

4223

# protos share the same generated key if their names are the same.

4224

# When the data crypto key is generated, this name is not used in any way

4225

# (repeating the api call will result in a different key being generated).

4226

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4227

},

4228

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4229

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

4230

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

4231

# output would be 'My phone number is '.

4232

},

4233

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4234

# replacement values are dynamically provided by the user for custom behavior,

4235

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

4236

# This can be used on

4237

# data of type: number, long, string, timestamp.

4238

# If the bound `Value` type differs from the type of data being transformed, we

4239

# will first attempt converting the type of the data to be transformed to match

4240

# the type of the bound before comparing.

4241

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4242

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4243

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4244

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4245

# used.

4246

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4247

# of bytes considered to comprise a 'Value' is based on its representation

4248

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4249

# 123456789, the number of bytes would be counted as 9, even though an

4250

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4251

"booleanValue": True or False, # boolean

4252

"floatValue": 3.14, # float

4253

"dayOfWeekValue": "A String", # day of week

4254

"timestampValue": "A String", # timestamp

4255

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4256

# and time zone are either specified elsewhere or are not significant. The date

4257

# is relative to the Proleptic Gregorian Calendar. This can represent:

4258

#

4259

# * A full date, with non-zero year, month and day values

4260

# * A month and day value, with a zero year, e.g. an anniversary

4261

# * A year on its own, with zero month and day values

4262

# * A year and month value, with a zero day, e.g. a credit card expiration date

4263

#

4264

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4265

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4266

# a year.

4267

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4268

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4269

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4270

# if specifying a year by itself or a year and month where the day is not

4271

# significant.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4272

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4273

"stringValue": "A String", # string

4274

"integerValue": "A String", # integer

4275

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4276

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4277

# types are google.type.Date and `google.protobuf.Timestamp`.

4278

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4279

# allow the value 60 if it allows leap-seconds.

4280

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4281

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4282

# to allow the value "24:00:00" for scenarios like business closing time.

4283

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4284

},

4285

},

4286

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

4287

# Note that for the purposes of inspection or transformation, the number

4288

# of bytes considered to comprise a 'Value' is based on its representation

4289

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4290

# 123456789, the number of bytes would be counted as 9, even though an

4291

# int64 only holds up to 8 bytes of data.

4292

"booleanValue": True or False, # boolean

4293

"floatValue": 3.14, # float

4294

"dayOfWeekValue": "A String", # day of week

4295

"timestampValue": "A String", # timestamp

4296

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4297

# and time zone are either specified elsewhere or are not significant. The date

4298

# is relative to the Proleptic Gregorian Calendar. This can represent:

4299

#

4300

# * A full date, with non-zero year, month and day values

4301

# * A month and day value, with a zero year, e.g. an anniversary

4302

# * A year on its own, with zero month and day values

4303

# * A year and month value, with a zero day, e.g. a credit card expiration date

4304

#

4305

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4306

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4307

# a year.

4308

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4309

# month and day.

4310

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4311

# if specifying a year by itself or a year and month where the day is not

4312

# significant.

4313

},

4314

"stringValue": "A String", # string

4315

"integerValue": "A String", # integer

4316

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4317

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4318

# types are google.type.Date and `google.protobuf.Timestamp`.

4319

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4320

# allow the value 60 if it allows leap-seconds.

4321

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4322

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4323

# to allow the value "24:00:00" for scenarios like business closing time.

4324

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4325

},

4326

},

4327

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

4328

# the default behavior will be to hyphenate the min-max range.

4329

# Note that for the purposes of inspection or transformation, the number

4330

# of bytes considered to comprise a 'Value' is based on its representation

4331

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4332

# 123456789, the number of bytes would be counted as 9, even though an

4333

# int64 only holds up to 8 bytes of data.

4334

"booleanValue": True or False, # boolean

4335

"floatValue": 3.14, # float

4336

"dayOfWeekValue": "A String", # day of week

4337

"timestampValue": "A String", # timestamp

4338

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4339

# and time zone are either specified elsewhere or are not significant. The date

4340

# is relative to the Proleptic Gregorian Calendar. This can represent:

4341

#

4342

# * A full date, with non-zero year, month and day values

4343

# * A month and day value, with a zero year, e.g. an anniversary

4344

# * A year on its own, with zero month and day values

4345

# * A year and month value, with a zero day, e.g. a credit card expiration date

4346

#

4347

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4348

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4349

# a year.

4350

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4351

# month and day.

4352

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4353

# if specifying a year by itself or a year and month where the day is not

4354

# significant.

4355

},

4356

"stringValue": "A String", # string

4357

"integerValue": "A String", # integer

4358

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4359

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4360

# types are google.type.Date and `google.protobuf.Timestamp`.

4361

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4362

# allow the value 60 if it allows leap-seconds.

4363

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4364

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4365

# to allow the value "24:00:00" for scenarios like business closing time.

4366

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4367

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4372

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

4373

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4374

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4375

# of bytes considered to comprise a 'Value' is based on its representation

4376

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4377

# 123456789, the number of bytes would be counted as 9, even though an

4378

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4379

"booleanValue": True or False, # boolean

4380

"floatValue": 3.14, # float

4381

"dayOfWeekValue": "A String", # day of week

4382

"timestampValue": "A String", # timestamp

4383

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4384

# and time zone are either specified elsewhere or are not significant. The date

4385

# is relative to the Proleptic Gregorian Calendar. This can represent:

4386

#

4387

# * A full date, with non-zero year, month and day values

4388

# * A month and day value, with a zero year, e.g. an anniversary

4389

# * A year on its own, with zero month and day values

4390

# * A year and month value, with a zero day, e.g. a credit card expiration date

4391

#

4392

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4393

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4394

# a year.

4395

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4396

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4397

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4398

# if specifying a year by itself or a year and month where the day is not

4399

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4400

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4401

"stringValue": "A String", # string

4402

"integerValue": "A String", # integer

4403

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4404

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4405

# types are google.type.Date and `google.protobuf.Timestamp`.

4406

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4407

# allow the value 60 if it allows leap-seconds.

4408

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4409

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4410

# to allow the value "24:00:00" for scenarios like business closing time.

4411

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

4416

# fixed character. Masking can start from the beginning or end of the string.

4417

# This can be used on data of any type (numbers, longs, and so on) and when

4418

# de-identifying structured data we'll attempt to preserve the original data's

4419

# type. (This allows you to take a long like 123 and modify it to a string like

4420

# **3.

4421

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

4422

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

4423

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

4424

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

4425

# is `true`, then the string `12345` is masked as `12***`.

4426

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

4427

# characters. For example, if the input string is `555-555-5555` and you

4428

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

4429

# returns `***-**5-5555`.

4430

{ # Characters to skip when doing deidentification of a value. These will be left

4431

# alone and skipped.

4432

"charactersToSkip": "A String", # Characters to not transform when masking.

4433

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

4438

# masked. Skipped characters do not count towards this tally.

4439

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

4440

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

4441

# code or credit card number. This string must have a length of 1. If not

4442

# supplied, this value defaults to `*` for strings, and `0` for digits.

4443

},

4444

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

4445

# Bucketing transformation can provide all of this functionality,

4446

# but requires more configuration. This message is provided as a convenience to

4447

# the user for simple bucketing strategies.

4448

#

4449

# The transformed value will be a hyphenated string of

4450

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

4451

# all values that are within this bucket will be replaced with "10-20".

4452

#

4453

# This can be used on data of type: double, long.

4454

#

4455

# If the bound Value type differs from the type of data

4456

# being transformed, we will first attempt converting the type of the data to

4457

# be transformed to match the type of the bound before comparing.

4458

#

4459

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

4460

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

4461

# grouped together into a single bucket; for example if `lower_bound` = 10,

4462

# then all values less than 10 are replaced with the value "-10".

4463

# Note that for the purposes of inspection or transformation, the number

4464

# of bytes considered to comprise a 'Value' is based on its representation

4465

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4466

# 123456789, the number of bytes would be counted as 9, even though an

4467

# int64 only holds up to 8 bytes of data.

4468

"booleanValue": True or False, # boolean

4469

"floatValue": 3.14, # float

4470

"dayOfWeekValue": "A String", # day of week

4471

"timestampValue": "A String", # timestamp

4472

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4473

# and time zone are either specified elsewhere or are not significant. The date

4474

# is relative to the Proleptic Gregorian Calendar. This can represent:

4475

#

4476

# * A full date, with non-zero year, month and day values

4477

# * A month and day value, with a zero year, e.g. an anniversary

4478

# * A year on its own, with zero month and day values

4479

# * A year and month value, with a zero day, e.g. a credit card expiration date

4480

#

4481

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4482

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4483

# a year.

4484

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4485

# month and day.

4486

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4487

# if specifying a year by itself or a year and month where the day is not

4488

# significant.

4489

},

4490

"stringValue": "A String", # string

4491

"integerValue": "A String", # integer

4492

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4493

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4494

# types are google.type.Date and `google.protobuf.Timestamp`.

4495

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4496

# allow the value 60 if it allows leap-seconds.

4497

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4498

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4499

# to allow the value "24:00:00" for scenarios like business closing time.

4500

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4501

},

4502

},

4503

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

4504

# grouped together into a single bucket; for example if `upper_bound` = 89,

4505

# then all values greater than 89 are replaced with the value "89+".

4506

# Note that for the purposes of inspection or transformation, the number

4507

# of bytes considered to comprise a 'Value' is based on its representation

4508

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4509

# 123456789, the number of bytes would be counted as 9, even though an

4510

# int64 only holds up to 8 bytes of data.

4511

"booleanValue": True or False, # boolean

4512

"floatValue": 3.14, # float

4513

"dayOfWeekValue": "A String", # day of week

4514

"timestampValue": "A String", # timestamp

4515

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4516

# and time zone are either specified elsewhere or are not significant. The date

4517

# is relative to the Proleptic Gregorian Calendar. This can represent:

4518

#

4519

# * A full date, with non-zero year, month and day values

4520

# * A month and day value, with a zero year, e.g. an anniversary

4521

# * A year on its own, with zero month and day values

4522

# * A year and month value, with a zero day, e.g. a credit card expiration date

4523

#

4524

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4525

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4526

# a year.

4527

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4528

# month and day.

4529

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4530

# if specifying a year by itself or a year and month where the day is not

4531

# significant.

4532

},

4533

"stringValue": "A String", # string

4534

"integerValue": "A String", # integer

4535

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4536

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4537

# types are google.type.Date and `google.protobuf.Timestamp`.

4538

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4539

# allow the value 60 if it allows leap-seconds.

4540

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4541

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4542

# to allow the value "24:00:00" for scenarios like business closing time.

4543

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4544

},

4545

},

4546

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

4547

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

4548

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

4549

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

4550

},

4551

},

4552

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

4553

"recordSuppress": { # Configuration to suppress records whose suppression conditions evaluate to # The specific suppression option these stats apply to.

4554

# true.

4555

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

4556

# evaluated to be suppressed from the transformed content.

4557

# a field.

4558

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

4559

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

4560

# only supported value is `AND`.

4561

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

4562

"conditions": [ # A collection of conditions.

4563

{ # The field type of `value` and `field` do not need to match to be

4564

# considered equal, but not all comparisons are possible.

4565

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

4566

# but all other comparisons are invalid with incompatible types.

4567

# A `value` of type:

4568

#

4569

# - `string` can be compared against all other types

4570

# - `boolean` can only be compared against other booleans

4571

# - `integer` can be compared against doubles or a string if the string value

4572

# can be parsed as an integer.

4573

# - `double` can be compared against integers or a string if the string can

4574

# be parsed as a double.

4575

# - `Timestamp` can be compared against strings in RFC 3339 date string

4576

# format.

4577

# - `TimeOfDay` can be compared against timestamps and strings in the format

4578

# of 'HH:mm:ss'.

4579

#

4580

# If we fail to compare do to type mismatch, a warning will be given and

4581

# the condition will evaluate to false.

4582

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

4583

"name": "A String", # Name describing the field.

4584

},

4585

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

4586

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

4587

# Note that for the purposes of inspection or transformation, the number

4588

# of bytes considered to comprise a 'Value' is based on its representation

4589

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4590

# 123456789, the number of bytes would be counted as 9, even though an

4591

# int64 only holds up to 8 bytes of data.

4592

"booleanValue": True or False, # boolean

4593

"floatValue": 3.14, # float

4594

"dayOfWeekValue": "A String", # day of week

4595

"timestampValue": "A String", # timestamp

4596

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4597

# and time zone are either specified elsewhere or are not significant. The date

4598

# is relative to the Proleptic Gregorian Calendar. This can represent:

4599

#

4600

# * A full date, with non-zero year, month and day values

4601

# * A month and day value, with a zero year, e.g. an anniversary

4602

# * A year on its own, with zero month and day values

4603

# * A year and month value, with a zero day, e.g. a credit card expiration date

4604

#

4605

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4606

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4607

# a year.

4608

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4609

# month and day.

4610

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4611

# if specifying a year by itself or a year and month where the day is not

4612

# significant.

4613

},

4614

"stringValue": "A String", # string

4615

"integerValue": "A String", # integer

4616

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4617

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4618

# types are google.type.Date and `google.protobuf.Timestamp`.

4619

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4620

# allow the value 60 if it allows leap-seconds.

4621

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4622

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4623

# to allow the value "24:00:00" for scenarios like business closing time.

4624

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

],

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4630

},

4631

},

4632

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4633

"infoType": { # Type of information detected by the API. # Set if the transformation was limited to a specific InfoType.

4634

"name": "A String", # Name of the information type. Either a name of your choosing when

4635

# creating a CustomInfoType, or one of the names listed

4636

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4637

# a built-in type. InfoType names should conform to the pattern

4638

# `[a-zA-Z0-9_]{1,64}`.

4639

},

4640

"results": [ # Collection of all transformations that took place or had an error.

4641

{ # A collection that informs the user the number of times a particular

4642

# `TransformationResultCode` and error details occurred.

4643

"code": "A String", # Outcome of the transformation.

4644

"count": "A String", # Number of transformations counted by this result.

4645

"details": "A String", # A place for warnings or errors to show up if a transformation didn't

4646

# work as expected.

4647

},

4648

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4649

},

4650

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4651

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4657

<code class="details" id="inspect">inspect(parent, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4658

<pre>Finds potentially sensitive info in content.

4659

This method has limits on input size, processing time, and output size.

4660

4661

When no InfoTypes or CustomInfoTypes are specified in this request, the

4662

system will automatically choose what detectors to run. By default this may

4663

be all types, but may change over time as detectors are updated.

4664

4665

For how to guides, see https://cloud.google.com/dlp/docs/inspecting-images

4666

and https://cloud.google.com/dlp/docs/inspecting-text,

4667

4668

Args:

4669

parent: string, The parent resource name, for example projects/my-project-id. (required)

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4670

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4671

The object takes the form of:

4672

4673

{ # Request to search for potentially sensitive info in a ContentItem.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4674

"item": { # Container structure for the content to inspect. # The item to inspect.

4675

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

4676

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

4677

"data": "A String", # Content data to inspect or redact.

4678

},

4679

"value": "A String", # String data to inspect or redact.

4680

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4681

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

4682

# learn more.

4683

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

4684

# learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4685

"rows": [ # Rows of the table.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4686

{ # Values of the row.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4687

"values": [ # Individual cells.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4688

{ # Set of primitive values supported by the system.

4689

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4690

# of bytes considered to comprise a 'Value' is based on its representation

4691

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4692

# 123456789, the number of bytes would be counted as 9, even though an

4693

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4694

"booleanValue": True or False, # boolean

4695

"floatValue": 3.14, # float

4696

"dayOfWeekValue": "A String", # day of week

4697

"timestampValue": "A String", # timestamp

4698

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4699

# and time zone are either specified elsewhere or are not significant. The date

4700

# is relative to the Proleptic Gregorian Calendar. This can represent:

4701

#

4702

# * A full date, with non-zero year, month and day values

4703

# * A month and day value, with a zero year, e.g. an anniversary

4704

# * A year on its own, with zero month and day values

4705

# * A year and month value, with a zero day, e.g. a credit card expiration date

4706

#

4707

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4708

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4709

# a year.

4710

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4711

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4712

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4713

# if specifying a year by itself or a year and month where the day is not

4714

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4715

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4716

"stringValue": "A String", # string

4717

"integerValue": "A String", # integer

4718

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4719

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4720

# types are google.type.Date and `google.protobuf.Timestamp`.

4721

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4722

# allow the value 60 if it allows leap-seconds.

4723

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4724

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4725

# to allow the value "24:00:00" for scenarios like business closing time.

4726

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4727

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

],

},

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4732

"headers": [ # Headers of the table.

4733

{ # General identifier of a data field in a storage service.

4734

"name": "A String", # Name describing the field.

4735

},

4736

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4737

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4738

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4739

"inspectTemplateName": "A String", # Template to use. Any configuration directly specified in

4740

# inspect_config will override those set in the template. Singular fields

4741

# that are set in this request will replace their corresponding fields in the

4742

# template. Repeated fields are appended. Singular sub-messages and groups

4743

# are recursively merged.

4744

"inspectConfig": { # Configuration description of the scanning process. # Configuration for the inspector. What specified here will override

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4745

# the template referenced by the inspect_template_name argument.

4746

# When used with redactContent only info_types and min_likelihood are currently

4747

# used.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4748

"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is

4749

# included in the response; see Finding.quote.

4750

"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig.

4751

# Exclusion rules, contained in the set are executed in the end, other

4752

# rules are executed in the order they are specified for each info type.

4753

{ # Rule set for modifying a set of infoTypes to alter behavior under certain

4754

# circumstances, depending on the specific details of the rules within the set.

4755

"infoTypes": [ # List of infoTypes this rule set is applied to.

4756

{ # Type of information detected by the API.

4757

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4758

# creating a CustomInfoType, or one of the names listed

4759

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4760

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4761

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4762

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4763

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4764

"rules": [ # Set of rules to be applied to infoTypes. The rules are applied in order.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4765

{ # A single inspection rule to be applied to infoTypes, specified in

4766

# `InspectionRuleSet`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4767

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4768

# proximity of hotwords.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4769

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4770

# part of a detection rule.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4771

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4772

# levels. For example, if a finding would be `POSSIBLE` without the

4773

# detection rule and `relative_likelihood` is 1, then it is upgraded to

4774

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

4775

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

4776

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

4777

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

4778

# a final likelihood of `LIKELY`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4779

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4780

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4781

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

4782

"groupIndexes": [ # The index of the submatch to extract as findings. When not

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4783

# specified, the entire match is returned. No more than 3 may be included.

4784

42,

4785

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4786

"pattern": "A String", # Pattern defining the regular expression. Its syntax

4787

# (https://github.com/google/re2/wiki/Syntax) can be found under the

4788

# google/re2 repository on GitHub.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4789

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4790

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

4791

# The total length of the window cannot exceed 1000 characters. Note that

4792

# the finding itself will be included in the window, so that hotwords may

4793

# be used to match substrings of the finding itself. For example, the

4794

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

4795

# adjusted upwards if the area code is known to be the local area code of

4796

# a company office using the hotword regex "\(xxx\)", where "xxx"

4797

# is the area code in question.

4798

# rule.

4799

"windowBefore": 42, # Number of characters before the finding to consider.

4800

"windowAfter": 42, # Number of characters after the finding to consider.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4801

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4802

},

4803

"exclusionRule": { # The rule that specifies conditions when findings of infoTypes specified in # Exclusion rule.

4804

# `InspectionRuleSet` are removed from results.

4805

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # Dictionary which defines the rule.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4806

# be used to match sensitive information specific to the data, such as a list

4807

# of employee IDs or job titles.

4808

#

4809

# Dictionary words are case-insensitive and all characters other than letters

4810

# and digits in the unicode [Basic Multilingual

4811

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

4812

# will be replaced with whitespace when scanning for matches, so the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4813

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

4814

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4815

# surrounding any match must be of a different type than the adjacent

4816

# characters within the word, so letters must be next to non-letters and

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4817

# digits next to non-digits. For example, the dictionary word "jen" will

4818

# match the first three letters of the text "jen123" but will return no

4819

# matches for "jennifer".

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4820

#

4821

# Dictionary words containing a large number of characters that are not

4822

# letters or digits may result in unexpected findings because such characters

4823

# are treated as whitespace. The

4824

# [limits](https://cloud.google.com/dlp/limits) page contains details about

4825

# the size limits of dictionaries. For dictionaries that do not fit within

4826

# these constraints, consider using `LargeCustomDictionaryConfig` in the

4827

# `StoredInfoType` API.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4828

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

4829

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4830

# at least one phrase and every phrase must contain at least 2 characters

4831

# that are letters or digits. [required]

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4832

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4833

],

4834

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4835

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4836

# is accepted.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4837

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4838

# Example: gs://[BUCKET_NAME]/dictionary.txt

4839

},

4840

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4841

"regex": { # Message defining a custom regular expression. # Regular expression which defines the rule.

4842

"groupIndexes": [ # The index of the submatch to extract as findings. When not

4843

# specified, the entire match is returned. No more than 3 may be included.

4844

42,

4845

],

4846

"pattern": "A String", # Pattern defining the regular expression. Its syntax

4847

# (https://github.com/google/re2/wiki/Syntax) can be found under the

4848

# google/re2 repository on GitHub.

4849

},

4850

"excludeInfoTypes": { # List of exclude infoTypes. # Set of infoTypes for which findings would affect this rule.

4851

"infoTypes": [ # InfoType list in ExclusionRule rule drops a finding when it overlaps or

4852

# contained within with a finding of an infoType from this list. For

4853

# example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and

4854

# `exclusion_rule` containing `exclude_info_types.info_types` with

4855

# "EMAIL_ADDRESS" the phone number findings are dropped if they overlap

4856

# with EMAIL_ADDRESS finding.

4857

# That leads to "555-222-2222@example.org" to generate only a single

4858

# finding, namely email address.

4859

{ # Type of information detected by the API.

4860

"name": "A String", # Name of the information type. Either a name of your choosing when

4861

# creating a CustomInfoType, or one of the names listed

4862

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4863

# a built-in type. InfoType names should conform to the pattern

4864

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

"matchingType": "A String", # How the rule is applied, see MatchingType documentation for details.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4869

},

4870

},

4871

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4872

},

4873

],

4874

"limits": { # Configuration to control the number of findings returned. # Configuration to control the number of findings returned.

4875

"maxFindingsPerItem": 42, # Max number of findings that will be returned for each item scanned.

4876

# When set within `InspectJobConfig`,

4877

# the maximum returned is 2000 regardless if this is set higher.

4878

# When set within `InspectContentRequest`, this field is ignored.

4879

"maxFindingsPerInfoType": [ # Configuration of findings limit given for specified infoTypes.

4880

{ # Max findings configuration per infoType, per content item or long

4881

# running DlpJob.

4882

"maxFindings": 42, # Max findings limit for the given infoType.

4883

"infoType": { # Type of information detected by the API. # Type of information the findings limit applies to. Only one limit per

4884

# info_type should be provided. If InfoTypeLimit does not have an

4885

# info_type, the DLP API applies the limit against all info_types that

4886

# are found but not specified in another InfoTypeLimit.

4887

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4888

# creating a CustomInfoType, or one of the names listed

4889

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4890

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4891

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4892

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4893

},

4894

],

4895

"maxFindingsPerRequest": 42, # Max number of findings that will be returned per request/job.

4896

# When set within `InspectContentRequest`, the maximum returned is 2000

4897

# regardless if this is set higher.

4898

},

4899

"contentOptions": [ # List of options defining data content to scan.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4900

# If empty, text, images, and other content will be included.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4901

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4902

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4903

"infoTypes": [ # Restricts what info_types to look for. The values must correspond to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4904

# InfoType values returned by ListInfoTypes or listed at

4905

# https://cloud.google.com/dlp/docs/infotypes-reference.

4906

#

4907

# When no InfoTypes or CustomInfoTypes are specified in a request, the

4908

# system may automatically choose what detectors to run. By default this may

4909

# be all types, but may change over time as detectors are updated.

4910

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4911

# If you need precise control and predictability as to what detectors are

4912

# run you should specify specific InfoTypes listed in the reference,

4913

# otherwise a default list will be used, which may change over time.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4914

{ # Type of information detected by the API.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4915

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4916

# creating a CustomInfoType, or one of the names listed

4917

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4918

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

4919

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

4920

},

4921

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4922

"minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is

4923

# POSSIBLE.

4924

# See https://cloud.google.com/dlp/docs/likelihood to learn more.

4925

"excludeInfoTypes": True or False, # When true, excludes type information of the findings.

4926

"customInfoTypes": [ # CustomInfoTypes provided by the user. See

4927

# https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

4928

{ # Custom information type provided by the user. Used to find domain-specific

4929

# sensitive information configurable to the data in question.

4930

"likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be

4931

# altered by a detection rule if the finding meets the criteria specified by

4932

# the rule. Defaults to `VERY_LIKELY` if not specified.

4933

"infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in

4934

# infoType, when the name matches one of existing infoTypes and that infoType

4935

# is specified in `InspectContent.info_types` field. Specifying the latter

4936

# adds findings to the one detected by the system. If built-in info type is

4937

# not specified in `InspectContent.info_types` list then the name is treated

4938

# as a custom info type.

4939

"name": "A String", # Name of the information type. Either a name of your choosing when

4940

# creating a CustomInfoType, or one of the names listed

4941

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4942

# a built-in type. InfoType names should conform to the pattern

4943

# `[a-zA-Z0-9_]{1,64}`.

4944

},

4945

"regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.

4946

"groupIndexes": [ # The index of the submatch to extract as findings. When not

4947

# specified, the entire match is returned. No more than 3 may be included.

4948

42,

4949

],

4950

"pattern": "A String", # Pattern defining the regular expression. Its syntax

4951

# (https://github.com/google/re2/wiki/Syntax) can be found under the

4952

# google/re2 repository on GitHub.

4953

},

4954

"detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.

4955

# Rules are applied in order that they are specified. Not supported for the

4956

# `surrogate_type` CustomInfoType.

4957

{ # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a

4958

# `CustomInfoType` to alter behavior under certain circumstances, depending

4959

# on the specific details of the rule. Not supported for the `surrogate_type`

4960

# custom infoType.

4961

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

4962

# proximity of hotwords.

4963

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

4964

# part of a detection rule.

4965

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

4966

# levels. For example, if a finding would be `POSSIBLE` without the

4967

# detection rule and `relative_likelihood` is 1, then it is upgraded to

4968

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

4969

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

4970

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

4971

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

4972

# a final likelihood of `LIKELY`.

4973

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

4974

},

4975

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

4976

"groupIndexes": [ # The index of the submatch to extract as findings. When not

4977

# specified, the entire match is returned. No more than 3 may be included.

4978

42,

4979

],

4980

"pattern": "A String", # Pattern defining the regular expression. Its syntax

4981

# (https://github.com/google/re2/wiki/Syntax) can be found under the

4982

# google/re2 repository on GitHub.

4983

},

4984

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

4985

# The total length of the window cannot exceed 1000 characters. Note that

4986

# the finding itself will be included in the window, so that hotwords may

4987

# be used to match substrings of the finding itself. For example, the

4988

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

4989

# adjusted upwards if the area code is known to be the local area code of

4990

# a company office using the hotword regex "\(xxx\)", where "xxx"

4991

# is the area code in question.

4992

# rule.

4993

"windowBefore": 42, # Number of characters before the finding to consider.

4994

"windowAfter": 42, # Number of characters after the finding to consider.

},

},

},

],

"exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding

5000

# to be returned. It still can be used for rules matching.

5001

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.

5002

# be used to match sensitive information specific to the data, such as a list

5003

# of employee IDs or job titles.

5004

#

5005

# Dictionary words are case-insensitive and all characters other than letters

5006

# and digits in the unicode [Basic Multilingual

5007

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

5008

# will be replaced with whitespace when scanning for matches, so the

5009

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

5010

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

5011

# surrounding any match must be of a different type than the adjacent

5012

# characters within the word, so letters must be next to non-letters and

5013

# digits next to non-digits. For example, the dictionary word "jen" will

5014

# match the first three letters of the text "jen123" but will return no

5015

# matches for "jennifer".

5016

#

5017

# Dictionary words containing a large number of characters that are not

5018

# letters or digits may result in unexpected findings because such characters

5019

# are treated as whitespace. The

5020

# [limits](https://cloud.google.com/dlp/limits) page contains details about

5021

# the size limits of dictionaries. For dictionaries that do not fit within

5022

# these constraints, consider using `LargeCustomDictionaryConfig` in the

5023

# `StoredInfoType` API.

5024

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

5025

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

5026

# at least one phrase and every phrase must contain at least 2 characters

5027

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

5032

# is accepted.

5033

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

5034

# Example: gs://[BUCKET_NAME]/dictionary.txt

5035

},

5036

},

5037

"storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in

5038

# `InspectDataSource`. Not currently supported in `InspectContent`.

5039

"name": "A String", # Resource name of the requested `StoredInfoType`, for example

5040

# `organizations/433245324/storedInfoTypes/432452342` or

5041

# `projects/project-id/storedInfoTypes/432452342`.

5042

"createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for

5043

# inspection was created. Output-only field, populated by the system.

5044

},

5045

"surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that

5046

# support reversing.

5047

# such as

5048

# [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).

5049

# These types of transformations are

5050

# those that perform pseudonymization, thereby producing a "surrogate" as

5051

# output. This should be used in conjunction with a field on the

5052

# transformation such as `surrogate_info_type`. This CustomInfoType does

5053

# not support the use of `detection_rules`.

5054

},

5055

},

5056

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5057

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5058

"locationId": "A String", # The geographic location to process content inspection. Reserved for future

5059

# extensions.

5060

# When inspecting images location is restricted to 'global', 'us', 'asia',

5061

# and 'europe'.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5062

}

5063

5064

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

5071

5072

{ # Results of inspecting an item.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5073

"result": { # All the findings for a single scanned item. # The findings.

5074

"findings": [ # List of findings for an item.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5075

{ # Represents a piece of potentially sensitive content.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5076

"resourceName": "A String", # The job that stored the finding.

5077

"triggerName": "A String", # Job trigger name, if applicable, for this finding.

5078

"jobCreateTime": "A String", # Time the job started that produced this finding.

5079

"quoteInfo": { # Message for infoType-dependent details parsed from quote. # Contains data parsed from quotes. Only populated if include_quote was set

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5080

# to true and a supported infoType was requested. Currently supported

5081

# infoTypes: DATE, DATE_OF_BIRTH and TIME.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5082

"dateTime": { # Message for a date time object. # The date time indicated by the quote.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5083

# e.g. 2018-01-01, 5th August.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5084

"date": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # One or more of the following must be set.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5085

# Must be a valid date or time value.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5086

# and time zone are either specified elsewhere or are not significant. The date

5087

# is relative to the Proleptic Gregorian Calendar. This can represent:

5088

#

5089

# * A full date, with non-zero year, month and day values

5090

# * A month and day value, with a zero year, e.g. an anniversary

5091

# * A year on its own, with zero month and day values

5092

# * A year and month value, with a zero day, e.g. a credit card expiration date

5093

#

5094

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5095

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5096

# a year.

5097

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5098

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5099

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5100

# if specifying a year by itself or a year and month where the day is not

5101

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5102

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5103

"timeZone": { # Time zone of the date time object. # Time zone

5104

"offsetMinutes": 42, # Set only if the offset can be determined. Positive for time ahead of UTC.

5105

# E.g. For "UTC-9", this value is -540.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5106

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5107

"dayOfWeek": "A String", # Day of week

5108

"time": { # Represents a time of day. The date and time zone are either not significant # Time of day

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5109

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5110

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5111

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5112

# allow the value 60 if it allows leap-seconds.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5113

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

5114

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5115

# to allow the value "24:00:00" for scenarios like business closing time.

5116

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5117

},

5118

},

5119

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5120

"labels": { # The labels associated with this `Finding`.

5121

#

5122

# Label keys must be between 1 and 63 characters long and must conform

5123

# to the following regular expression: `[a-z]([-a-z0-9]*[a-z0-9])?`.

5124

#

5125

# Label values must be between 0 and 63 characters long and must conform

5126

# to the regular expression `([a-z]([-a-z0-9]*[a-z0-9])?)?`.

5127

#

5128

# No more than 10 labels can be associated with a given finding.

5129

#

5130

# Examples:

5131

# * `"environment" : "production"`

5132

# * `"pipeline" : "etl"`

5133

"a_key": "A String",

5134

},

5135

"infoType": { # Type of information detected by the API. # The type of content that might have been found.

5136

# Provided if `excluded_types` is false.

5137

"name": "A String", # Name of the information type. Either a name of your choosing when

5138

# creating a CustomInfoType, or one of the names listed

5139

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5140

# a built-in type. InfoType names should conform to the pattern

5141

# `[a-zA-Z0-9_]{1,64}`.

5142

},

5143

"likelihood": "A String", # Confidence of how likely it is that the `info_type` is correct.

5144

"name": "A String", # Resource name in format

5145

# projects/{project}/locations/{location}/findings/{finding} Populated only

5146

# when viewing persisted findings.

5147

"location": { # Specifies the location of the finding. # Where the content was found.

5148

"codepointRange": { # Generic half-open interval [start, end) # Unicode character offsets delimiting the finding.

5149

# These are relative to the finding's containing element.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5150

# Provided when the content is text.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5151

"start": "A String", # Index of the first character of the range (inclusive).

5152

"end": "A String", # Index of the last character of the range (exclusive).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5153

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5154

"byteRange": { # Generic half-open interval [start, end) # Zero-based byte offsets delimiting the finding.

5155

# These are relative to the finding's containing element.

5156

# Note that when the content is not textual, this references

5157

# the UTF-8 encoded textual representation of the content.

5158

# Omitted if content is an image.

5159

"start": "A String", # Index of the first character of the range (inclusive).

5160

"end": "A String", # Index of the last character of the range (exclusive).

5161

},

5162

"container": { # Represents a container that may contain DLP findings. # Information about the container where this finding occurred, if available.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5163

# Examples of a container include a file, table, or database record.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5164

"fullPath": "A String", # A string representation of the full container name.

5165

# Examples:

5166

# - BigQuery: 'Project:DataSetId.TableId'

5167

# - Google Cloud Storage: 'gs://Bucket/folders/filename.txt'

5168

"type": "A String", # Container type, for example BigQuery or Google Cloud Storage.

5169

"updateTime": "A String", # Findings container modification timestamp, if applicable.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5170

# For Google Cloud Storage contains last file modification timestamp.

5171

# For BigQuery table contains last_modified_time property.

5172

# For Datastore - not populated.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5173

"rootPath": "A String", # The root of the container.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5174

# Examples:

5175

# - For BigQuery table `project_id:dataset_id.table_id`, the root is

5176

# `dataset_id`

5177

# - For Google Cloud Storage file `gs://bucket/folder/filename.txt`, the root

5178

# is `gs://bucket`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5179

"projectId": "A String", # Project where the finding was found.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5180

# Can be different from the project that owns the finding.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5181

"relativePath": "A String", # The rest of the path after the root.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5182

# Examples:

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5183

# - For BigQuery table `project_id:dataset_id.table_id`, the relative path is

5184

# `table_id`

5185

# - Google Cloud Storage file `gs://bucket/folder/filename.txt`, the relative

5186

# path is `folder/filename.txt`

5187

"version": "A String", # Findings container version, if available

5188

# ("generation" for Google Cloud Storage).

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5189

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5190

"contentLocations": [ # List of nested objects pointing to the precise location of the finding

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5191

# within the file or record.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5192

{ # Precise location of the finding within a document, record, image, or metadata

5193

# container.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5194

"containerName": "A String", # Name of the container where the finding is located.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5195

# The top level name is the source file name or table name. Names of some

5196

# common storage containers are formatted as follows:

5197

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5198

# * BigQuery tables: `{project_id}:{dataset_id}.{table_id}`

5199

# * Cloud Storage files: `gs://{bucket}/{path}`

5200

# * Datastore namespace: {namespace}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5201

#

5202

# Nested names could be absent if the embedded object has no string

5203

# identifier (for an example an image contained within a document).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5204

"documentLocation": { # Location of a finding within a document. # Location data for document files.

5205

"fileOffset": "A String", # Offset of the line, from the beginning of the file, where the finding

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5206

# is located.

5207

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5208

"recordLocation": { # Location of a finding within a row or record. # Location within a row or record of a database table.

5209

"fieldId": { # General identifier of a data field in a storage service. # Field id of the field containing the finding.

5210

"name": "A String", # Name describing the field.

5211

},

5212

"tableLocation": { # Location of a finding within a table. # Location within a `ContentItem.Table`.

5213

"rowIndex": "A String", # The zero-based index of the row where the finding is located. Only

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5214

# populated for resources that have a natural ordering, not BigQuery. In

5215

# BigQuery, to identify the row a finding came from, populate

5216

# BigQueryOptions.identifying_fields with your primary key column names and

5217

# when you store the findings the value of those columns will be stored

5218

# inside of Finding.

5219

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5220

"recordKey": { # Message for a unique key indicating a record that contains a finding. # Key of the finding.

5221

"idValues": [ # Values of identifying columns in the given row. Order of values matches

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5222

# the order of `identifying_fields` specified in the scanning request.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5223

"A String",

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5224

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5225

"datastoreKey": { # Record key for a finding in Cloud Datastore.

5226

"entityKey": { # A unique identifier for a Datastore entity. # Datastore entity key.

5227

# If a key's partition ID or any of its path kinds or names are

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5228

# reserved/read-only, the key is reserved/read-only.

5229

# A reserved/read-only key is forbidden in certain documented contexts.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5230

"path": [ # The entity path.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5231

# An entity path consists of one or more elements composed of a kind and a

5232

# string or numerical identifier, which identify entities. The first

5233

# element identifies a _root entity_, the second element identifies

5234

# a _child_ of the root entity, the third element identifies a child of the

5235

# second entity, and so forth. The entities identified by all prefixes of

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5236

# the path are called the element's _ancestors_.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5237

#

5238

# A path can never be empty, and a path can have at most 100 elements.

5239

{ # A (kind, ID/name) pair used to construct a key path.

5240

#

5241

# If either name or ID is set, the element is complete.

5242

# If neither is set, the element is incomplete.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5243

"kind": "A String", # The kind of the entity.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5244

# A kind matching regex `__.*__` is reserved/read-only.

5245

# A kind must not contain more than 1500 bytes when UTF-8 encoded.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5246

# Cannot be `""`.

5247

"id": "A String", # The auto-allocated ID of the entity.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5248

# Never equal to zero. Values less than zero are discouraged and may not

5249

# be supported in the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5250

"name": "A String", # The name of the entity.

5251

# A name matching regex `__.*__` is reserved/read-only.

5252

# A name must not be more than 1500 bytes when UTF-8 encoded.

5253

# Cannot be `""`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5254

},

5255

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5256

"partitionId": { # Datastore partition ID. # Entities are partitioned into subsets, currently identified by a project

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5257

# ID and namespace ID.

5258

# Queries are scoped to a single partition.

5259

# A partition ID identifies a grouping of entities. The grouping is always

5260

# by project and namespace, however the namespace ID may be empty.

5261

#

5262

# A partition ID contains several dimensions:

5263

# project ID and namespace ID.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5264

"namespaceId": "A String", # If not empty, the ID of the namespace to which the entities belong.

5265

"projectId": "A String", # The ID of the project to which the entities belong.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5266

},

5267

},

5268

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5269

"bigQueryKey": { # Row key for identifying a record in BigQuery table.

5270

"tableReference": { # Message defining the location of a BigQuery table. A table is uniquely # Complete BigQuery table reference.

5271

# identified by its project_id, dataset_id, and table_name. Within a query

5272

# a table is often referenced with a string in the format of:

5273

# `<project_id>:<dataset_id>.<table_id>` or

5274

# `<project_id>.<dataset_id>.<table_id>`.

5275

"projectId": "A String", # The Google Cloud Platform project ID of the project containing the table.

5276

# If omitted, project ID is inferred from the API call.

5277

"datasetId": "A String", # Dataset ID of the table.

5278

"tableId": "A String", # Name of the table.

5279

},

5280

"rowNumber": "A String", # Row number inferred at the time the table was scanned. This value is

5281

# nondeterministic, cannot be queried, and may be null for inspection

5282

# jobs. To locate findings within a table, specify

5283

# `inspect_job.storage_config.big_query_options.identifying_fields` in

5284

# `CreateDlpJobRequest`.

5285

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5286

},

5287

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5288

"containerTimestamp": "A String", # Findings container modification timestamp, if applicable.

5289

# For Google Cloud Storage contains last file modification timestamp.

5290

# For BigQuery table contains last_modified_time property.

5291

# For Datastore - not populated.

5292

"metadataLocation": { # Metadata Location # Location within the metadata for inspected content.

5293

"storageLabel": { # Storage metadata label to indicate which metadata entry contains findings. # Storage metadata.

5294

"key": "A String",

5295

},

5296

"type": "A String", # Type of metadata containing the finding.

5297

},

5298

"imageLocation": { # Location of the finding within an image. # Location within an image's pixels.

5299

"boundingBoxes": [ # Bounding boxes locating the pixels within the image containing the finding.

5300

{ # Bounding box encompassing detected text within an image.

5301

"top": 42, # Top coordinate of the bounding box. (0,0) is upper left.

5302

"width": 42, # Width of the bounding box in pixels.

5303

"height": 42, # Height of the bounding box in pixels.

5304

"left": 42, # Left coordinate of the bounding box. (0,0) is upper left.

},

],

},

"containerVersion": "A String", # Findings container version, if available

5309

# ("generation" for Google Cloud Storage).

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5310

},

5311

],

5312

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5313

"quote": "A String", # The content that was found. Even if the content is not textual, it

5314

# may be converted to a textual representation here.

5315

# Provided if `include_quote` is true and the finding is

5316

# less than or equal to 4096 bytes long. If the finding exceeds 4096 bytes

5317

# in length, the quote may be omitted.

5318

"createTime": "A String", # Timestamp when finding was detected.

5319

"jobName": "A String", # The job that stored the finding.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5320

},

5321

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5322

"findingsTruncated": True or False, # If true, then this item might have more findings than were returned,

5323

# and the findings returned are an arbitrary subset of all findings.

5324

# The findings list might be truncated because the input items were too

5325

# large, or because the server reached the maximum amount of resources

5326

# allowed for a single API call. For best results, divide the input into

5327

# smaller batches.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

}</pre>

</div>

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5333

<code class="details" id="reidentify">reidentify(parent, body=None, x__xgafv=None)</code>

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5334

<pre>Re-identifies content that has been de-identified.

5335

See

5336

https://cloud.google.com/dlp/docs/pseudonymization#re-identification_in_free_text_code_example

5337

to learn more.

5338

5339

Args:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5340

parent: string, Required. The parent resource name. (required)

5341

body: object, The request body.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5342

The object takes the form of:

5343

5344

{ # Request to re-identify an item.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5345

"item": { # Container structure for the content to inspect. # The item to re-identify. Will be treated as text.

5346

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

5347

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

5348

"data": "A String", # Content data to inspect or redact.

5349

},

5350

"value": "A String", # String data to inspect or redact.

5351

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

5352

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

5353

# learn more.

5354

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

5355

# learn more.

5356

"rows": [ # Rows of the table.

5357

{ # Values of the row.

5358

"values": [ # Individual cells.

5359

{ # Set of primitive values supported by the system.

5360

# Note that for the purposes of inspection or transformation, the number

5361

# of bytes considered to comprise a 'Value' is based on its representation

5362

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5363

# 123456789, the number of bytes would be counted as 9, even though an

5364

# int64 only holds up to 8 bytes of data.

5365

"booleanValue": True or False, # boolean

5366

"floatValue": 3.14, # float

5367

"dayOfWeekValue": "A String", # day of week

5368

"timestampValue": "A String", # timestamp

5369

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5370

# and time zone are either specified elsewhere or are not significant. The date

5371

# is relative to the Proleptic Gregorian Calendar. This can represent:

5372

#

5373

# * A full date, with non-zero year, month and day values

5374

# * A month and day value, with a zero year, e.g. an anniversary

5375

# * A year on its own, with zero month and day values

5376

# * A year and month value, with a zero day, e.g. a credit card expiration date

5377

#

5378

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

5379

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5380

# a year.

5381

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5382

# month and day.

5383

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5384

# if specifying a year by itself or a year and month where the day is not

5385

# significant.

5386

},

5387

"stringValue": "A String", # string

5388

"integerValue": "A String", # integer

5389

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

5390

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5391

# types are google.type.Date and `google.protobuf.Timestamp`.

5392

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5393

# allow the value 60 if it allows leap-seconds.

5394

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

5395

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5396

# to allow the value "24:00:00" for scenarios like business closing time.

5397

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

],

},

],

"headers": [ # Headers of the table.

5404

{ # General identifier of a data field in a storage service.

5405

"name": "A String", # Name describing the field.

},

],

},

},

"inspectTemplateName": "A String", # Template to use. Any configuration directly specified in

5411

# `inspect_config` will override those set in the template. Singular fields

5412

# that are set in this request will replace their corresponding fields in the

5413

# template. Repeated fields are appended. Singular sub-messages and groups

5414

# are recursively merged.

5415

"inspectConfig": { # Configuration description of the scanning process. # Configuration for the inspector.

5416

# When used with redactContent only info_types and min_likelihood are currently

5417

# used.

5418

"includeQuote": True or False, # When true, a contextual quote from the data that triggered a finding is

5419

# included in the response; see Finding.quote.

5420

"ruleSet": [ # Set of rules to apply to the findings for this InspectConfig.

5421

# Exclusion rules, contained in the set are executed in the end, other

5422

# rules are executed in the order they are specified for each info type.

5423

{ # Rule set for modifying a set of infoTypes to alter behavior under certain

5424

# circumstances, depending on the specific details of the rules within the set.

5425

"infoTypes": [ # List of infoTypes this rule set is applied to.

5426

{ # Type of information detected by the API.

5427

"name": "A String", # Name of the information type. Either a name of your choosing when

5428

# creating a CustomInfoType, or one of the names listed

5429

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5430

# a built-in type. InfoType names should conform to the pattern

5431

# `[a-zA-Z0-9_]{1,64}`.

5432

},

5433

],

5434

"rules": [ # Set of rules to be applied to infoTypes. The rules are applied in order.

5435

{ # A single inspection rule to be applied to infoTypes, specified in

5436

# `InspectionRuleSet`.

5437

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

5438

# proximity of hotwords.

5439

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

5440

# part of a detection rule.

5441

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

5442

# levels. For example, if a finding would be `POSSIBLE` without the

5443

# detection rule and `relative_likelihood` is 1, then it is upgraded to

5444

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

5445

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

5446

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

5447

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

5448

# a final likelihood of `LIKELY`.

5449

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

5450

},

5451

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

5452

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5453

# specified, the entire match is returned. No more than 3 may be included.

5454

42,

5455

],

5456

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5457

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5458

# google/re2 repository on GitHub.

5459

},

5460

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

5461

# The total length of the window cannot exceed 1000 characters. Note that

5462

# the finding itself will be included in the window, so that hotwords may

5463

# be used to match substrings of the finding itself. For example, the

5464

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

5465

# adjusted upwards if the area code is known to be the local area code of

5466

# a company office using the hotword regex "\(xxx\)", where "xxx"

5467

# is the area code in question.

5468

# rule.

5469

"windowBefore": 42, # Number of characters before the finding to consider.

5470

"windowAfter": 42, # Number of characters after the finding to consider.

5471

},

5472

},

5473

"exclusionRule": { # The rule that specifies conditions when findings of infoTypes specified in # Exclusion rule.

5474

# `InspectionRuleSet` are removed from results.

5475

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # Dictionary which defines the rule.

5476

# be used to match sensitive information specific to the data, such as a list

5477

# of employee IDs or job titles.

5478

#

5479

# Dictionary words are case-insensitive and all characters other than letters

5480

# and digits in the unicode [Basic Multilingual

5481

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

5482

# will be replaced with whitespace when scanning for matches, so the

5483

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

5484

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

5485

# surrounding any match must be of a different type than the adjacent

5486

# characters within the word, so letters must be next to non-letters and

5487

# digits next to non-digits. For example, the dictionary word "jen" will

5488

# match the first three letters of the text "jen123" but will return no

5489

# matches for "jennifer".

5490

#

5491

# Dictionary words containing a large number of characters that are not

5492

# letters or digits may result in unexpected findings because such characters

5493

# are treated as whitespace. The

5494

# [limits](https://cloud.google.com/dlp/limits) page contains details about

5495

# the size limits of dictionaries. For dictionaries that do not fit within

5496

# these constraints, consider using `LargeCustomDictionaryConfig` in the

5497

# `StoredInfoType` API.

5498

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

5499

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

5500

# at least one phrase and every phrase must contain at least 2 characters

5501

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

5506

# is accepted.

5507

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

5508

# Example: gs://[BUCKET_NAME]/dictionary.txt

5509

},

5510

},

5511

"regex": { # Message defining a custom regular expression. # Regular expression which defines the rule.

5512

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5513

# specified, the entire match is returned. No more than 3 may be included.

5514

42,

5515

],

5516

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5517

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5518

# google/re2 repository on GitHub.

5519

},

5520

"excludeInfoTypes": { # List of exclude infoTypes. # Set of infoTypes for which findings would affect this rule.

5521

"infoTypes": [ # InfoType list in ExclusionRule rule drops a finding when it overlaps or

5522

# contained within with a finding of an infoType from this list. For

5523

# example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and

5524

# `exclusion_rule` containing `exclude_info_types.info_types` with

5525

# "EMAIL_ADDRESS" the phone number findings are dropped if they overlap

5526

# with EMAIL_ADDRESS finding.

5527

# That leads to "555-222-2222@example.org" to generate only a single

5528

# finding, namely email address.

5529

{ # Type of information detected by the API.

5530

"name": "A String", # Name of the information type. Either a name of your choosing when

5531

# creating a CustomInfoType, or one of the names listed

5532

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5533

# a built-in type. InfoType names should conform to the pattern

5534

# `[a-zA-Z0-9_]{1,64}`.

},

],

},

"matchingType": "A String", # How the rule is applied, see MatchingType documentation for details.

},

},

],

},

],

"limits": { # Configuration to control the number of findings returned. # Configuration to control the number of findings returned.

5545

"maxFindingsPerItem": 42, # Max number of findings that will be returned for each item scanned.

5546

# When set within `InspectJobConfig`,

5547

# the maximum returned is 2000 regardless if this is set higher.

5548

# When set within `InspectContentRequest`, this field is ignored.

5549

"maxFindingsPerInfoType": [ # Configuration of findings limit given for specified infoTypes.

5550

{ # Max findings configuration per infoType, per content item or long

5551

# running DlpJob.

5552

"maxFindings": 42, # Max findings limit for the given infoType.

5553

"infoType": { # Type of information detected by the API. # Type of information the findings limit applies to. Only one limit per

5554

# info_type should be provided. If InfoTypeLimit does not have an

5555

# info_type, the DLP API applies the limit against all info_types that

5556

# are found but not specified in another InfoTypeLimit.

5557

"name": "A String", # Name of the information type. Either a name of your choosing when

5558

# creating a CustomInfoType, or one of the names listed

5559

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5560

# a built-in type. InfoType names should conform to the pattern

5561

# `[a-zA-Z0-9_]{1,64}`.

},

},

],

"maxFindingsPerRequest": 42, # Max number of findings that will be returned per request/job.

5566

# When set within `InspectContentRequest`, the maximum returned is 2000

5567

# regardless if this is set higher.

5568

},

5569

"contentOptions": [ # List of options defining data content to scan.

5570

# If empty, text, images, and other content will be included.

5571

"A String",

5572

],

5573

"infoTypes": [ # Restricts what info_types to look for. The values must correspond to

5574

# InfoType values returned by ListInfoTypes or listed at

5575

# https://cloud.google.com/dlp/docs/infotypes-reference.

5576

#

5577

# When no InfoTypes or CustomInfoTypes are specified in a request, the

5578

# system may automatically choose what detectors to run. By default this may

5579

# be all types, but may change over time as detectors are updated.

5580

#

5581

# If you need precise control and predictability as to what detectors are

5582

# run you should specify specific InfoTypes listed in the reference,

5583

# otherwise a default list will be used, which may change over time.

5584

{ # Type of information detected by the API.

5585

"name": "A String", # Name of the information type. Either a name of your choosing when

5586

# creating a CustomInfoType, or one of the names listed

5587

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5588

# a built-in type. InfoType names should conform to the pattern

5589

# `[a-zA-Z0-9_]{1,64}`.

5590

},

5591

],

5592

"minLikelihood": "A String", # Only returns findings equal or above this threshold. The default is

5593

# POSSIBLE.

5594

# See https://cloud.google.com/dlp/docs/likelihood to learn more.

5595

"excludeInfoTypes": True or False, # When true, excludes type information of the findings.

5596

"customInfoTypes": [ # CustomInfoTypes provided by the user. See

5597

# https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

5598

{ # Custom information type provided by the user. Used to find domain-specific

5599

# sensitive information configurable to the data in question.

5600

"likelihood": "A String", # Likelihood to return for this CustomInfoType. This base value can be

5601

# altered by a detection rule if the finding meets the criteria specified by

5602

# the rule. Defaults to `VERY_LIKELY` if not specified.

5603

"infoType": { # Type of information detected by the API. # CustomInfoType can either be a new infoType, or an extension of built-in

5604

# infoType, when the name matches one of existing infoTypes and that infoType

5605

# is specified in `InspectContent.info_types` field. Specifying the latter

5606

# adds findings to the one detected by the system. If built-in info type is

5607

# not specified in `InspectContent.info_types` list then the name is treated

5608

# as a custom info type.

5609

"name": "A String", # Name of the information type. Either a name of your choosing when

5610

# creating a CustomInfoType, or one of the names listed

5611

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5612

# a built-in type. InfoType names should conform to the pattern

5613

# `[a-zA-Z0-9_]{1,64}`.

5614

},

5615

"regex": { # Message defining a custom regular expression. # Regular expression based CustomInfoType.

5616

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5617

# specified, the entire match is returned. No more than 3 may be included.

5618

42,

5619

],

5620

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5621

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5622

# google/re2 repository on GitHub.

5623

},

5624

"detectionRules": [ # Set of detection rules to apply to all findings of this CustomInfoType.

5625

# Rules are applied in order that they are specified. Not supported for the

5626

# `surrogate_type` CustomInfoType.

5627

{ # Deprecated; use `InspectionRuleSet` instead. Rule for modifying a

5628

# `CustomInfoType` to alter behavior under certain circumstances, depending

5629

# on the specific details of the rule. Not supported for the `surrogate_type`

5630

# custom infoType.

5631

"hotwordRule": { # The rule that adjusts the likelihood of findings within a certain # Hotword-based detection rule.

5632

# proximity of hotwords.

5633

"likelihoodAdjustment": { # Message for specifying an adjustment to the likelihood of a finding as # Likelihood adjustment to apply to all matching findings.

5634

# part of a detection rule.

5635

"relativeLikelihood": 42, # Increase or decrease the likelihood by the specified number of

5636

# levels. For example, if a finding would be `POSSIBLE` without the

5637

# detection rule and `relative_likelihood` is 1, then it is upgraded to

5638

# `LIKELY`, while a value of -1 would downgrade it to `UNLIKELY`.

5639

# Likelihood may never drop below `VERY_UNLIKELY` or exceed

5640

# `VERY_LIKELY`, so applying an adjustment of 1 followed by an

5641

# adjustment of -1 when base likelihood is `VERY_LIKELY` will result in

5642

# a final likelihood of `LIKELY`.

5643

"fixedLikelihood": "A String", # Set the likelihood of a finding to a fixed value.

5644

},

5645

"hotwordRegex": { # Message defining a custom regular expression. # Regular expression pattern defining what qualifies as a hotword.

5646

"groupIndexes": [ # The index of the submatch to extract as findings. When not

5647

# specified, the entire match is returned. No more than 3 may be included.

5648

42,

5649

],

5650

"pattern": "A String", # Pattern defining the regular expression. Its syntax

5651

# (https://github.com/google/re2/wiki/Syntax) can be found under the

5652

# google/re2 repository on GitHub.

5653

},

5654

"proximity": { # Message for specifying a window around a finding to apply a detection # Proximity of the finding within which the entire hotword must reside.

5655

# The total length of the window cannot exceed 1000 characters. Note that

5656

# the finding itself will be included in the window, so that hotwords may

5657

# be used to match substrings of the finding itself. For example, the

5658

# certainty of a phone number regex "\(\d{3}\) \d{3}-\d{4}" could be

5659

# adjusted upwards if the area code is known to be the local area code of

5660

# a company office using the hotword regex "\(xxx\)", where "xxx"

5661

# is the area code in question.

5662

# rule.

5663

"windowBefore": 42, # Number of characters before the finding to consider.

5664

"windowAfter": 42, # Number of characters after the finding to consider.

},

},

},

],

"exclusionType": "A String", # If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding

5670

# to be returned. It still can be used for rules matching.

5671

"dictionary": { # Custom information type based on a dictionary of words or phrases. This can # A list of phrases to detect as a CustomInfoType.

5672

# be used to match sensitive information specific to the data, such as a list

5673

# of employee IDs or job titles.

5674

#

5675

# Dictionary words are case-insensitive and all characters other than letters

5676

# and digits in the unicode [Basic Multilingual

5677

# Plane](https://en.wikipedia.org/wiki/Plane_%28Unicode%29#Basic_Multilingual_Plane)

5678

# will be replaced with whitespace when scanning for matches, so the

5679

# dictionary phrase "Sam Johnson" will match all three phrases "sam johnson",

5680

# "Sam, Johnson", and "Sam (Johnson)". Additionally, the characters

5681

# surrounding any match must be of a different type than the adjacent

5682

# characters within the word, so letters must be next to non-letters and

5683

# digits next to non-digits. For example, the dictionary word "jen" will

5684

# match the first three letters of the text "jen123" but will return no

5685

# matches for "jennifer".

5686

#

5687

# Dictionary words containing a large number of characters that are not

5688

# letters or digits may result in unexpected findings because such characters

5689

# are treated as whitespace. The

5690

# [limits](https://cloud.google.com/dlp/limits) page contains details about

5691

# the size limits of dictionaries. For dictionaries that do not fit within

5692

# these constraints, consider using `LargeCustomDictionaryConfig` in the

5693

# `StoredInfoType` API.

5694

"wordList": { # Message defining a list of words or phrases to search for in the data. # List of words or phrases to search for.

5695

"words": [ # Words or phrases defining the dictionary. The dictionary must contain

5696

# at least one phrase and every phrase must contain at least 2 characters

5697

# that are letters or digits. [required]

"A String",

],

},

"cloudStoragePath": { # Message representing a single file or path in Cloud Storage. # Newline-delimited file of words in Cloud Storage. Only a single file

5702

# is accepted.

5703

"path": "A String", # A url representing a file or path (no wildcards) in Cloud Storage.

5704

# Example: gs://[BUCKET_NAME]/dictionary.txt

5705

},

5706

},

5707

"storedType": { # A reference to a StoredInfoType to use with scanning. # Load an existing `StoredInfoType` resource for use in

5708

# `InspectDataSource`. Not currently supported in `InspectContent`.

5709

"name": "A String", # Resource name of the requested `StoredInfoType`, for example

5710

# `organizations/433245324/storedInfoTypes/432452342` or

5711

# `projects/project-id/storedInfoTypes/432452342`.

5712

"createTime": "A String", # Timestamp indicating when the version of the `StoredInfoType` used for

5713

# inspection was created. Output-only field, populated by the system.

5714

},

5715

"surrogateType": { # Message for detecting output from deidentification transformations # Message for detecting output from deidentification transformations that

5716

# support reversing.

5717

# such as

5718

# [`CryptoReplaceFfxFpeConfig`](/dlp/docs/reference/rest/v2/organizations.deidentifyTemplates#cryptoreplaceffxfpeconfig).

5719

# These types of transformations are

5720

# those that perform pseudonymization, thereby producing a "surrogate" as

5721

# output. This should be used in conjunction with a field on the

5722

# transformation such as `surrogate_info_type`. This CustomInfoType does

5723

# not support the use of `detection_rules`.

},

},

],

},

"locationId": "A String", # The geographic location to process content reidentification. Reserved for

5729

# future extensions.

5730

"reidentifyTemplateName": "A String", # Template to use. References an instance of `DeidentifyTemplate`.

5731

# Any configuration directly specified in `reidentify_config` or

5732

# `inspect_config` will override those set in the template. Singular fields

5733

# that are set in this request will replace their corresponding fields in the

5734

# template. Repeated fields are appended. Singular sub-messages and groups

5735

# are recursively merged.

5736

"reidentifyConfig": { # The configuration that controls how the data will change. # Configuration for the re-identification of the content item.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5737

# This field shares the same proto message type that is used for

5738

# de-identification, however its usage here is for the reversal of the

5739

# previous de-identification. Re-identification is performed by examining

5740

# the transformations used to de-identify the items and executing the

5741

# reverse. This requires that only reversible transformations

5742

# be provided here. The reversible transformations are:

5743

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5744

# - `CryptoDeterministicConfig`

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5745

# - `CryptoReplaceFfxFpeConfig`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5746

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default

5747

# mode is `TransformationErrorHandling.ThrowError`.

5748

# transformation error occurs when the requested transformation is incompatible

5749

# with the data. For example, trying to de-identify an IP address using a

5750

# `DateShift` transformation would result in a transformation error, since date

5751

# info cannot be extracted from an IP address.

5752

# Information about any incompatible transformations, and how they were

5753

# handled, is returned in the response as part of the

5754

# `TransformationOverviews`.

5755

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

5756

},

5757

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would # Ignore errors

5758

# cause an error. For example, if a `DateShift` transformation were applied

5759

# an an IP address, this mode would leave the IP address unchanged in the

5760

# response.

5761

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5762

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5763

"recordTransformations": { # A type of transformation that is applied over structured data such as a # Treat the dataset as structured. Transformations can be applied to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5764

# specific locations within structured datasets, such as transforming

5765

# a column within a table.

5766

# table.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5767

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5768

# match any suppression rule are omitted from the output.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5769

{ # Configuration to suppress records whose suppression conditions evaluate to

5770

# true.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5771

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5772

# evaluated to be suppressed from the transformed content.

5773

# a field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5774

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

5775

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

5776

# only supported value is `AND`.

5777

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

5778

"conditions": [ # A collection of conditions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5779

{ # The field type of `value` and `field` do not need to match to be

5780

# considered equal, but not all comparisons are possible.

5781

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

5782

# but all other comparisons are invalid with incompatible types.

5783

# A `value` of type:

5784

#

5785

# - `string` can be compared against all other types

5786

# - `boolean` can only be compared against other booleans

5787

# - `integer` can be compared against doubles or a string if the string value

5788

# can be parsed as an integer.

5789

# - `double` can be compared against integers or a string if the string can

5790

# be parsed as a double.

5791

# - `Timestamp` can be compared against strings in RFC 3339 date string

5792

# format.

5793

# - `TimeOfDay` can be compared against timestamps and strings in the format

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5794

# of 'HH:mm:ss'.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5795

#

5796

# If we fail to compare do to type mismatch, a warning will be given and

5797

# the condition will evaluate to false.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5798

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

5799

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5800

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5801

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

5802

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5803

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5804

# of bytes considered to comprise a 'Value' is based on its representation

5805

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5806

# 123456789, the number of bytes would be counted as 9, even though an

5807

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5808

"booleanValue": True or False, # boolean

5809

"floatValue": 3.14, # float

5810

"dayOfWeekValue": "A String", # day of week

5811

"timestampValue": "A String", # timestamp

5812

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5813

# and time zone are either specified elsewhere or are not significant. The date

5814

# is relative to the Proleptic Gregorian Calendar. This can represent:

5815

#

5816

# * A full date, with non-zero year, month and day values

5817

# * A month and day value, with a zero year, e.g. an anniversary

5818

# * A year on its own, with zero month and day values

5819

# * A year and month value, with a zero day, e.g. a credit card expiration date

5820

#

5821

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5822

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5823

# a year.

5824

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5825

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5826

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5827

# if specifying a year by itself or a year and month where the day is not

5828

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5829

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5830

"stringValue": "A String", # string

5831

"integerValue": "A String", # integer

5832

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

5833

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5834

# types are google.type.Date and `google.protobuf.Timestamp`.

5835

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5836

# allow the value 60 if it allows leap-seconds.

5837

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

5838

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5839

# to allow the value "24:00:00" for scenarios like business closing time.

5840

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

5841

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

},

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5850

"fieldTransformations": [ # Transform the record by applying various field transformations.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5851

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5852

"fields": [ # Required. Input field(s) to apply the transformation to.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5853

{ # General identifier of a data field in a storage service.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5854

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5855

},

5856

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5857

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5858

# transform content that matches an `InfoType`.

5859

# apply various `PrimitiveTransformation`s to each finding, where the

5860

# transformation is applied to only values that were identified as a specific

5861

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5862

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

5863

# for a given infoType.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5864

{ # A transformation to apply to text that is identified as a specific

5865

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5866

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

5867

# this transformation to apply to all findings that correspond to

5868

# infoTypes that were requested in `InspectConfig`.

5869

{ # Type of information detected by the API.

5870

"name": "A String", # Name of the information type. Either a name of your choosing when

5871

# creating a CustomInfoType, or one of the names listed

5872

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5873

# a built-in type. InfoType names should conform to the pattern

5874

# `[a-zA-Z0-9_]{1,64}`.

5875

},

5876

],

5877

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

5878

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

5879

# portion of the value.

5880

"partToExtract": "A String", # The part of the time to keep.

5881

},

5882

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

5883

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

5884

# to learn more.

5885

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

5886

# If set, must also set cryptoKey. If set, shift will be consistent for the

5887

# given context.

5888

"name": "A String", # Name describing the field.

5889

},

5890

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

5891

# range (inclusive ends). Negative means shift to earlier in time. Must not

5892

# be more than 365250 days (1000 years) each direction.

5893

#

5894

# For example, 3 means shift date to at most 3 days into the future.

5895

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

5896

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

5897

# results in the same shift for the same context and crypto_key. If

5898

# set, must also set context. Can only be applied to table items.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5899

# a key encryption key (KEK) stored by KMS).

5900

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5901

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5902

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5903

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5904

# The wrapped key must be a 128/192/256 bit key.

5905

# Authorization requires the following IAM permissions when sending a request

5906

# to perform a crypto transformation using a kms-wrapped crypto key:

5907

# dlp.kms.encrypt

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5908

"wrappedKey": "A String", # Required. The wrapped data crypto key.

5909

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5910

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5911

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5912

# leaking the key. Choose another type of key if possible.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5913

"key": "A String", # Required. A 128/192/256 bit key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5914

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5915

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5916

# It will be discarded after the request finishes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5917

"name": "A String", # Required. Name of the key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5918

# This is an arbitrary string used to differentiate different keys.

5919

# A unique key is generated per name: two separate `TransientCryptoKey`

5920

# protos share the same generated key if their names are the same.

5921

# When the data crypto key is generated, this name is not used in any way

5922

# (repeating the api call will result in a different key being generated).

5923

},

5924

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5925

},

5926

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

5927

},

5928

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

5929

# Uses SHA-256.

5930

# The key size must be either 32 or 64 bytes.

5931

# Outputs a base64 encoded representation of the hashed output

5932

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

5933

# Currently, only string and integer values can be hashed.

5934

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

5935

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

5936

# a key encryption key (KEK) stored by KMS).

5937

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5938

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5939

# unwrap the data crypto key.

5940

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5941

# The wrapped key must be a 128/192/256 bit key.

5942

# Authorization requires the following IAM permissions when sending a request

5943

# to perform a crypto transformation using a kms-wrapped crypto key:

5944

# dlp.kms.encrypt

5945

"wrappedKey": "A String", # Required. The wrapped data crypto key.

5946

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5947

},

5948

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5949

# leaking the key. Choose another type of key if possible.

5950

"key": "A String", # Required. A 128/192/256 bit key.

5951

},

5952

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5953

# It will be discarded after the request finishes.

5954

"name": "A String", # Required. Name of the key.

5955

# This is an arbitrary string used to differentiate different keys.

5956

# A unique key is generated per name: two separate `TransientCryptoKey`

5957

# protos share the same generated key if their names are the same.

5958

# When the data crypto key is generated, this name is not used in any way

5959

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

5964

# (FPE) with the FFX mode of operation; however when used in the

5965

# `ReidentifyContent` API method, it serves the opposite function by reversing

5966

# the surrogate back into the original identifier. The identifier must be

5967

# encoded as ASCII. For a given crypto key and context, the same identifier

5968

# will be replaced with the same surrogate. Identifiers must be at least two

5969

# characters long. In the case that the identifier is the empty string, it will

5970

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

5971

# more.

5972

#

5973

# Note: We recommend using CryptoDeterministicConfig for all use cases which

5974

# do not require preserving the input alphabet space and size, plus warrant

5975

# referential integrity.

5976

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

5977

# that the FFX mode natively supports. This happens before/after

5978

# encryption/decryption.

5979

# Each character listed must appear only once.

5980

# Number of characters must be in the range [2, 95].

5981

# This must be encoded as ASCII.

5982

# The order of characters does not matter.

5983

"commonAlphabet": "A String", # Common alphabets.

5984

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

5985

# This annotation will be applied to the surrogate by prefixing it with

5986

# the name of the custom infoType followed by the number of

5987

# characters comprising the surrogate. The following scheme defines the

5988

# format: info_type_name(surrogate_character_count):surrogate

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

5989

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5990

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

5991

# the surrogate is 'abc', the full replacement value

5992

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

5993

#

5994

# This annotation identifies the surrogate when inspecting content using the

5995

# custom infoType

5996

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

5997

# This facilitates reversal of the surrogate when it occurs in free text.

5998

#

5999

# In order for inspection to work properly, the name of this infoType must

6000

# not occur naturally anywhere in your data; otherwise, inspection may

6001

# find a surrogate that does not correspond to an actual identifier.

6002

# Therefore, choose your custom infoType name carefully after considering

6003

# what your data looks like. One way to select a name that has a high chance

6004

# of yielding reliable detection is to include one or more unicode characters

6005

# that are highly improbable to exist in your data.

6006

# For example, assuming your data is entered from a regular ASCII keyboard,

6007

# the symbol with the hex code point 29DD might be used like so:

6008

# ⧝MY_TOKEN_TYPE

6009

"name": "A String", # Name of the information type. Either a name of your choosing when

6010

# creating a CustomInfoType, or one of the names listed

6011

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6012

# a built-in type. InfoType names should conform to the pattern

6013

# `[a-zA-Z0-9_]{1,64}`.

6014

},

6015

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

6016

# identifier in two different contexts won't be given the same surrogate. If

6017

# the context is not set, a default tweak will be used.

6018

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6019

# If the context is set but:

6020

#

6021

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6022

# 1. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6023

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6024

# a default tweak will be used.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6025

#

6026

# Note that case (1) is expected when an `InfoTypeTransformation` is

6027

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6028

# Currently, the referenced field may be of value type integer or string.

6029

#

6030

# The tweak is constructed as a sequence of bytes in big endian byte order

6031

# such that:

6032

#

6033

# - a 64 bit integer is encoded followed by a single byte of value 1

6034

# - a string is encoded in UTF-8 format followed by a single byte of value 2

6035

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6036

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6037

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

6038

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

6039

# a key encryption key (KEK) stored by KMS).

6040

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6041

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6042

# unwrap the data crypto key.

6043

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6044

# The wrapped key must be a 128/192/256 bit key.

6045

# Authorization requires the following IAM permissions when sending a request

6046

# to perform a crypto transformation using a kms-wrapped crypto key:

6047

# dlp.kms.encrypt

6048

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6049

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6050

},

6051

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6052

# leaking the key. Choose another type of key if possible.

6053

"key": "A String", # Required. A 128/192/256 bit key.

6054

},

6055

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6056

# It will be discarded after the request finishes.

6057

"name": "A String", # Required. Name of the key.

6058

# This is an arbitrary string used to differentiate different keys.

6059

# A unique key is generated per name: two separate `TransientCryptoKey`

6060

# protos share the same generated key if their names are the same.

6061

# When the data crypto key is generated, this name is not used in any way

6062

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

6067

# input. Outputs a base64 encoded representation of the encrypted output.

6068

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

6069

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6070

# This annotation will be applied to the surrogate by prefixing it with

6071

# the name of the custom info type followed by the number of

6072

# characters comprising the surrogate. The following scheme defines the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6073

# format: {info type name}({surrogate character count}):{surrogate}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6074

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6075

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

6076

# the surrogate is 'abc', the full replacement value

6077

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6078

#

6079

# This annotation identifies the surrogate when inspecting content using the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6080

# custom info type 'Surrogate'. This facilitates reversal of the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6081

# surrogate when it occurs in free text.

6082

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6083

# Note: For record transformations where the entire cell in a table is being

6084

# transformed, surrogates are not mandatory. Surrogates are used to denote

6085

# the location of the token and are necessary for re-identification in free

6086

# form text.

6087

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6088

# In order for inspection to work properly, the name of this info type must

6089

# not occur naturally anywhere in your data; otherwise, inspection may either

6090

#

6091

# - reverse a surrogate that does not correspond to an actual identifier

6092

# - be unable to parse the surrogate and result in an error

6093

#

6094

# Therefore, choose your custom info type name carefully after considering

6095

# what your data looks like. One way to select a name that has a high chance

6096

# of yielding reliable detection is to include one or more unicode characters

6097

# that are highly improbable to exist in your data.

6098

# For example, assuming your data is entered from a regular ASCII keyboard,

6099

# the symbol with the hex code point 29DD might be used like so:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6100

# ⧝MY_TOKEN_TYPE.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6101

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6102

# creating a CustomInfoType, or one of the names listed

6103

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6104

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6105

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6106

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6107

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

6108

# referential integrity such that the same identifier in two different

6109

# contexts will be given a distinct surrogate. The context is appended to

6110

# plaintext value being encrypted. On decryption the provided context is

6111

# validated against the value used during encryption. If a context was

6112

# provided during encryption, same context must be provided during decryption

6113

# as well.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6114

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6115

# If the context is not set, plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6116

# If the context is set but:

6117

#

6118

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6119

# 2. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6120

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6121

# plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6122

#

6123

# Note that case (1) is expected when an `InfoTypeTransformation` is

6124

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6125

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6126

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6127

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

6128

# a key encryption key (KEK) stored by KMS).

6129

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6130

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6131

# unwrap the data crypto key.

6132

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6133

# The wrapped key must be a 128/192/256 bit key.

6134

# Authorization requires the following IAM permissions when sending a request

6135

# to perform a crypto transformation using a kms-wrapped crypto key:

6136

# dlp.kms.encrypt

6137

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6138

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6139

},

6140

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6141

# leaking the key. Choose another type of key if possible.

6142

"key": "A String", # Required. A 128/192/256 bit key.

6143

},

6144

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6145

# It will be discarded after the request finishes.

6146

"name": "A String", # Required. Name of the key.

6147

# This is an arbitrary string used to differentiate different keys.

6148

# A unique key is generated per name: two separate `TransientCryptoKey`

6149

# protos share the same generated key if their names are the same.

6150

# When the data crypto key is generated, this name is not used in any way

6151

# (repeating the api call will result in a different key being generated).

6152

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6153

},

6154

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6155

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

6156

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

6157

# output would be 'My phone number is '.

6158

},

6159

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6160

# replacement values are dynamically provided by the user for custom behavior,

6161

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

6162

# This can be used on

6163

# data of type: number, long, string, timestamp.

6164

# If the bound `Value` type differs from the type of data being transformed, we

6165

# will first attempt converting the type of the data to be transformed to match

6166

# the type of the bound before comparing.

6167

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6168

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6169

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6170

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6171

# used.

6172

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6173

# of bytes considered to comprise a 'Value' is based on its representation

6174

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6175

# 123456789, the number of bytes would be counted as 9, even though an

6176

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6177

"booleanValue": True or False, # boolean

6178

"floatValue": 3.14, # float

6179

"dayOfWeekValue": "A String", # day of week

6180

"timestampValue": "A String", # timestamp

6181

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6182

# and time zone are either specified elsewhere or are not significant. The date

6183

# is relative to the Proleptic Gregorian Calendar. This can represent:

6184

#

6185

# * A full date, with non-zero year, month and day values

6186

# * A month and day value, with a zero year, e.g. an anniversary

6187

# * A year on its own, with zero month and day values

6188

# * A year and month value, with a zero day, e.g. a credit card expiration date

6189

#

6190

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6191

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6192

# a year.

6193

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6194

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6195

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6196

# if specifying a year by itself or a year and month where the day is not

6197

# significant.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6198

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6199

"stringValue": "A String", # string

6200

"integerValue": "A String", # integer

6201

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6202

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6203

# types are google.type.Date and `google.protobuf.Timestamp`.

6204

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6205

# allow the value 60 if it allows leap-seconds.

6206

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6207

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6208

# to allow the value "24:00:00" for scenarios like business closing time.

6209

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6210

},

6211

},

6212

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

6213

# Note that for the purposes of inspection or transformation, the number

6214

# of bytes considered to comprise a 'Value' is based on its representation

6215

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6216

# 123456789, the number of bytes would be counted as 9, even though an

6217

# int64 only holds up to 8 bytes of data.

6218

"booleanValue": True or False, # boolean

6219

"floatValue": 3.14, # float

6220

"dayOfWeekValue": "A String", # day of week

6221

"timestampValue": "A String", # timestamp

6222

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6223

# and time zone are either specified elsewhere or are not significant. The date

6224

# is relative to the Proleptic Gregorian Calendar. This can represent:

6225

#

6226

# * A full date, with non-zero year, month and day values

6227

# * A month and day value, with a zero year, e.g. an anniversary

6228

# * A year on its own, with zero month and day values

6229

# * A year and month value, with a zero day, e.g. a credit card expiration date

6230

#

6231

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6232

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6233

# a year.

6234

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6235

# month and day.

6236

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6237

# if specifying a year by itself or a year and month where the day is not

6238

# significant.

6239

},

6240

"stringValue": "A String", # string

6241

"integerValue": "A String", # integer

6242

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6243

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6244

# types are google.type.Date and `google.protobuf.Timestamp`.

6245

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6246

# allow the value 60 if it allows leap-seconds.

6247

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6248

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6249

# to allow the value "24:00:00" for scenarios like business closing time.

6250

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6251

},

6252

},

6253

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

6254

# the default behavior will be to hyphenate the min-max range.

6255

# Note that for the purposes of inspection or transformation, the number

6256

# of bytes considered to comprise a 'Value' is based on its representation

6257

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6258

# 123456789, the number of bytes would be counted as 9, even though an

6259

# int64 only holds up to 8 bytes of data.

6260

"booleanValue": True or False, # boolean

6261

"floatValue": 3.14, # float

6262

"dayOfWeekValue": "A String", # day of week

6263

"timestampValue": "A String", # timestamp

6264

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6265

# and time zone are either specified elsewhere or are not significant. The date

6266

# is relative to the Proleptic Gregorian Calendar. This can represent:

6267

#

6268

# * A full date, with non-zero year, month and day values

6269

# * A month and day value, with a zero year, e.g. an anniversary

6270

# * A year on its own, with zero month and day values

6271

# * A year and month value, with a zero day, e.g. a credit card expiration date

6272

#

6273

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6274

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6275

# a year.

6276

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6277

# month and day.

6278

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6279

# if specifying a year by itself or a year and month where the day is not

6280

# significant.

6281

},

6282

"stringValue": "A String", # string

6283

"integerValue": "A String", # integer

6284

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6285

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6286

# types are google.type.Date and `google.protobuf.Timestamp`.

6287

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6288

# allow the value 60 if it allows leap-seconds.

6289

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6290

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6291

# to allow the value "24:00:00" for scenarios like business closing time.

6292

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6293

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6298

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

6299

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6300

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6301

# of bytes considered to comprise a 'Value' is based on its representation

6302

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6303

# 123456789, the number of bytes would be counted as 9, even though an

6304

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6305

"booleanValue": True or False, # boolean

6306

"floatValue": 3.14, # float

6307

"dayOfWeekValue": "A String", # day of week

6308

"timestampValue": "A String", # timestamp

6309

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6310

# and time zone are either specified elsewhere or are not significant. The date

6311

# is relative to the Proleptic Gregorian Calendar. This can represent:

6312

#

6313

# * A full date, with non-zero year, month and day values

6314

# * A month and day value, with a zero year, e.g. an anniversary

6315

# * A year on its own, with zero month and day values

6316

# * A year and month value, with a zero day, e.g. a credit card expiration date

6317

#

6318

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6319

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6320

# a year.

6321

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

6322

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6323

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6324

# if specifying a year by itself or a year and month where the day is not

6325

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6326

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6327

"stringValue": "A String", # string

6328

"integerValue": "A String", # integer

6329

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6330

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6331

# types are google.type.Date and `google.protobuf.Timestamp`.

6332

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6333

# allow the value 60 if it allows leap-seconds.

6334

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6335

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6336

# to allow the value "24:00:00" for scenarios like business closing time.

6337

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

6342

# fixed character. Masking can start from the beginning or end of the string.

6343

# This can be used on data of any type (numbers, longs, and so on) and when

6344

# de-identifying structured data we'll attempt to preserve the original data's

6345

# type. (This allows you to take a long like 123 and modify it to a string like

6346

# **3.

6347

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

6348

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

6349

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

6350

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

6351

# is `true`, then the string `12345` is masked as `12***`.

6352

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

6353

# characters. For example, if the input string is `555-555-5555` and you

6354

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

6355

# returns `***-**5-5555`.

6356

{ # Characters to skip when doing deidentification of a value. These will be left

6357

# alone and skipped.

6358

"charactersToSkip": "A String", # Characters to not transform when masking.

6359

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

6364

# masked. Skipped characters do not count towards this tally.

6365

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

6366

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

6367

# code or credit card number. This string must have a length of 1. If not

6368

# supplied, this value defaults to `*` for strings, and `0` for digits.

6369

},

6370

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

6371

# Bucketing transformation can provide all of this functionality,

6372

# but requires more configuration. This message is provided as a convenience to

6373

# the user for simple bucketing strategies.

6374

#

6375

# The transformed value will be a hyphenated string of

6376

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

6377

# all values that are within this bucket will be replaced with "10-20".

6378

#

6379

# This can be used on data of type: double, long.

6380

#

6381

# If the bound Value type differs from the type of data

6382

# being transformed, we will first attempt converting the type of the data to

6383

# be transformed to match the type of the bound before comparing.

6384

#

6385

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

6386

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

6387

# grouped together into a single bucket; for example if `lower_bound` = 10,

6388

# then all values less than 10 are replaced with the value "-10".

6389

# Note that for the purposes of inspection or transformation, the number

6390

# of bytes considered to comprise a 'Value' is based on its representation

6391

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6392

# 123456789, the number of bytes would be counted as 9, even though an

6393

# int64 only holds up to 8 bytes of data.

6394

"booleanValue": True or False, # boolean

6395

"floatValue": 3.14, # float

6396

"dayOfWeekValue": "A String", # day of week

6397

"timestampValue": "A String", # timestamp

6398

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6399

# and time zone are either specified elsewhere or are not significant. The date

6400

# is relative to the Proleptic Gregorian Calendar. This can represent:

6401

#

6402

# * A full date, with non-zero year, month and day values

6403

# * A month and day value, with a zero year, e.g. an anniversary

6404

# * A year on its own, with zero month and day values

6405

# * A year and month value, with a zero day, e.g. a credit card expiration date

6406

#

6407

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6408

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6409

# a year.

6410

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6411

# month and day.

6412

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6413

# if specifying a year by itself or a year and month where the day is not

6414

# significant.

6415

},

6416

"stringValue": "A String", # string

6417

"integerValue": "A String", # integer

6418

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6419

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6420

# types are google.type.Date and `google.protobuf.Timestamp`.

6421

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6422

# allow the value 60 if it allows leap-seconds.

6423

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6424

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6425

# to allow the value "24:00:00" for scenarios like business closing time.

6426

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6427

},

6428

},

6429

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

6430

# grouped together into a single bucket; for example if `upper_bound` = 89,

6431

# then all values greater than 89 are replaced with the value "89+".

6432

# Note that for the purposes of inspection or transformation, the number

6433

# of bytes considered to comprise a 'Value' is based on its representation

6434

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6435

# 123456789, the number of bytes would be counted as 9, even though an

6436

# int64 only holds up to 8 bytes of data.

6437

"booleanValue": True or False, # boolean

6438

"floatValue": 3.14, # float

6439

"dayOfWeekValue": "A String", # day of week

6440

"timestampValue": "A String", # timestamp

6441

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6442

# and time zone are either specified elsewhere or are not significant. The date

6443

# is relative to the Proleptic Gregorian Calendar. This can represent:

6444

#

6445

# * A full date, with non-zero year, month and day values

6446

# * A month and day value, with a zero year, e.g. an anniversary

6447

# * A year on its own, with zero month and day values

6448

# * A year and month value, with a zero day, e.g. a credit card expiration date

6449

#

6450

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6451

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6452

# a year.

6453

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6454

# month and day.

6455

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6456

# if specifying a year by itself or a year and month where the day is not

6457

# significant.

6458

},

6459

"stringValue": "A String", # string

6460

"integerValue": "A String", # integer

6461

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6462

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6463

# types are google.type.Date and `google.protobuf.Timestamp`.

6464

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6465

# allow the value 60 if it allows leap-seconds.

6466

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6467

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6468

# to allow the value "24:00:00" for scenarios like business closing time.

6469

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6470

},

6471

},

6472

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

6473

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

6474

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

6475

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

},

},

},

],

},

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

6482

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

6483

# portion of the value.

6484

"partToExtract": "A String", # The part of the time to keep.

6485

},

6486

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

6487

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

6488

# to learn more.

6489

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

6490

# If set, must also set cryptoKey. If set, shift will be consistent for the

6491

# given context.

6492

"name": "A String", # Name describing the field.

6493

},

6494

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

6495

# range (inclusive ends). Negative means shift to earlier in time. Must not

6496

# be more than 365250 days (1000 years) each direction.

6497

#

6498

# For example, 3 means shift date to at most 3 days into the future.

6499

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

6500

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

6501

# results in the same shift for the same context and crypto_key. If

6502

# set, must also set context. Can only be applied to table items.

6503

# a key encryption key (KEK) stored by KMS).

6504

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6505

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6506

# unwrap the data crypto key.

6507

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6508

# The wrapped key must be a 128/192/256 bit key.

6509

# Authorization requires the following IAM permissions when sending a request

6510

# to perform a crypto transformation using a kms-wrapped crypto key:

6511

# dlp.kms.encrypt

6512

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6513

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6514

},

6515

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6516

# leaking the key. Choose another type of key if possible.

6517

"key": "A String", # Required. A 128/192/256 bit key.

6518

},

6519

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6520

# It will be discarded after the request finishes.

6521

"name": "A String", # Required. Name of the key.

6522

# This is an arbitrary string used to differentiate different keys.

6523

# A unique key is generated per name: two separate `TransientCryptoKey`

6524

# protos share the same generated key if their names are the same.

6525

# When the data crypto key is generated, this name is not used in any way

6526

# (repeating the api call will result in a different key being generated).

},

},

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

6531

},

6532

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

6533

# Uses SHA-256.

6534

# The key size must be either 32 or 64 bytes.

6535

# Outputs a base64 encoded representation of the hashed output

6536

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

6537

# Currently, only string and integer values can be hashed.

6538

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

6539

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

6540

# a key encryption key (KEK) stored by KMS).

6541

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6542

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6543

# unwrap the data crypto key.

6544

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6545

# The wrapped key must be a 128/192/256 bit key.

6546

# Authorization requires the following IAM permissions when sending a request

6547

# to perform a crypto transformation using a kms-wrapped crypto key:

6548

# dlp.kms.encrypt

6549

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6550

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6551

},

6552

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6553

# leaking the key. Choose another type of key if possible.

6554

"key": "A String", # Required. A 128/192/256 bit key.

6555

},

6556

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6557

# It will be discarded after the request finishes.

6558

"name": "A String", # Required. Name of the key.

6559

# This is an arbitrary string used to differentiate different keys.

6560

# A unique key is generated per name: two separate `TransientCryptoKey`

6561

# protos share the same generated key if their names are the same.

6562

# When the data crypto key is generated, this name is not used in any way

6563

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

6568

# (FPE) with the FFX mode of operation; however when used in the

6569

# `ReidentifyContent` API method, it serves the opposite function by reversing

6570

# the surrogate back into the original identifier. The identifier must be

6571

# encoded as ASCII. For a given crypto key and context, the same identifier

6572

# will be replaced with the same surrogate. Identifiers must be at least two

6573

# characters long. In the case that the identifier is the empty string, it will

6574

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

6575

# more.

6576

#

6577

# Note: We recommend using CryptoDeterministicConfig for all use cases which

6578

# do not require preserving the input alphabet space and size, plus warrant

6579

# referential integrity.

6580

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

6581

# that the FFX mode natively supports. This happens before/after

6582

# encryption/decryption.

6583

# Each character listed must appear only once.

6584

# Number of characters must be in the range [2, 95].

6585

# This must be encoded as ASCII.

6586

# The order of characters does not matter.

6587

"commonAlphabet": "A String", # Common alphabets.

6588

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

6589

# This annotation will be applied to the surrogate by prefixing it with

6590

# the name of the custom infoType followed by the number of

6591

# characters comprising the surrogate. The following scheme defines the

6592

# format: info_type_name(surrogate_character_count):surrogate

6593

#

6594

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

6595

# the surrogate is 'abc', the full replacement value

6596

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

6597

#

6598

# This annotation identifies the surrogate when inspecting content using the

6599

# custom infoType

6600

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

6601

# This facilitates reversal of the surrogate when it occurs in free text.

6602

#

6603

# In order for inspection to work properly, the name of this infoType must

6604

# not occur naturally anywhere in your data; otherwise, inspection may

6605

# find a surrogate that does not correspond to an actual identifier.

6606

# Therefore, choose your custom infoType name carefully after considering

6607

# what your data looks like. One way to select a name that has a high chance

6608

# of yielding reliable detection is to include one or more unicode characters

6609

# that are highly improbable to exist in your data.

6610

# For example, assuming your data is entered from a regular ASCII keyboard,

6611

# the symbol with the hex code point 29DD might be used like so:

6612

# ⧝MY_TOKEN_TYPE

6613

"name": "A String", # Name of the information type. Either a name of your choosing when

6614

# creating a CustomInfoType, or one of the names listed

6615

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6616

# a built-in type. InfoType names should conform to the pattern

6617

# `[a-zA-Z0-9_]{1,64}`.

6618

},

6619

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

6620

# identifier in two different contexts won't be given the same surrogate. If

6621

# the context is not set, a default tweak will be used.

6622

#

6623

# If the context is set but:

6624

#

6625

# 1. there is no record present when transforming a given value or

6626

# 1. the field is not present when transforming a given value,

6627

#

6628

# a default tweak will be used.

6629

#

6630

# Note that case (1) is expected when an `InfoTypeTransformation` is

6631

# applied to both structured and non-structured `ContentItem`s.

6632

# Currently, the referenced field may be of value type integer or string.

6633

#

6634

# The tweak is constructed as a sequence of bytes in big endian byte order

6635

# such that:

6636

#

6637

# - a 64 bit integer is encoded followed by a single byte of value 1

6638

# - a string is encoded in UTF-8 format followed by a single byte of value 2

6639

"name": "A String", # Name describing the field.

6640

},

6641

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

6642

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

6643

# a key encryption key (KEK) stored by KMS).

6644

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6645

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6646

# unwrap the data crypto key.

6647

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6648

# The wrapped key must be a 128/192/256 bit key.

6649

# Authorization requires the following IAM permissions when sending a request

6650

# to perform a crypto transformation using a kms-wrapped crypto key:

6651

# dlp.kms.encrypt

6652

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6653

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6654

},

6655

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6656

# leaking the key. Choose another type of key if possible.

6657

"key": "A String", # Required. A 128/192/256 bit key.

6658

},

6659

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6660

# It will be discarded after the request finishes.

6661

"name": "A String", # Required. Name of the key.

6662

# This is an arbitrary string used to differentiate different keys.

6663

# A unique key is generated per name: two separate `TransientCryptoKey`

6664

# protos share the same generated key if their names are the same.

6665

# When the data crypto key is generated, this name is not used in any way

6666

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

6671

# input. Outputs a base64 encoded representation of the encrypted output.

6672

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

6673

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

6674

# This annotation will be applied to the surrogate by prefixing it with

6675

# the name of the custom info type followed by the number of

6676

# characters comprising the surrogate. The following scheme defines the

6677

# format: {info type name}({surrogate character count}):{surrogate}

6678

#

6679

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

6680

# the surrogate is 'abc', the full replacement value

6681

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

6682

#

6683

# This annotation identifies the surrogate when inspecting content using the

6684

# custom info type 'Surrogate'. This facilitates reversal of the

6685

# surrogate when it occurs in free text.

6686

#

6687

# Note: For record transformations where the entire cell in a table is being

6688

# transformed, surrogates are not mandatory. Surrogates are used to denote

6689

# the location of the token and are necessary for re-identification in free

6690

# form text.

6691

#

6692

# In order for inspection to work properly, the name of this info type must

6693

# not occur naturally anywhere in your data; otherwise, inspection may either

6694

#

6695

# - reverse a surrogate that does not correspond to an actual identifier

6696

# - be unable to parse the surrogate and result in an error

6697

#

6698

# Therefore, choose your custom info type name carefully after considering

6699

# what your data looks like. One way to select a name that has a high chance

6700

# of yielding reliable detection is to include one or more unicode characters

6701

# that are highly improbable to exist in your data.

6702

# For example, assuming your data is entered from a regular ASCII keyboard,

6703

# the symbol with the hex code point 29DD might be used like so:

6704

# ⧝MY_TOKEN_TYPE.

6705

"name": "A String", # Name of the information type. Either a name of your choosing when

6706

# creating a CustomInfoType, or one of the names listed

6707

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6708

# a built-in type. InfoType names should conform to the pattern

6709

# `[a-zA-Z0-9_]{1,64}`.

6710

},

6711

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

6712

# referential integrity such that the same identifier in two different

6713

# contexts will be given a distinct surrogate. The context is appended to

6714

# plaintext value being encrypted. On decryption the provided context is

6715

# validated against the value used during encryption. If a context was

6716

# provided during encryption, same context must be provided during decryption

6717

# as well.

6718

#

6719

# If the context is not set, plaintext would be used as is for encryption.

6720

# If the context is set but:

6721

#

6722

# 1. there is no record present when transforming a given value or

6723

# 2. the field is not present when transforming a given value,

6724

#

6725

# plaintext would be used as is for encryption.

6726

#

6727

# Note that case (1) is expected when an `InfoTypeTransformation` is

6728

# applied to both structured and non-structured `ContentItem`s.

6729

"name": "A String", # Name describing the field.

6730

},

6731

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

6732

# a key encryption key (KEK) stored by KMS).

6733

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6734

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6735

# unwrap the data crypto key.

6736

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6737

# The wrapped key must be a 128/192/256 bit key.

6738

# Authorization requires the following IAM permissions when sending a request

6739

# to perform a crypto transformation using a kms-wrapped crypto key:

6740

# dlp.kms.encrypt

6741

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6742

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6743

},

6744

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6745

# leaking the key. Choose another type of key if possible.

6746

"key": "A String", # Required. A 128/192/256 bit key.

6747

},

6748

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6749

# It will be discarded after the request finishes.

6750

"name": "A String", # Required. Name of the key.

6751

# This is an arbitrary string used to differentiate different keys.

6752

# A unique key is generated per name: two separate `TransientCryptoKey`

6753

# protos share the same generated key if their names are the same.

6754

# When the data crypto key is generated, this name is not used in any way

6755

# (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

6760

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

6761

# output would be 'My phone number is '.

6762

},

6763

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

6764

# replacement values are dynamically provided by the user for custom behavior,

6765

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

6766

# This can be used on

6767

# data of type: number, long, string, timestamp.

6768

# If the bound `Value` type differs from the type of data being transformed, we

6769

# will first attempt converting the type of the data to be transformed to match

6770

# the type of the bound before comparing.

6771

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

6772

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

6773

{ # Bucket is represented as a range, along with replacement values.

6774

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

6775

# used.

6776

# Note that for the purposes of inspection or transformation, the number

6777

# of bytes considered to comprise a 'Value' is based on its representation

6778

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6779

# 123456789, the number of bytes would be counted as 9, even though an

6780

# int64 only holds up to 8 bytes of data.

6781

"booleanValue": True or False, # boolean

6782

"floatValue": 3.14, # float

6783

"dayOfWeekValue": "A String", # day of week

6784

"timestampValue": "A String", # timestamp

6785

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6786

# and time zone are either specified elsewhere or are not significant. The date

6787

# is relative to the Proleptic Gregorian Calendar. This can represent:

6788

#

6789

# * A full date, with non-zero year, month and day values

6790

# * A month and day value, with a zero year, e.g. an anniversary

6791

# * A year on its own, with zero month and day values

6792

# * A year and month value, with a zero day, e.g. a credit card expiration date

6793

#

6794

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6795

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6796

# a year.

6797

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6798

# month and day.

6799

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6800

# if specifying a year by itself or a year and month where the day is not

6801

# significant.

6802

},

6803

"stringValue": "A String", # string

6804

"integerValue": "A String", # integer

6805

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6806

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6807

# types are google.type.Date and `google.protobuf.Timestamp`.

6808

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6809

# allow the value 60 if it allows leap-seconds.

6810

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6811

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6812

# to allow the value "24:00:00" for scenarios like business closing time.

6813

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6814

},

6815

},

6816

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

6817

# Note that for the purposes of inspection or transformation, the number

6818

# of bytes considered to comprise a 'Value' is based on its representation

6819

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6820

# 123456789, the number of bytes would be counted as 9, even though an

6821

# int64 only holds up to 8 bytes of data.

6822

"booleanValue": True or False, # boolean

6823

"floatValue": 3.14, # float

6824

"dayOfWeekValue": "A String", # day of week

6825

"timestampValue": "A String", # timestamp

6826

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6827

# and time zone are either specified elsewhere or are not significant. The date

6828

# is relative to the Proleptic Gregorian Calendar. This can represent:

6829

#

6830

# * A full date, with non-zero year, month and day values

6831

# * A month and day value, with a zero year, e.g. an anniversary

6832

# * A year on its own, with zero month and day values

6833

# * A year and month value, with a zero day, e.g. a credit card expiration date

6834

#

6835

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6836

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6837

# a year.

6838

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6839

# month and day.

6840

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6841

# if specifying a year by itself or a year and month where the day is not

6842

# significant.

6843

},

6844

"stringValue": "A String", # string

6845

"integerValue": "A String", # integer

6846

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6847

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6848

# types are google.type.Date and `google.protobuf.Timestamp`.

6849

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6850

# allow the value 60 if it allows leap-seconds.

6851

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6852

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6853

# to allow the value "24:00:00" for scenarios like business closing time.

6854

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6855

},

6856

},

6857

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

6858

# the default behavior will be to hyphenate the min-max range.

6859

# Note that for the purposes of inspection or transformation, the number

6860

# of bytes considered to comprise a 'Value' is based on its representation

6861

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6862

# 123456789, the number of bytes would be counted as 9, even though an

6863

# int64 only holds up to 8 bytes of data.

6864

"booleanValue": True or False, # boolean

6865

"floatValue": 3.14, # float

6866

"dayOfWeekValue": "A String", # day of week

6867

"timestampValue": "A String", # timestamp

6868

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6869

# and time zone are either specified elsewhere or are not significant. The date

6870

# is relative to the Proleptic Gregorian Calendar. This can represent:

6871

#

6872

# * A full date, with non-zero year, month and day values

6873

# * A month and day value, with a zero year, e.g. an anniversary

6874

# * A year on its own, with zero month and day values

6875

# * A year and month value, with a zero day, e.g. a credit card expiration date

6876

#

6877

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6878

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6879

# a year.

6880

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6881

# month and day.

6882

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6883

# if specifying a year by itself or a year and month where the day is not

6884

# significant.

6885

},

6886

"stringValue": "A String", # string

6887

"integerValue": "A String", # integer

6888

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6889

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6890

# types are google.type.Date and `google.protobuf.Timestamp`.

6891

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6892

# allow the value 60 if it allows leap-seconds.

6893

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6894

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6895

# to allow the value "24:00:00" for scenarios like business closing time.

6896

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6897

},

6898

},

6899

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6900

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6901

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6902

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

6903

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

6904

# Note that for the purposes of inspection or transformation, the number

6905

# of bytes considered to comprise a 'Value' is based on its representation

6906

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6907

# 123456789, the number of bytes would be counted as 9, even though an

6908

# int64 only holds up to 8 bytes of data.

6909

"booleanValue": True or False, # boolean

6910

"floatValue": 3.14, # float

6911

"dayOfWeekValue": "A String", # day of week

6912

"timestampValue": "A String", # timestamp

6913

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6914

# and time zone are either specified elsewhere or are not significant. The date

6915

# is relative to the Proleptic Gregorian Calendar. This can represent:

6916

#

6917

# * A full date, with non-zero year, month and day values

6918

# * A month and day value, with a zero year, e.g. an anniversary

6919

# * A year on its own, with zero month and day values

6920

# * A year and month value, with a zero day, e.g. a credit card expiration date

6921

#

6922

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6923

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6924

# a year.

6925

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6926

# month and day.

6927

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6928

# if specifying a year by itself or a year and month where the day is not

6929

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6930

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6931

"stringValue": "A String", # string

6932

"integerValue": "A String", # integer

6933

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6934

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6935

# types are google.type.Date and `google.protobuf.Timestamp`.

6936

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6937

# allow the value 60 if it allows leap-seconds.

6938

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6939

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6940

# to allow the value "24:00:00" for scenarios like business closing time.

6941

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

6942

},

6943

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6944

},

6945

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

6946

# fixed character. Masking can start from the beginning or end of the string.

6947

# This can be used on data of any type (numbers, longs, and so on) and when

6948

# de-identifying structured data we'll attempt to preserve the original data's

6949

# type. (This allows you to take a long like 123 and modify it to a string like

6950

# **3.

6951

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

6952

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

6953

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

6954

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

6955

# is `true`, then the string `12345` is masked as `12***`.

6956

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

6957

# characters. For example, if the input string is `555-555-5555` and you

6958

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

6959

# returns `***-**5-5555`.

6960

{ # Characters to skip when doing deidentification of a value. These will be left

6961

# alone and skipped.

6962

"charactersToSkip": "A String", # Characters to not transform when masking.

6963

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

6968

# masked. Skipped characters do not count towards this tally.

6969

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

6970

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

6971

# code or credit card number. This string must have a length of 1. If not

6972

# supplied, this value defaults to `*` for strings, and `0` for digits.

6973

},

6974

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

6975

# Bucketing transformation can provide all of this functionality,

6976

# but requires more configuration. This message is provided as a convenience to

6977

# the user for simple bucketing strategies.

6978

#

6979

# The transformed value will be a hyphenated string of

6980

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

6981

# all values that are within this bucket will be replaced with "10-20".

6982

#

6983

# This can be used on data of type: double, long.

6984

#

6985

# If the bound Value type differs from the type of data

6986

# being transformed, we will first attempt converting the type of the data to

6987

# be transformed to match the type of the bound before comparing.

6988

#

6989

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

6990

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

6991

# grouped together into a single bucket; for example if `lower_bound` = 10,

6992

# then all values less than 10 are replaced with the value "-10".

6993

# Note that for the purposes of inspection or transformation, the number

6994

# of bytes considered to comprise a 'Value' is based on its representation

6995

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6996

# 123456789, the number of bytes would be counted as 9, even though an

6997

# int64 only holds up to 8 bytes of data.

6998

"booleanValue": True or False, # boolean

6999

"floatValue": 3.14, # float

7000

"dayOfWeekValue": "A String", # day of week

7001

"timestampValue": "A String", # timestamp

7002

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7003

# and time zone are either specified elsewhere or are not significant. The date

7004

# is relative to the Proleptic Gregorian Calendar. This can represent:

7005

#

7006

# * A full date, with non-zero year, month and day values

7007

# * A month and day value, with a zero year, e.g. an anniversary

7008

# * A year on its own, with zero month and day values

7009

# * A year and month value, with a zero day, e.g. a credit card expiration date

7010

#

7011

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7012

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7013

# a year.

7014

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7015

# month and day.

7016

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7017

# if specifying a year by itself or a year and month where the day is not

7018

# significant.

7019

},

7020

"stringValue": "A String", # string

7021

"integerValue": "A String", # integer

7022

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7023

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7024

# types are google.type.Date and `google.protobuf.Timestamp`.

7025

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7026

# allow the value 60 if it allows leap-seconds.

7027

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7028

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7029

# to allow the value "24:00:00" for scenarios like business closing time.

7030

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7031

},

7032

},

7033

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

7034

# grouped together into a single bucket; for example if `upper_bound` = 89,

7035

# then all values greater than 89 are replaced with the value "89+".

7036

# Note that for the purposes of inspection or transformation, the number

7037

# of bytes considered to comprise a 'Value' is based on its representation

7038

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7039

# 123456789, the number of bytes would be counted as 9, even though an

7040

# int64 only holds up to 8 bytes of data.

7041

"booleanValue": True or False, # boolean

7042

"floatValue": 3.14, # float

7043

"dayOfWeekValue": "A String", # day of week

7044

"timestampValue": "A String", # timestamp

7045

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7046

# and time zone are either specified elsewhere or are not significant. The date

7047

# is relative to the Proleptic Gregorian Calendar. This can represent:

7048

#

7049

# * A full date, with non-zero year, month and day values

7050

# * A month and day value, with a zero year, e.g. an anniversary

7051

# * A year on its own, with zero month and day values

7052

# * A year and month value, with a zero day, e.g. a credit card expiration date

7053

#

7054

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7055

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7056

# a year.

7057

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7058

# month and day.

7059

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7060

# if specifying a year by itself or a year and month where the day is not

7061

# significant.

7062

},

7063

"stringValue": "A String", # string

7064

"integerValue": "A String", # integer

7065

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7066

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7067

# types are google.type.Date and `google.protobuf.Timestamp`.

7068

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7069

# allow the value 60 if it allows leap-seconds.

7070

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7071

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7072

# to allow the value "24:00:00" for scenarios like business closing time.

7073

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7074

},

7075

},

7076

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

7077

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

7078

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

7079

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7080

},

7081

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7082

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

7083

# given `RecordCondition`. The conditions are allowed to reference fields

7084

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

7089

# column for the same record is within a specific range.

7090

# - Redact a field if the date of birth field is greater than 85.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7091

# a field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7092

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

7093

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

7094

# only supported value is `AND`.

7095

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

7096

"conditions": [ # A collection of conditions.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7097

{ # The field type of `value` and `field` do not need to match to be

7098

# considered equal, but not all comparisons are possible.

7099

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

7100

# but all other comparisons are invalid with incompatible types.

7101

# A `value` of type:

7102

#

7103

# - `string` can be compared against all other types

7104

# - `boolean` can only be compared against other booleans

7105

# - `integer` can be compared against doubles or a string if the string value

7106

# can be parsed as an integer.

7107

# - `double` can be compared against integers or a string if the string can

7108

# be parsed as a double.

7109

# - `Timestamp` can be compared against strings in RFC 3339 date string

7110

# format.

7111

# - `TimeOfDay` can be compared against timestamps and strings in the format

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7112

# of 'HH:mm:ss'.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7113

#

7114

# If we fail to compare do to type mismatch, a warning will be given and

7115

# the condition will evaluate to false.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7116

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

7117

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7118

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7119

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

7120

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7121

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7122

# of bytes considered to comprise a 'Value' is based on its representation

7123

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7124

# 123456789, the number of bytes would be counted as 9, even though an

7125

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7126

"booleanValue": True or False, # boolean

7127

"floatValue": 3.14, # float

7128

"dayOfWeekValue": "A String", # day of week

7129

"timestampValue": "A String", # timestamp

7130

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7131

# and time zone are either specified elsewhere or are not significant. The date

7132

# is relative to the Proleptic Gregorian Calendar. This can represent:

7133

#

7134

# * A full date, with non-zero year, month and day values

7135

# * A month and day value, with a zero year, e.g. an anniversary

7136

# * A year on its own, with zero month and day values

7137

# * A year and month value, with a zero day, e.g. a credit card expiration date

7138

#

7139

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7140

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7141

# a year.

7142

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7143

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7144

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7145

# if specifying a year by itself or a year and month where the day is not

7146

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7147

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7148

"stringValue": "A String", # string

7149

"integerValue": "A String", # integer

7150

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7151

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7152

# types are google.type.Date and `google.protobuf.Timestamp`.

7153

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7154

# allow the value 60 if it allows leap-seconds.

7155

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7156

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7157

# to allow the value "24:00:00" for scenarios like business closing time.

7158

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7159

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7164

},

7165

},

7166

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7167

],

7168

},

7169

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text

7170

# transformation everywhere.

7171

# apply various `PrimitiveTransformation`s to each finding, where the

7172

# transformation is applied to only values that were identified as a specific

7173

# info_type.

7174

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

7175

# for a given infoType.

7176

{ # A transformation to apply to text that is identified as a specific

7177

# info_type.

7178

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

7179

# this transformation to apply to all findings that correspond to

7180

# infoTypes that were requested in `InspectConfig`.

7181

{ # Type of information detected by the API.

7182

"name": "A String", # Name of the information type. Either a name of your choosing when

7183

# creating a CustomInfoType, or one of the names listed

7184

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

7185

# a built-in type. InfoType names should conform to the pattern

7186

# `[a-zA-Z0-9_]{1,64}`.

7187

},

7188

],

7189

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

7190

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

7191

# portion of the value.

7192

"partToExtract": "A String", # The part of the time to keep.

7193

},

7194

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

7195

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

7196

# to learn more.

7197

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

7198

# If set, must also set cryptoKey. If set, shift will be consistent for the

7199

# given context.

7200

"name": "A String", # Name describing the field.

7201

},

7202

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

7203

# range (inclusive ends). Negative means shift to earlier in time. Must not

7204

# be more than 365250 days (1000 years) each direction.

7205

#

7206

# For example, 3 means shift date to at most 3 days into the future.

7207

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

7208

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

7209

# results in the same shift for the same context and crypto_key. If

7210

# set, must also set context. Can only be applied to table items.

7211

# a key encryption key (KEK) stored by KMS).

7212

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7213

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7214

# unwrap the data crypto key.

7215

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7216

# The wrapped key must be a 128/192/256 bit key.

7217

# Authorization requires the following IAM permissions when sending a request

7218

# to perform a crypto transformation using a kms-wrapped crypto key:

7219

# dlp.kms.encrypt

7220

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7221

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7222

},

7223

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7224

# leaking the key. Choose another type of key if possible.

7225

"key": "A String", # Required. A 128/192/256 bit key.

7226

},

7227

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7228

# It will be discarded after the request finishes.

7229

"name": "A String", # Required. Name of the key.

7230

# This is an arbitrary string used to differentiate different keys.

7231

# A unique key is generated per name: two separate `TransientCryptoKey`

7232

# protos share the same generated key if their names are the same.

7233

# When the data crypto key is generated, this name is not used in any way

7234

# (repeating the api call will result in a different key being generated).

},

},

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

7239

},

7240

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

7241

# Uses SHA-256.

7242

# The key size must be either 32 or 64 bytes.

7243

# Outputs a base64 encoded representation of the hashed output

7244

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

7245

# Currently, only string and integer values can be hashed.

7246

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

7247

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

7248

# a key encryption key (KEK) stored by KMS).

7249

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7250

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7251

# unwrap the data crypto key.

7252

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7253

# The wrapped key must be a 128/192/256 bit key.

7254

# Authorization requires the following IAM permissions when sending a request

7255

# to perform a crypto transformation using a kms-wrapped crypto key:

7256

# dlp.kms.encrypt

7257

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7258

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7259

},

7260

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7261

# leaking the key. Choose another type of key if possible.

7262

"key": "A String", # Required. A 128/192/256 bit key.

7263

},

7264

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7265

# It will be discarded after the request finishes.

7266

"name": "A String", # Required. Name of the key.

7267

# This is an arbitrary string used to differentiate different keys.

7268

# A unique key is generated per name: two separate `TransientCryptoKey`

7269

# protos share the same generated key if their names are the same.

7270

# When the data crypto key is generated, this name is not used in any way

7271

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

7276

# (FPE) with the FFX mode of operation; however when used in the

7277

# `ReidentifyContent` API method, it serves the opposite function by reversing

7278

# the surrogate back into the original identifier. The identifier must be

7279

# encoded as ASCII. For a given crypto key and context, the same identifier

7280

# will be replaced with the same surrogate. Identifiers must be at least two

7281

# characters long. In the case that the identifier is the empty string, it will

7282

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

7283

# more.

7284

#

7285

# Note: We recommend using CryptoDeterministicConfig for all use cases which

7286

# do not require preserving the input alphabet space and size, plus warrant

7287

# referential integrity.

7288

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

7289

# that the FFX mode natively supports. This happens before/after

7290

# encryption/decryption.

7291

# Each character listed must appear only once.

7292

# Number of characters must be in the range [2, 95].

7293

# This must be encoded as ASCII.

7294

# The order of characters does not matter.

7295

"commonAlphabet": "A String", # Common alphabets.

7296

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

7297

# This annotation will be applied to the surrogate by prefixing it with

7298

# the name of the custom infoType followed by the number of

7299

# characters comprising the surrogate. The following scheme defines the

7300

# format: info_type_name(surrogate_character_count):surrogate

7301

#

7302

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

7303

# the surrogate is 'abc', the full replacement value

7304

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

7305

#

7306

# This annotation identifies the surrogate when inspecting content using the

7307

# custom infoType

7308

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

7309

# This facilitates reversal of the surrogate when it occurs in free text.

7310

#

7311

# In order for inspection to work properly, the name of this infoType must

7312

# not occur naturally anywhere in your data; otherwise, inspection may

7313

# find a surrogate that does not correspond to an actual identifier.

7314

# Therefore, choose your custom infoType name carefully after considering

7315

# what your data looks like. One way to select a name that has a high chance

7316

# of yielding reliable detection is to include one or more unicode characters

7317

# that are highly improbable to exist in your data.

7318

# For example, assuming your data is entered from a regular ASCII keyboard,

7319

# the symbol with the hex code point 29DD might be used like so:

7320

# ⧝MY_TOKEN_TYPE

7321

"name": "A String", # Name of the information type. Either a name of your choosing when

7322

# creating a CustomInfoType, or one of the names listed

7323

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

7324

# a built-in type. InfoType names should conform to the pattern

7325

# `[a-zA-Z0-9_]{1,64}`.

7326

},

7327

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

7328

# identifier in two different contexts won't be given the same surrogate. If

7329

# the context is not set, a default tweak will be used.

7330

#

7331

# If the context is set but:

7332

#

7333

# 1. there is no record present when transforming a given value or

7334

# 1. the field is not present when transforming a given value,

7335

#

7336

# a default tweak will be used.

7337

#

7338

# Note that case (1) is expected when an `InfoTypeTransformation` is

7339

# applied to both structured and non-structured `ContentItem`s.

7340

# Currently, the referenced field may be of value type integer or string.

7341

#

7342

# The tweak is constructed as a sequence of bytes in big endian byte order

7343

# such that:

7344

#

7345

# - a 64 bit integer is encoded followed by a single byte of value 1

7346

# - a string is encoded in UTF-8 format followed by a single byte of value 2

7347

"name": "A String", # Name describing the field.

7348

},

7349

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

7350

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

7351

# a key encryption key (KEK) stored by KMS).

7352

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7353

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7354

# unwrap the data crypto key.

7355

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7356

# The wrapped key must be a 128/192/256 bit key.

7357

# Authorization requires the following IAM permissions when sending a request

7358

# to perform a crypto transformation using a kms-wrapped crypto key:

7359

# dlp.kms.encrypt

7360

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7361

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7362

},

7363

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7364

# leaking the key. Choose another type of key if possible.

7365

"key": "A String", # Required. A 128/192/256 bit key.

7366

},

7367

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7368

# It will be discarded after the request finishes.

7369

"name": "A String", # Required. Name of the key.

7370

# This is an arbitrary string used to differentiate different keys.

7371

# A unique key is generated per name: two separate `TransientCryptoKey`

7372

# protos share the same generated key if their names are the same.

7373

# When the data crypto key is generated, this name is not used in any way

7374

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

7379

# input. Outputs a base64 encoded representation of the encrypted output.

7380

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

7381

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

7382

# This annotation will be applied to the surrogate by prefixing it with

7383

# the name of the custom info type followed by the number of

7384

# characters comprising the surrogate. The following scheme defines the

7385

# format: {info type name}({surrogate character count}):{surrogate}

7386

#

7387

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

7388

# the surrogate is 'abc', the full replacement value

7389

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

7390

#

7391

# This annotation identifies the surrogate when inspecting content using the

7392

# custom info type 'Surrogate'. This facilitates reversal of the

7393

# surrogate when it occurs in free text.

7394

#

7395

# Note: For record transformations where the entire cell in a table is being

7396

# transformed, surrogates are not mandatory. Surrogates are used to denote

7397

# the location of the token and are necessary for re-identification in free

7398

# form text.

7399

#

7400

# In order for inspection to work properly, the name of this info type must

7401

# not occur naturally anywhere in your data; otherwise, inspection may either

7402

#

7403

# - reverse a surrogate that does not correspond to an actual identifier

7404

# - be unable to parse the surrogate and result in an error

7405

#

7406

# Therefore, choose your custom info type name carefully after considering

7407

# what your data looks like. One way to select a name that has a high chance

7408

# of yielding reliable detection is to include one or more unicode characters

7409

# that are highly improbable to exist in your data.

7410

# For example, assuming your data is entered from a regular ASCII keyboard,

7411

# the symbol with the hex code point 29DD might be used like so:

7412

# ⧝MY_TOKEN_TYPE.

7413

"name": "A String", # Name of the information type. Either a name of your choosing when

7414

# creating a CustomInfoType, or one of the names listed

7415

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

7416

# a built-in type. InfoType names should conform to the pattern

7417

# `[a-zA-Z0-9_]{1,64}`.

7418

},

7419

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

7420

# referential integrity such that the same identifier in two different

7421

# contexts will be given a distinct surrogate. The context is appended to

7422

# plaintext value being encrypted. On decryption the provided context is

7423

# validated against the value used during encryption. If a context was

7424

# provided during encryption, same context must be provided during decryption

7425

# as well.

7426

#

7427

# If the context is not set, plaintext would be used as is for encryption.

7428

# If the context is set but:

7429

#

7430

# 1. there is no record present when transforming a given value or

7431

# 2. the field is not present when transforming a given value,

7432

#

7433

# plaintext would be used as is for encryption.

7434

#

7435

# Note that case (1) is expected when an `InfoTypeTransformation` is

7436

# applied to both structured and non-structured `ContentItem`s.

7437

"name": "A String", # Name describing the field.

7438

},

7439

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

7440

# a key encryption key (KEK) stored by KMS).

7441

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7442

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7443

# unwrap the data crypto key.

7444

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7445

# The wrapped key must be a 128/192/256 bit key.

7446

# Authorization requires the following IAM permissions when sending a request

7447

# to perform a crypto transformation using a kms-wrapped crypto key:

7448

# dlp.kms.encrypt

7449

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7450

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7451

},

7452

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7453

# leaking the key. Choose another type of key if possible.

7454

"key": "A String", # Required. A 128/192/256 bit key.

7455

},

7456

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7457

# It will be discarded after the request finishes.

7458

"name": "A String", # Required. Name of the key.

7459

# This is an arbitrary string used to differentiate different keys.

7460

# A unique key is generated per name: two separate `TransientCryptoKey`

7461

# protos share the same generated key if their names are the same.

7462

# When the data crypto key is generated, this name is not used in any way

7463

# (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

7468

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

7469

# output would be 'My phone number is '.

7470

},

7471

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

7472

# replacement values are dynamically provided by the user for custom behavior,

7473

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

7474

# This can be used on

7475

# data of type: number, long, string, timestamp.

7476

# If the bound `Value` type differs from the type of data being transformed, we

7477

# will first attempt converting the type of the data to be transformed to match

7478

# the type of the bound before comparing.

7479

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

7480

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

7481

{ # Bucket is represented as a range, along with replacement values.

7482

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

7483

# used.

7484

# Note that for the purposes of inspection or transformation, the number

7485

# of bytes considered to comprise a 'Value' is based on its representation

7486

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7487

# 123456789, the number of bytes would be counted as 9, even though an

7488

# int64 only holds up to 8 bytes of data.

7489

"booleanValue": True or False, # boolean

7490

"floatValue": 3.14, # float

7491

"dayOfWeekValue": "A String", # day of week

7492

"timestampValue": "A String", # timestamp

7493

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7494

# and time zone are either specified elsewhere or are not significant. The date

7495

# is relative to the Proleptic Gregorian Calendar. This can represent:

7496

#

7497

# * A full date, with non-zero year, month and day values

7498

# * A month and day value, with a zero year, e.g. an anniversary

7499

# * A year on its own, with zero month and day values

7500

# * A year and month value, with a zero day, e.g. a credit card expiration date

7501

#

7502

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7503

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7504

# a year.

7505

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7506

# month and day.

7507

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7508

# if specifying a year by itself or a year and month where the day is not

7509

# significant.

7510

},

7511

"stringValue": "A String", # string

7512

"integerValue": "A String", # integer

7513

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7514

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7515

# types are google.type.Date and `google.protobuf.Timestamp`.

7516

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7517

# allow the value 60 if it allows leap-seconds.

7518

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7519

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7520

# to allow the value "24:00:00" for scenarios like business closing time.

7521

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7522

},

7523

},

7524

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

7525

# Note that for the purposes of inspection or transformation, the number

7526

# of bytes considered to comprise a 'Value' is based on its representation

7527

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7528

# 123456789, the number of bytes would be counted as 9, even though an

7529

# int64 only holds up to 8 bytes of data.

7530

"booleanValue": True or False, # boolean

7531

"floatValue": 3.14, # float

7532

"dayOfWeekValue": "A String", # day of week

7533

"timestampValue": "A String", # timestamp

7534

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7535

# and time zone are either specified elsewhere or are not significant. The date

7536

# is relative to the Proleptic Gregorian Calendar. This can represent:

7537

#

7538

# * A full date, with non-zero year, month and day values

7539

# * A month and day value, with a zero year, e.g. an anniversary

7540

# * A year on its own, with zero month and day values

7541

# * A year and month value, with a zero day, e.g. a credit card expiration date

7542

#

7543

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7544

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7545

# a year.

7546

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7547

# month and day.

7548

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7549

# if specifying a year by itself or a year and month where the day is not

7550

# significant.

7551

},

7552

"stringValue": "A String", # string

7553

"integerValue": "A String", # integer

7554

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7555

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7556

# types are google.type.Date and `google.protobuf.Timestamp`.

7557

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7558

# allow the value 60 if it allows leap-seconds.

7559

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7560

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7561

# to allow the value "24:00:00" for scenarios like business closing time.

7562

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7563

},

7564

},

7565

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

7566

# the default behavior will be to hyphenate the min-max range.

7567

# Note that for the purposes of inspection or transformation, the number

7568

# of bytes considered to comprise a 'Value' is based on its representation

7569

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7570

# 123456789, the number of bytes would be counted as 9, even though an

7571

# int64 only holds up to 8 bytes of data.

7572

"booleanValue": True or False, # boolean

7573

"floatValue": 3.14, # float

7574

"dayOfWeekValue": "A String", # day of week

7575

"timestampValue": "A String", # timestamp

7576

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7577

# and time zone are either specified elsewhere or are not significant. The date

7578

# is relative to the Proleptic Gregorian Calendar. This can represent:

7579

#

7580

# * A full date, with non-zero year, month and day values

7581

# * A month and day value, with a zero year, e.g. an anniversary

7582

# * A year on its own, with zero month and day values

7583

# * A year and month value, with a zero day, e.g. a credit card expiration date

7584

#

7585

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7586

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7587

# a year.

7588

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7589

# month and day.

7590

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7591

# if specifying a year by itself or a year and month where the day is not

7592

# significant.

7593

},

7594

"stringValue": "A String", # string

7595

"integerValue": "A String", # integer

7596

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7597

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7598

# types are google.type.Date and `google.protobuf.Timestamp`.

7599

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7600

# allow the value 60 if it allows leap-seconds.

7601

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7602

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7603

# to allow the value "24:00:00" for scenarios like business closing time.

7604

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

],

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

7611

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

7612

# Note that for the purposes of inspection or transformation, the number

7613

# of bytes considered to comprise a 'Value' is based on its representation

7614

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7615

# 123456789, the number of bytes would be counted as 9, even though an

7616

# int64 only holds up to 8 bytes of data.

7617

"booleanValue": True or False, # boolean

7618

"floatValue": 3.14, # float

7619

"dayOfWeekValue": "A String", # day of week

7620

"timestampValue": "A String", # timestamp

7621

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7622

# and time zone are either specified elsewhere or are not significant. The date

7623

# is relative to the Proleptic Gregorian Calendar. This can represent:

7624

#

7625

# * A full date, with non-zero year, month and day values

7626

# * A month and day value, with a zero year, e.g. an anniversary

7627

# * A year on its own, with zero month and day values

7628

# * A year and month value, with a zero day, e.g. a credit card expiration date

7629

#

7630

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7631

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7632

# a year.

7633

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7634

# month and day.

7635

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7636

# if specifying a year by itself or a year and month where the day is not

7637

# significant.

7638

},

7639

"stringValue": "A String", # string

7640

"integerValue": "A String", # integer

7641

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7642

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7643

# types are google.type.Date and `google.protobuf.Timestamp`.

7644

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7645

# allow the value 60 if it allows leap-seconds.

7646

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7647

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7648

# to allow the value "24:00:00" for scenarios like business closing time.

7649

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

7654

# fixed character. Masking can start from the beginning or end of the string.

7655

# This can be used on data of any type (numbers, longs, and so on) and when

7656

# de-identifying structured data we'll attempt to preserve the original data's

7657

# type. (This allows you to take a long like 123 and modify it to a string like

7658

# **3.

7659

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

7660

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

7661

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

7662

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

7663

# is `true`, then the string `12345` is masked as `12***`.

7664

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

7665

# characters. For example, if the input string is `555-555-5555` and you

7666

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

7667

# returns `***-**5-5555`.

7668

{ # Characters to skip when doing deidentification of a value. These will be left

7669

# alone and skipped.

7670

"charactersToSkip": "A String", # Characters to not transform when masking.

7671

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

7676

# masked. Skipped characters do not count towards this tally.

7677

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

7678

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

7679

# code or credit card number. This string must have a length of 1. If not

7680

# supplied, this value defaults to `*` for strings, and `0` for digits.

7681

},

7682

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

7683

# Bucketing transformation can provide all of this functionality,

7684

# but requires more configuration. This message is provided as a convenience to

7685

# the user for simple bucketing strategies.

7686

#

7687

# The transformed value will be a hyphenated string of

7688

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

7689

# all values that are within this bucket will be replaced with "10-20".

7690

#

7691

# This can be used on data of type: double, long.

7692

#

7693

# If the bound Value type differs from the type of data

7694

# being transformed, we will first attempt converting the type of the data to

7695

# be transformed to match the type of the bound before comparing.

7696

#

7697

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

7698

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

7699

# grouped together into a single bucket; for example if `lower_bound` = 10,

7700

# then all values less than 10 are replaced with the value "-10".

7701

# Note that for the purposes of inspection or transformation, the number

7702

# of bytes considered to comprise a 'Value' is based on its representation

7703

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7704

# 123456789, the number of bytes would be counted as 9, even though an

7705

# int64 only holds up to 8 bytes of data.

7706

"booleanValue": True or False, # boolean

7707

"floatValue": 3.14, # float

7708

"dayOfWeekValue": "A String", # day of week

7709

"timestampValue": "A String", # timestamp

7710

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7711

# and time zone are either specified elsewhere or are not significant. The date

7712

# is relative to the Proleptic Gregorian Calendar. This can represent:

7713

#

7714

# * A full date, with non-zero year, month and day values

7715

# * A month and day value, with a zero year, e.g. an anniversary

7716

# * A year on its own, with zero month and day values

7717

# * A year and month value, with a zero day, e.g. a credit card expiration date

7718

#

7719

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7720

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7721

# a year.

7722

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7723

# month and day.

7724

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7725

# if specifying a year by itself or a year and month where the day is not

7726

# significant.

7727

},

7728

"stringValue": "A String", # string

7729

"integerValue": "A String", # integer

7730

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7731

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7732

# types are google.type.Date and `google.protobuf.Timestamp`.

7733

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7734

# allow the value 60 if it allows leap-seconds.

7735

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7736

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7737

# to allow the value "24:00:00" for scenarios like business closing time.

7738

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7739

},

7740

},

7741

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

7742

# grouped together into a single bucket; for example if `upper_bound` = 89,

7743

# then all values greater than 89 are replaced with the value "89+".

7744

# Note that for the purposes of inspection or transformation, the number

7745

# of bytes considered to comprise a 'Value' is based on its representation

7746

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7747

# 123456789, the number of bytes would be counted as 9, even though an

7748

# int64 only holds up to 8 bytes of data.

7749

"booleanValue": True or False, # boolean

7750

"floatValue": 3.14, # float

7751

"dayOfWeekValue": "A String", # day of week

7752

"timestampValue": "A String", # timestamp

7753

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7754

# and time zone are either specified elsewhere or are not significant. The date

7755

# is relative to the Proleptic Gregorian Calendar. This can represent:

7756

#

7757

# * A full date, with non-zero year, month and day values

7758

# * A month and day value, with a zero year, e.g. an anniversary

7759

# * A year on its own, with zero month and day values

7760

# * A year and month value, with a zero day, e.g. a credit card expiration date

7761

#

7762

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7763

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7764

# a year.

7765

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7766

# month and day.

7767

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7768

# if specifying a year by itself or a year and month where the day is not

7769

# significant.

7770

},

7771

"stringValue": "A String", # string

7772

"integerValue": "A String", # integer

7773

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7774

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7775

# types are google.type.Date and `google.protobuf.Timestamp`.

7776

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7777

# allow the value 60 if it allows leap-seconds.

7778

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7779

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7780

# to allow the value "24:00:00" for scenarios like business closing time.

7781

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7782

},

7783

},

7784

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

7785

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

7786

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

7787

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

7788

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7789

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7790

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

],

},

},

}

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

7803

7804

{ # Results of re-identifying a item.

7805

"overview": { # Overview of the modifications that occurred. # An overview of the changes that were made to the `item`.

7806

"transformationSummaries": [ # Transformations applied to the dataset.

7807

{ # Summary of a single transformation.

7808

# Only one of 'transformation', 'field_transformation', or 'record_suppress'

7809

# will be set.

7810

"fieldTransformations": [ # The field transformation that was applied.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

7811

# If multiple field transformations are requested for a single field,

7812

# this list will contain all of them; otherwise, only one is supplied.

7813

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7814

"fields": [ # Required. Input field(s) to apply the transformation to.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7815

{ # General identifier of a data field in a storage service.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7816

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7817

},

7818

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7819

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7820

# transform content that matches an `InfoType`.

7821

# apply various `PrimitiveTransformation`s to each finding, where the

7822

# transformation is applied to only values that were identified as a specific

7823

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7824

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7825

# for a given infoType.

7826

{ # A transformation to apply to text that is identified as a specific

7827

# info_type.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7828

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

7829

# this transformation to apply to all findings that correspond to

7830

# infoTypes that were requested in `InspectConfig`.

7831

{ # Type of information detected by the API.

7832

"name": "A String", # Name of the information type. Either a name of your choosing when

7833

# creating a CustomInfoType, or one of the names listed

7834

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

7835

# a built-in type. InfoType names should conform to the pattern

7836

# `[a-zA-Z0-9_]{1,64}`.

7837

},

7838

],

7839

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

7840

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

7841

# portion of the value.

7842

"partToExtract": "A String", # The part of the time to keep.

7843

},

7844

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

7845

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

7846

# to learn more.

7847

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

7848

# If set, must also set cryptoKey. If set, shift will be consistent for the

7849

# given context.

7850

"name": "A String", # Name describing the field.

7851

},

7852

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

7853

# range (inclusive ends). Negative means shift to earlier in time. Must not

7854

# be more than 365250 days (1000 years) each direction.

7855

#

7856

# For example, 3 means shift date to at most 3 days into the future.

7857

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

7858

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

7859

# results in the same shift for the same context and crypto_key. If

7860

# set, must also set context. Can only be applied to table items.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7861

# a key encryption key (KEK) stored by KMS).

7862

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7863

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7864

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7865

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7866

# The wrapped key must be a 128/192/256 bit key.

7867

# Authorization requires the following IAM permissions when sending a request

7868

# to perform a crypto transformation using a kms-wrapped crypto key:

7869

# dlp.kms.encrypt

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7870

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7871

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7872

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7873

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7874

# leaking the key. Choose another type of key if possible.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7875

"key": "A String", # Required. A 128/192/256 bit key.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7876

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7877

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7878

# It will be discarded after the request finishes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7879

"name": "A String", # Required. Name of the key.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7880

# This is an arbitrary string used to differentiate different keys.

7881

# A unique key is generated per name: two separate `TransientCryptoKey`

7882

# protos share the same generated key if their names are the same.

7883

# When the data crypto key is generated, this name is not used in any way

7884

# (repeating the api call will result in a different key being generated).

7885

},

7886

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7887

},

7888

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

7889

},

7890

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

7891

# Uses SHA-256.

7892

# The key size must be either 32 or 64 bytes.

7893

# Outputs a base64 encoded representation of the hashed output

7894

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

7895

# Currently, only string and integer values can be hashed.

7896

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

7897

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

7898

# a key encryption key (KEK) stored by KMS).

7899

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7900

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7901

# unwrap the data crypto key.

7902

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7903

# The wrapped key must be a 128/192/256 bit key.

7904

# Authorization requires the following IAM permissions when sending a request

7905

# to perform a crypto transformation using a kms-wrapped crypto key:

7906

# dlp.kms.encrypt

7907

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7908

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7909

},

7910

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7911

# leaking the key. Choose another type of key if possible.

7912

"key": "A String", # Required. A 128/192/256 bit key.

7913

},

7914

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7915

# It will be discarded after the request finishes.

7916

"name": "A String", # Required. Name of the key.

7917

# This is an arbitrary string used to differentiate different keys.

7918

# A unique key is generated per name: two separate `TransientCryptoKey`

7919

# protos share the same generated key if their names are the same.

7920

# When the data crypto key is generated, this name is not used in any way

7921

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

7926

# (FPE) with the FFX mode of operation; however when used in the

7927

# `ReidentifyContent` API method, it serves the opposite function by reversing

7928

# the surrogate back into the original identifier. The identifier must be

7929

# encoded as ASCII. For a given crypto key and context, the same identifier

7930

# will be replaced with the same surrogate. Identifiers must be at least two

7931

# characters long. In the case that the identifier is the empty string, it will

7932

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

7933

# more.

7934

#

7935

# Note: We recommend using CryptoDeterministicConfig for all use cases which

7936

# do not require preserving the input alphabet space and size, plus warrant

7937

# referential integrity.

7938

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

7939

# that the FFX mode natively supports. This happens before/after

7940

# encryption/decryption.

7941

# Each character listed must appear only once.

7942

# Number of characters must be in the range [2, 95].

7943

# This must be encoded as ASCII.

7944

# The order of characters does not matter.

7945

"commonAlphabet": "A String", # Common alphabets.

7946

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

7947

# This annotation will be applied to the surrogate by prefixing it with

7948

# the name of the custom infoType followed by the number of

7949

# characters comprising the surrogate. The following scheme defines the

7950

# format: info_type_name(surrogate_character_count):surrogate

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7951

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7952

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

7953

# the surrogate is 'abc', the full replacement value

7954

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

7955

#

7956

# This annotation identifies the surrogate when inspecting content using the

7957

# custom infoType

7958

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

7959

# This facilitates reversal of the surrogate when it occurs in free text.

7960

#

7961

# In order for inspection to work properly, the name of this infoType must

7962

# not occur naturally anywhere in your data; otherwise, inspection may

7963

# find a surrogate that does not correspond to an actual identifier.

7964

# Therefore, choose your custom infoType name carefully after considering

7965

# what your data looks like. One way to select a name that has a high chance

7966

# of yielding reliable detection is to include one or more unicode characters

7967

# that are highly improbable to exist in your data.

7968

# For example, assuming your data is entered from a regular ASCII keyboard,

7969

# the symbol with the hex code point 29DD might be used like so:

7970

# ⧝MY_TOKEN_TYPE

7971

"name": "A String", # Name of the information type. Either a name of your choosing when

7972

# creating a CustomInfoType, or one of the names listed

7973

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

7974

# a built-in type. InfoType names should conform to the pattern

7975

# `[a-zA-Z0-9_]{1,64}`.

7976

},

7977

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

7978

# identifier in two different contexts won't be given the same surrogate. If

7979

# the context is not set, a default tweak will be used.

7980

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7981

# If the context is set but:

7982

#

7983

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7984

# 1. the field is not present when transforming a given value,

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7985

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7986

# a default tweak will be used.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7987

#

7988

# Note that case (1) is expected when an `InfoTypeTransformation` is

7989

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7990

# Currently, the referenced field may be of value type integer or string.

7991

#

7992

# The tweak is constructed as a sequence of bytes in big endian byte order

7993

# such that:

7994

#

7995

# - a 64 bit integer is encoded followed by a single byte of value 1

7996

# - a string is encoded in UTF-8 format followed by a single byte of value 2

7997

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

7998

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7999

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

8000

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

8001

# a key encryption key (KEK) stored by KMS).

8002

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8003

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8004

# unwrap the data crypto key.

8005

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8006

# The wrapped key must be a 128/192/256 bit key.

8007

# Authorization requires the following IAM permissions when sending a request

8008

# to perform a crypto transformation using a kms-wrapped crypto key:

8009

# dlp.kms.encrypt

8010

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8011

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8012

},

8013

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8014

# leaking the key. Choose another type of key if possible.

8015

"key": "A String", # Required. A 128/192/256 bit key.

8016

},

8017

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8018

# It will be discarded after the request finishes.

8019

"name": "A String", # Required. Name of the key.

8020

# This is an arbitrary string used to differentiate different keys.

8021

# A unique key is generated per name: two separate `TransientCryptoKey`

8022

# protos share the same generated key if their names are the same.

8023

# When the data crypto key is generated, this name is not used in any way

8024

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

8029

# input. Outputs a base64 encoded representation of the encrypted output.

8030

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

8031

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8032

# This annotation will be applied to the surrogate by prefixing it with

8033

# the name of the custom info type followed by the number of

8034

# characters comprising the surrogate. The following scheme defines the

8035

# format: {info type name}({surrogate character count}):{surrogate}

8036

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8037

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

8038

# the surrogate is 'abc', the full replacement value

8039

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8040

#

8041

# This annotation identifies the surrogate when inspecting content using the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8042

# custom info type 'Surrogate'. This facilitates reversal of the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8043

# surrogate when it occurs in free text.

8044

#

8045

# Note: For record transformations where the entire cell in a table is being

8046

# transformed, surrogates are not mandatory. Surrogates are used to denote

8047

# the location of the token and are necessary for re-identification in free

8048

# form text.

8049

#

8050

# In order for inspection to work properly, the name of this info type must

8051

# not occur naturally anywhere in your data; otherwise, inspection may either

8052

#

8053

# - reverse a surrogate that does not correspond to an actual identifier

8054

# - be unable to parse the surrogate and result in an error

8055

#

8056

# Therefore, choose your custom info type name carefully after considering

8057

# what your data looks like. One way to select a name that has a high chance

8058

# of yielding reliable detection is to include one or more unicode characters

8059

# that are highly improbable to exist in your data.

8060

# For example, assuming your data is entered from a regular ASCII keyboard,

8061

# the symbol with the hex code point 29DD might be used like so:

8062

# ⧝MY_TOKEN_TYPE.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8063

"name": "A String", # Name of the information type. Either a name of your choosing when

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8064

# creating a CustomInfoType, or one of the names listed

8065

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

8066

# a built-in type. InfoType names should conform to the pattern

8067

# `[a-zA-Z0-9_]{1,64}`.

8068

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8069

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

8070

# referential integrity such that the same identifier in two different

8071

# contexts will be given a distinct surrogate. The context is appended to

8072

# plaintext value being encrypted. On decryption the provided context is

8073

# validated against the value used during encryption. If a context was

8074

# provided during encryption, same context must be provided during decryption

8075

# as well.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8076

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8077

# If the context is not set, plaintext would be used as is for encryption.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8078

# If the context is set but:

8079

#

8080

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8081

# 2. the field is not present when transforming a given value,

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8082

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8083

# plaintext would be used as is for encryption.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8084

#

8085

# Note that case (1) is expected when an `InfoTypeTransformation` is

8086

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8087

"name": "A String", # Name describing the field.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8088

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8089

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

8090

# a key encryption key (KEK) stored by KMS).

8091

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8092

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8093

# unwrap the data crypto key.

8094

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8095

# The wrapped key must be a 128/192/256 bit key.

8096

# Authorization requires the following IAM permissions when sending a request

8097

# to perform a crypto transformation using a kms-wrapped crypto key:

8098

# dlp.kms.encrypt

8099

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8100

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8101

},

8102

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8103

# leaking the key. Choose another type of key if possible.

8104

"key": "A String", # Required. A 128/192/256 bit key.

8105

},

8106

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8107

# It will be discarded after the request finishes.

8108

"name": "A String", # Required. Name of the key.

8109

# This is an arbitrary string used to differentiate different keys.

8110

# A unique key is generated per name: two separate `TransientCryptoKey`

8111

# protos share the same generated key if their names are the same.

8112

# When the data crypto key is generated, this name is not used in any way

8113

# (repeating the api call will result in a different key being generated).

8114

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8115

},

8116

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8117

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

8118

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

8119

# output would be 'My phone number is '.

8120

},

8121

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8122

# replacement values are dynamically provided by the user for custom behavior,

8123

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

8124

# This can be used on

8125

# data of type: number, long, string, timestamp.

8126

# If the bound `Value` type differs from the type of data being transformed, we

8127

# will first attempt converting the type of the data to be transformed to match

8128

# the type of the bound before comparing.

8129

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8130

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8131

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8132

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8133

# used.

8134

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8135

# of bytes considered to comprise a 'Value' is based on its representation

8136

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8137

# 123456789, the number of bytes would be counted as 9, even though an

8138

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8139

"booleanValue": True or False, # boolean

8140

"floatValue": 3.14, # float

8141

"dayOfWeekValue": "A String", # day of week

8142

"timestampValue": "A String", # timestamp

8143

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8144

# and time zone are either specified elsewhere or are not significant. The date

8145

# is relative to the Proleptic Gregorian Calendar. This can represent:

8146

#

8147

# * A full date, with non-zero year, month and day values

8148

# * A month and day value, with a zero year, e.g. an anniversary

8149

# * A year on its own, with zero month and day values

8150

# * A year and month value, with a zero day, e.g. a credit card expiration date

8151

#

8152

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8153

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8154

# a year.

8155

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8156

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8157

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8158

# if specifying a year by itself or a year and month where the day is not

8159

# significant.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8160

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8161

"stringValue": "A String", # string

8162

"integerValue": "A String", # integer

8163

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8164

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8165

# types are google.type.Date and `google.protobuf.Timestamp`.

8166

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8167

# allow the value 60 if it allows leap-seconds.

8168

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8169

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8170

# to allow the value "24:00:00" for scenarios like business closing time.

8171

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8172

},

8173

},

8174

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

8175

# Note that for the purposes of inspection or transformation, the number

8176

# of bytes considered to comprise a 'Value' is based on its representation

8177

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8178

# 123456789, the number of bytes would be counted as 9, even though an

8179

# int64 only holds up to 8 bytes of data.

8180

"booleanValue": True or False, # boolean

8181

"floatValue": 3.14, # float

8182

"dayOfWeekValue": "A String", # day of week

8183

"timestampValue": "A String", # timestamp

8184

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8185

# and time zone are either specified elsewhere or are not significant. The date

8186

# is relative to the Proleptic Gregorian Calendar. This can represent:

8187

#

8188

# * A full date, with non-zero year, month and day values

8189

# * A month and day value, with a zero year, e.g. an anniversary

8190

# * A year on its own, with zero month and day values

8191

# * A year and month value, with a zero day, e.g. a credit card expiration date

8192

#

8193

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8194

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8195

# a year.

8196

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8197

# month and day.

8198

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8199

# if specifying a year by itself or a year and month where the day is not

8200

# significant.

8201

},

8202

"stringValue": "A String", # string

8203

"integerValue": "A String", # integer

8204

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8205

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8206

# types are google.type.Date and `google.protobuf.Timestamp`.

8207

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8208

# allow the value 60 if it allows leap-seconds.

8209

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8210

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8211

# to allow the value "24:00:00" for scenarios like business closing time.

8212

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8213

},

8214

},

8215

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

8216

# the default behavior will be to hyphenate the min-max range.

8217

# Note that for the purposes of inspection or transformation, the number

8218

# of bytes considered to comprise a 'Value' is based on its representation

8219

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8220

# 123456789, the number of bytes would be counted as 9, even though an

8221

# int64 only holds up to 8 bytes of data.

8222

"booleanValue": True or False, # boolean

8223

"floatValue": 3.14, # float

8224

"dayOfWeekValue": "A String", # day of week

8225

"timestampValue": "A String", # timestamp

8226

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8227

# and time zone are either specified elsewhere or are not significant. The date

8228

# is relative to the Proleptic Gregorian Calendar. This can represent:

8229

#

8230

# * A full date, with non-zero year, month and day values

8231

# * A month and day value, with a zero year, e.g. an anniversary

8232

# * A year on its own, with zero month and day values

8233

# * A year and month value, with a zero day, e.g. a credit card expiration date

8234

#

8235

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8236

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8237

# a year.

8238

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8239

# month and day.

8240

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8241

# if specifying a year by itself or a year and month where the day is not

8242

# significant.

8243

},

8244

"stringValue": "A String", # string

8245

"integerValue": "A String", # integer

8246

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8247

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8248

# types are google.type.Date and `google.protobuf.Timestamp`.

8249

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8250

# allow the value 60 if it allows leap-seconds.

8251

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8252

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8253

# to allow the value "24:00:00" for scenarios like business closing time.

8254

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8255

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8260

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

8261

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8262

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8263

# of bytes considered to comprise a 'Value' is based on its representation

8264

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8265

# 123456789, the number of bytes would be counted as 9, even though an

8266

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8267

"booleanValue": True or False, # boolean

8268

"floatValue": 3.14, # float

8269

"dayOfWeekValue": "A String", # day of week

8270

"timestampValue": "A String", # timestamp

8271

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8272

# and time zone are either specified elsewhere or are not significant. The date

8273

# is relative to the Proleptic Gregorian Calendar. This can represent:

8274

#

8275

# * A full date, with non-zero year, month and day values

8276

# * A month and day value, with a zero year, e.g. an anniversary

8277

# * A year on its own, with zero month and day values

8278

# * A year and month value, with a zero day, e.g. a credit card expiration date

8279

#

8280

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8281

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8282

# a year.

8283

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8284

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8285

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8286

# if specifying a year by itself or a year and month where the day is not

8287

# significant.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8288

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8289

"stringValue": "A String", # string

8290

"integerValue": "A String", # integer

8291

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8292

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8293

# types are google.type.Date and `google.protobuf.Timestamp`.

8294

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8295

# allow the value 60 if it allows leap-seconds.

8296

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8297

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8298

# to allow the value "24:00:00" for scenarios like business closing time.

8299

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8300

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8301

},

8302

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8303

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

8304

# fixed character. Masking can start from the beginning or end of the string.

8305

# This can be used on data of any type (numbers, longs, and so on) and when

8306

# de-identifying structured data we'll attempt to preserve the original data's

8307

# type. (This allows you to take a long like 123 and modify it to a string like

8308

# **3.

8309

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

8310

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

8311

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

8312

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

8313

# is `true`, then the string `12345` is masked as `12***`.

8314

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

8315

# characters. For example, if the input string is `555-555-5555` and you

8316

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

8317

# returns `***-**5-5555`.

8318

{ # Characters to skip when doing deidentification of a value. These will be left

8319

# alone and skipped.

8320

"charactersToSkip": "A String", # Characters to not transform when masking.

8321

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

8326

# masked. Skipped characters do not count towards this tally.

8327

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

8328

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

8329

# code or credit card number. This string must have a length of 1. If not

8330

# supplied, this value defaults to `*` for strings, and `0` for digits.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8331

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8332

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

8333

# Bucketing transformation can provide all of this functionality,

8334

# but requires more configuration. This message is provided as a convenience to

8335

# the user for simple bucketing strategies.

8336

#

8337

# The transformed value will be a hyphenated string of

8338

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

8339

# all values that are within this bucket will be replaced with "10-20".

8340

#

8341

# This can be used on data of type: double, long.

8342

#

8343

# If the bound Value type differs from the type of data

8344

# being transformed, we will first attempt converting the type of the data to

8345

# be transformed to match the type of the bound before comparing.

8346

#

8347

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

8348

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

8349

# grouped together into a single bucket; for example if `lower_bound` = 10,

8350

# then all values less than 10 are replaced with the value "-10".

8351

# Note that for the purposes of inspection or transformation, the number

8352

# of bytes considered to comprise a 'Value' is based on its representation

8353

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8354

# 123456789, the number of bytes would be counted as 9, even though an

8355

# int64 only holds up to 8 bytes of data.

8356

"booleanValue": True or False, # boolean

8357

"floatValue": 3.14, # float

8358

"dayOfWeekValue": "A String", # day of week

8359

"timestampValue": "A String", # timestamp

8360

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8361

# and time zone are either specified elsewhere or are not significant. The date

8362

# is relative to the Proleptic Gregorian Calendar. This can represent:

8363

#

8364

# * A full date, with non-zero year, month and day values

8365

# * A month and day value, with a zero year, e.g. an anniversary

8366

# * A year on its own, with zero month and day values

8367

# * A year and month value, with a zero day, e.g. a credit card expiration date

8368

#

8369

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8370

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8371

# a year.

8372

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8373

# month and day.

8374

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8375

# if specifying a year by itself or a year and month where the day is not

8376

# significant.

8377

},

8378

"stringValue": "A String", # string

8379

"integerValue": "A String", # integer

8380

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8381

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8382

# types are google.type.Date and `google.protobuf.Timestamp`.

8383

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8384

# allow the value 60 if it allows leap-seconds.

8385

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8386

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8387

# to allow the value "24:00:00" for scenarios like business closing time.

8388

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8389

},

8390

},

8391

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

8392

# grouped together into a single bucket; for example if `upper_bound` = 89,

8393

# then all values greater than 89 are replaced with the value "89+".

8394

# Note that for the purposes of inspection or transformation, the number

8395

# of bytes considered to comprise a 'Value' is based on its representation

8396

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8397

# 123456789, the number of bytes would be counted as 9, even though an

8398

# int64 only holds up to 8 bytes of data.

8399

"booleanValue": True or False, # boolean

8400

"floatValue": 3.14, # float

8401

"dayOfWeekValue": "A String", # day of week

8402

"timestampValue": "A String", # timestamp

8403

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8404

# and time zone are either specified elsewhere or are not significant. The date

8405

# is relative to the Proleptic Gregorian Calendar. This can represent:

8406

#

8407

# * A full date, with non-zero year, month and day values

8408

# * A month and day value, with a zero year, e.g. an anniversary

8409

# * A year on its own, with zero month and day values

8410

# * A year and month value, with a zero day, e.g. a credit card expiration date

8411

#

8412

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8413

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8414

# a year.

8415

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8416

# month and day.

8417

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8418

# if specifying a year by itself or a year and month where the day is not

8419

# significant.

8420

},

8421

"stringValue": "A String", # string

8422

"integerValue": "A String", # integer

8423

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8424

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8425

# types are google.type.Date and `google.protobuf.Timestamp`.

8426

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8427

# allow the value 60 if it allows leap-seconds.

8428

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8429

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8430

# to allow the value "24:00:00" for scenarios like business closing time.

8431

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8432

},

8433

},

8434

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

8435

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

8436

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

8437

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

8438

},

8439

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

8440

},

8441

],

8442

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8443

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

8444

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

8445

# portion of the value.

8446

"partToExtract": "A String", # The part of the time to keep.

8447

},

8448

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

8449

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

8450

# to learn more.

8451

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

8452

# If set, must also set cryptoKey. If set, shift will be consistent for the

8453

# given context.

8454

"name": "A String", # Name describing the field.

8455

},

8456

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

8457

# range (inclusive ends). Negative means shift to earlier in time. Must not

8458

# be more than 365250 days (1000 years) each direction.

8459

#

8460

# For example, 3 means shift date to at most 3 days into the future.

8461

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

8462

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

8463

# results in the same shift for the same context and crypto_key. If

8464

# set, must also set context. Can only be applied to table items.

8465

# a key encryption key (KEK) stored by KMS).

8466

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8467

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8468

# unwrap the data crypto key.

8469

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8470

# The wrapped key must be a 128/192/256 bit key.

8471

# Authorization requires the following IAM permissions when sending a request

8472

# to perform a crypto transformation using a kms-wrapped crypto key:

8473

# dlp.kms.encrypt

8474

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8475

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8476

},

8477

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8478

# leaking the key. Choose another type of key if possible.

8479

"key": "A String", # Required. A 128/192/256 bit key.

8480

},

8481

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8482

# It will be discarded after the request finishes.

8483

"name": "A String", # Required. Name of the key.

8484

# This is an arbitrary string used to differentiate different keys.

8485

# A unique key is generated per name: two separate `TransientCryptoKey`

8486

# protos share the same generated key if their names are the same.

8487

# When the data crypto key is generated, this name is not used in any way

8488

# (repeating the api call will result in a different key being generated).

},

},

},

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

8493

},

8494

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

8495

# Uses SHA-256.

8496

# The key size must be either 32 or 64 bytes.

8497

# Outputs a base64 encoded representation of the hashed output

8498

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

8499

# Currently, only string and integer values can be hashed.

8500

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

8501

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

8502

# a key encryption key (KEK) stored by KMS).

8503

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8504

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8505

# unwrap the data crypto key.

8506

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8507

# The wrapped key must be a 128/192/256 bit key.

8508

# Authorization requires the following IAM permissions when sending a request

8509

# to perform a crypto transformation using a kms-wrapped crypto key:

8510

# dlp.kms.encrypt

8511

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8512

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8513

},

8514

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8515

# leaking the key. Choose another type of key if possible.

8516

"key": "A String", # Required. A 128/192/256 bit key.

8517

},

8518

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8519

# It will be discarded after the request finishes.

8520

"name": "A String", # Required. Name of the key.

8521

# This is an arbitrary string used to differentiate different keys.

8522

# A unique key is generated per name: two separate `TransientCryptoKey`

8523

# protos share the same generated key if their names are the same.

8524

# When the data crypto key is generated, this name is not used in any way

8525

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

8530

# (FPE) with the FFX mode of operation; however when used in the

8531

# `ReidentifyContent` API method, it serves the opposite function by reversing

8532

# the surrogate back into the original identifier. The identifier must be

8533

# encoded as ASCII. For a given crypto key and context, the same identifier

8534

# will be replaced with the same surrogate. Identifiers must be at least two

8535

# characters long. In the case that the identifier is the empty string, it will

8536

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

8537

# more.

8538

#

8539

# Note: We recommend using CryptoDeterministicConfig for all use cases which

8540

# do not require preserving the input alphabet space and size, plus warrant

8541

# referential integrity.

8542

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

8543

# that the FFX mode natively supports. This happens before/after

8544

# encryption/decryption.

8545

# Each character listed must appear only once.

8546

# Number of characters must be in the range [2, 95].

8547

# This must be encoded as ASCII.

8548

# The order of characters does not matter.

8549

"commonAlphabet": "A String", # Common alphabets.

8550

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

8551

# This annotation will be applied to the surrogate by prefixing it with

8552

# the name of the custom infoType followed by the number of

8553

# characters comprising the surrogate. The following scheme defines the

8554

# format: info_type_name(surrogate_character_count):surrogate

8555

#

8556

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

8557

# the surrogate is 'abc', the full replacement value

8558

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

8559

#

8560

# This annotation identifies the surrogate when inspecting content using the

8561

# custom infoType

8562

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

8563

# This facilitates reversal of the surrogate when it occurs in free text.

8564

#

8565

# In order for inspection to work properly, the name of this infoType must

8566

# not occur naturally anywhere in your data; otherwise, inspection may

8567

# find a surrogate that does not correspond to an actual identifier.

8568

# Therefore, choose your custom infoType name carefully after considering

8569

# what your data looks like. One way to select a name that has a high chance

8570

# of yielding reliable detection is to include one or more unicode characters

8571

# that are highly improbable to exist in your data.

8572

# For example, assuming your data is entered from a regular ASCII keyboard,

8573

# the symbol with the hex code point 29DD might be used like so:

8574

# ⧝MY_TOKEN_TYPE

8575

"name": "A String", # Name of the information type. Either a name of your choosing when

8576

# creating a CustomInfoType, or one of the names listed

8577

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

8578

# a built-in type. InfoType names should conform to the pattern

8579

# `[a-zA-Z0-9_]{1,64}`.

8580

},

8581

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

8582

# identifier in two different contexts won't be given the same surrogate. If

8583

# the context is not set, a default tweak will be used.

8584

#

8585

# If the context is set but:

8586

#

8587

# 1. there is no record present when transforming a given value or

8588

# 1. the field is not present when transforming a given value,

8589

#

8590

# a default tweak will be used.

8591

#

8592

# Note that case (1) is expected when an `InfoTypeTransformation` is

8593

# applied to both structured and non-structured `ContentItem`s.

8594

# Currently, the referenced field may be of value type integer or string.

8595

#

8596

# The tweak is constructed as a sequence of bytes in big endian byte order

8597

# such that:

8598

#

8599

# - a 64 bit integer is encoded followed by a single byte of value 1

8600

# - a string is encoded in UTF-8 format followed by a single byte of value 2

8601

"name": "A String", # Name describing the field.

8602

},

8603

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

8604

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

8605

# a key encryption key (KEK) stored by KMS).

8606

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8607

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8608

# unwrap the data crypto key.

8609

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8610

# The wrapped key must be a 128/192/256 bit key.

8611

# Authorization requires the following IAM permissions when sending a request

8612

# to perform a crypto transformation using a kms-wrapped crypto key:

8613

# dlp.kms.encrypt

8614

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8615

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8616

},

8617

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8618

# leaking the key. Choose another type of key if possible.

8619

"key": "A String", # Required. A 128/192/256 bit key.

8620

},

8621

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8622

# It will be discarded after the request finishes.

8623

"name": "A String", # Required. Name of the key.

8624

# This is an arbitrary string used to differentiate different keys.

8625

# A unique key is generated per name: two separate `TransientCryptoKey`

8626

# protos share the same generated key if their names are the same.

8627

# When the data crypto key is generated, this name is not used in any way

8628

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

8633

# input. Outputs a base64 encoded representation of the encrypted output.

8634

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

8635

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

8636

# This annotation will be applied to the surrogate by prefixing it with

8637

# the name of the custom info type followed by the number of

8638

# characters comprising the surrogate. The following scheme defines the

8639

# format: {info type name}({surrogate character count}):{surrogate}

8640

#

8641

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

8642

# the surrogate is 'abc', the full replacement value

8643

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

8644

#

8645

# This annotation identifies the surrogate when inspecting content using the

8646

# custom info type 'Surrogate'. This facilitates reversal of the

8647

# surrogate when it occurs in free text.

8648

#

8649

# Note: For record transformations where the entire cell in a table is being

8650

# transformed, surrogates are not mandatory. Surrogates are used to denote

8651

# the location of the token and are necessary for re-identification in free

8652

# form text.

8653

#

8654

# In order for inspection to work properly, the name of this info type must

8655

# not occur naturally anywhere in your data; otherwise, inspection may either

8656

#

8657

# - reverse a surrogate that does not correspond to an actual identifier

8658

# - be unable to parse the surrogate and result in an error

8659

#

8660

# Therefore, choose your custom info type name carefully after considering

8661

# what your data looks like. One way to select a name that has a high chance

8662

# of yielding reliable detection is to include one or more unicode characters

8663

# that are highly improbable to exist in your data.

8664

# For example, assuming your data is entered from a regular ASCII keyboard,

8665

# the symbol with the hex code point 29DD might be used like so:

8666

# ⧝MY_TOKEN_TYPE.

8667

"name": "A String", # Name of the information type. Either a name of your choosing when

8668

# creating a CustomInfoType, or one of the names listed

8669

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

8670

# a built-in type. InfoType names should conform to the pattern

8671

# `[a-zA-Z0-9_]{1,64}`.

8672

},

8673

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

8674

# referential integrity such that the same identifier in two different

8675

# contexts will be given a distinct surrogate. The context is appended to

8676

# plaintext value being encrypted. On decryption the provided context is

8677

# validated against the value used during encryption. If a context was

8678

# provided during encryption, same context must be provided during decryption

8679

# as well.

8680

#

8681

# If the context is not set, plaintext would be used as is for encryption.

8682

# If the context is set but:

8683

#

8684

# 1. there is no record present when transforming a given value or

8685

# 2. the field is not present when transforming a given value,

8686

#

8687

# plaintext would be used as is for encryption.

8688

#

8689

# Note that case (1) is expected when an `InfoTypeTransformation` is

8690

# applied to both structured and non-structured `ContentItem`s.

8691

"name": "A String", # Name describing the field.

8692

},

8693

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

8694

# a key encryption key (KEK) stored by KMS).

8695

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8696

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8697

# unwrap the data crypto key.

8698

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8699

# The wrapped key must be a 128/192/256 bit key.

8700

# Authorization requires the following IAM permissions when sending a request

8701

# to perform a crypto transformation using a kms-wrapped crypto key:

8702

# dlp.kms.encrypt

8703

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8704

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8705

},

8706

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8707

# leaking the key. Choose another type of key if possible.

8708

"key": "A String", # Required. A 128/192/256 bit key.

8709

},

8710

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8711

# It will be discarded after the request finishes.

8712

"name": "A String", # Required. Name of the key.

8713

# This is an arbitrary string used to differentiate different keys.

8714

# A unique key is generated per name: two separate `TransientCryptoKey`

8715

# protos share the same generated key if their names are the same.

8716

# When the data crypto key is generated, this name is not used in any way

8717

# (repeating the api call will result in a different key being generated).

},

},

},

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

8722

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

8723

# output would be 'My phone number is '.

8724

},

8725

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

8726

# replacement values are dynamically provided by the user for custom behavior,

8727

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

8728

# This can be used on

8729

# data of type: number, long, string, timestamp.

8730

# If the bound `Value` type differs from the type of data being transformed, we

8731

# will first attempt converting the type of the data to be transformed to match

8732

# the type of the bound before comparing.

8733

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

8734

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

8735

{ # Bucket is represented as a range, along with replacement values.

8736

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

8737

# used.

8738

# Note that for the purposes of inspection or transformation, the number

8739

# of bytes considered to comprise a 'Value' is based on its representation

8740

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8741

# 123456789, the number of bytes would be counted as 9, even though an

8742

# int64 only holds up to 8 bytes of data.

8743

"booleanValue": True or False, # boolean

8744

"floatValue": 3.14, # float

8745

"dayOfWeekValue": "A String", # day of week

8746

"timestampValue": "A String", # timestamp

8747

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8748

# and time zone are either specified elsewhere or are not significant. The date

8749

# is relative to the Proleptic Gregorian Calendar. This can represent:

8750

#

8751

# * A full date, with non-zero year, month and day values

8752

# * A month and day value, with a zero year, e.g. an anniversary

8753

# * A year on its own, with zero month and day values

8754

# * A year and month value, with a zero day, e.g. a credit card expiration date

8755

#

8756

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8757

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8758

# a year.

8759

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8760

# month and day.

8761

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8762

# if specifying a year by itself or a year and month where the day is not

8763

# significant.

8764

},

8765

"stringValue": "A String", # string

8766

"integerValue": "A String", # integer

8767

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8768

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8769

# types are google.type.Date and `google.protobuf.Timestamp`.

8770

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8771

# allow the value 60 if it allows leap-seconds.

8772

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8773

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8774

# to allow the value "24:00:00" for scenarios like business closing time.

8775

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8776

},

8777

},

8778

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

8779

# Note that for the purposes of inspection or transformation, the number

8780

# of bytes considered to comprise a 'Value' is based on its representation

8781

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8782

# 123456789, the number of bytes would be counted as 9, even though an

8783

# int64 only holds up to 8 bytes of data.

8784

"booleanValue": True or False, # boolean

8785

"floatValue": 3.14, # float

8786

"dayOfWeekValue": "A String", # day of week

8787

"timestampValue": "A String", # timestamp

8788

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8789

# and time zone are either specified elsewhere or are not significant. The date

8790

# is relative to the Proleptic Gregorian Calendar. This can represent:

8791

#

8792

# * A full date, with non-zero year, month and day values

8793

# * A month and day value, with a zero year, e.g. an anniversary

8794

# * A year on its own, with zero month and day values

8795

# * A year and month value, with a zero day, e.g. a credit card expiration date

8796

#

8797

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8798

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8799

# a year.

8800

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8801

# month and day.

8802

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8803

# if specifying a year by itself or a year and month where the day is not

8804

# significant.

8805

},

8806

"stringValue": "A String", # string

8807

"integerValue": "A String", # integer

8808

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8809

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8810

# types are google.type.Date and `google.protobuf.Timestamp`.

8811

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8812

# allow the value 60 if it allows leap-seconds.

8813

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8814

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8815

# to allow the value "24:00:00" for scenarios like business closing time.

8816

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8817

},

8818

},

8819

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

8820

# the default behavior will be to hyphenate the min-max range.

8821

# Note that for the purposes of inspection or transformation, the number

8822

# of bytes considered to comprise a 'Value' is based on its representation

8823

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8824

# 123456789, the number of bytes would be counted as 9, even though an

8825

# int64 only holds up to 8 bytes of data.

8826

"booleanValue": True or False, # boolean

8827

"floatValue": 3.14, # float

8828

"dayOfWeekValue": "A String", # day of week

8829

"timestampValue": "A String", # timestamp

8830

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8831

# and time zone are either specified elsewhere or are not significant. The date

8832

# is relative to the Proleptic Gregorian Calendar. This can represent:

8833

#

8834

# * A full date, with non-zero year, month and day values

8835

# * A month and day value, with a zero year, e.g. an anniversary

8836

# * A year on its own, with zero month and day values

8837

# * A year and month value, with a zero day, e.g. a credit card expiration date

8838

#

8839

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8840

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8841

# a year.

8842

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8843

# month and day.

8844

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8845

# if specifying a year by itself or a year and month where the day is not

8846

# significant.

8847

},

8848

"stringValue": "A String", # string

8849

"integerValue": "A String", # integer

8850

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8851

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8852

# types are google.type.Date and `google.protobuf.Timestamp`.

8853

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8854

# allow the value 60 if it allows leap-seconds.

8855

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8856

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8857

# to allow the value "24:00:00" for scenarios like business closing time.

8858

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

],

},

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

8865

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

8866

# Note that for the purposes of inspection or transformation, the number

8867

# of bytes considered to comprise a 'Value' is based on its representation

8868

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8869

# 123456789, the number of bytes would be counted as 9, even though an

8870

# int64 only holds up to 8 bytes of data.

8871

"booleanValue": True or False, # boolean

8872

"floatValue": 3.14, # float

8873

"dayOfWeekValue": "A String", # day of week

8874

"timestampValue": "A String", # timestamp

8875

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8876

# and time zone are either specified elsewhere or are not significant. The date

8877

# is relative to the Proleptic Gregorian Calendar. This can represent:

8878

#

8879

# * A full date, with non-zero year, month and day values

8880

# * A month and day value, with a zero year, e.g. an anniversary

8881

# * A year on its own, with zero month and day values

8882

# * A year and month value, with a zero day, e.g. a credit card expiration date

8883

#

8884

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8885

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8886

# a year.

8887

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8888

# month and day.

8889

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8890

# if specifying a year by itself or a year and month where the day is not

8891

# significant.

8892

},

8893

"stringValue": "A String", # string

8894

"integerValue": "A String", # integer

8895

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8896

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8897

# types are google.type.Date and `google.protobuf.Timestamp`.

8898

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8899

# allow the value 60 if it allows leap-seconds.

8900

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8901

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8902

# to allow the value "24:00:00" for scenarios like business closing time.

8903

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

8908

# fixed character. Masking can start from the beginning or end of the string.

8909

# This can be used on data of any type (numbers, longs, and so on) and when

8910

# de-identifying structured data we'll attempt to preserve the original data's

8911

# type. (This allows you to take a long like 123 and modify it to a string like

8912

# **3.

8913

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

8914

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

8915

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

8916

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

8917

# is `true`, then the string `12345` is masked as `12***`.

8918

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

8919

# characters. For example, if the input string is `555-555-5555` and you

8920

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

8921

# returns `***-**5-5555`.

8922

{ # Characters to skip when doing deidentification of a value. These will be left

8923

# alone and skipped.

8924

"charactersToSkip": "A String", # Characters to not transform when masking.

8925

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

8930

# masked. Skipped characters do not count towards this tally.

8931

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

8932

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

8933

# code or credit card number. This string must have a length of 1. If not

8934

# supplied, this value defaults to `*` for strings, and `0` for digits.

8935

},

8936

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

8937

# Bucketing transformation can provide all of this functionality,

8938

# but requires more configuration. This message is provided as a convenience to

8939

# the user for simple bucketing strategies.

8940

#

8941

# The transformed value will be a hyphenated string of

8942

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

8943

# all values that are within this bucket will be replaced with "10-20".

8944

#

8945

# This can be used on data of type: double, long.

8946

#

8947

# If the bound Value type differs from the type of data

8948

# being transformed, we will first attempt converting the type of the data to

8949

# be transformed to match the type of the bound before comparing.

8950

#

8951

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

8952

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

8953

# grouped together into a single bucket; for example if `lower_bound` = 10,

8954

# then all values less than 10 are replaced with the value "-10".

8955

# Note that for the purposes of inspection or transformation, the number

8956

# of bytes considered to comprise a 'Value' is based on its representation

8957

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8958

# 123456789, the number of bytes would be counted as 9, even though an

8959

# int64 only holds up to 8 bytes of data.

8960

"booleanValue": True or False, # boolean

8961

"floatValue": 3.14, # float

8962

"dayOfWeekValue": "A String", # day of week

8963

"timestampValue": "A String", # timestamp

8964

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8965

# and time zone are either specified elsewhere or are not significant. The date

8966

# is relative to the Proleptic Gregorian Calendar. This can represent:

8967

#

8968

# * A full date, with non-zero year, month and day values

8969

# * A month and day value, with a zero year, e.g. an anniversary

8970

# * A year on its own, with zero month and day values

8971

# * A year and month value, with a zero day, e.g. a credit card expiration date

8972

#

8973

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8974

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8975

# a year.

8976

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8977

# month and day.

8978

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8979

# if specifying a year by itself or a year and month where the day is not

8980

# significant.

8981

},

8982

"stringValue": "A String", # string

8983

"integerValue": "A String", # integer

8984

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8985

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8986

# types are google.type.Date and `google.protobuf.Timestamp`.

8987

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8988

# allow the value 60 if it allows leap-seconds.

8989

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8990

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8991

# to allow the value "24:00:00" for scenarios like business closing time.

8992

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8993

},

8994

},

8995

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

8996

# grouped together into a single bucket; for example if `upper_bound` = 89,

8997

# then all values greater than 89 are replaced with the value "89+".

8998

# Note that for the purposes of inspection or transformation, the number

8999

# of bytes considered to comprise a 'Value' is based on its representation

9000

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9001

# 123456789, the number of bytes would be counted as 9, even though an

9002

# int64 only holds up to 8 bytes of data.

9003

"booleanValue": True or False, # boolean

9004

"floatValue": 3.14, # float

9005

"dayOfWeekValue": "A String", # day of week

9006

"timestampValue": "A String", # timestamp

9007

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9008

# and time zone are either specified elsewhere or are not significant. The date

9009

# is relative to the Proleptic Gregorian Calendar. This can represent:

9010

#

9011

# * A full date, with non-zero year, month and day values

9012

# * A month and day value, with a zero year, e.g. an anniversary

9013

# * A year on its own, with zero month and day values

9014

# * A year and month value, with a zero day, e.g. a credit card expiration date

9015

#

9016

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9017

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9018

# a year.

9019

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9020

# month and day.

9021

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9022

# if specifying a year by itself or a year and month where the day is not

9023

# significant.

9024

},

9025

"stringValue": "A String", # string

9026

"integerValue": "A String", # integer

9027

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9028

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9029

# types are google.type.Date and `google.protobuf.Timestamp`.

9030

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9031

# allow the value 60 if it allows leap-seconds.

9032

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9033

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9034

# to allow the value "24:00:00" for scenarios like business closing time.

9035

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9036

},

9037

},

9038

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

9039

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

9040

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

9041

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

9042

},

9043

},

9044

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

9045

# given `RecordCondition`. The conditions are allowed to reference fields

9046

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

9051

# column for the same record is within a specific range.

9052

# - Redact a field if the date of birth field is greater than 85.

9053

# a field.

9054

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

9055

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

9056

# only supported value is `AND`.

9057

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

9058

"conditions": [ # A collection of conditions.

9059

{ # The field type of `value` and `field` do not need to match to be

9060

# considered equal, but not all comparisons are possible.

9061

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

9062

# but all other comparisons are invalid with incompatible types.

9063

# A `value` of type:

9064

#

9065

# - `string` can be compared against all other types

9066

# - `boolean` can only be compared against other booleans

9067

# - `integer` can be compared against doubles or a string if the string value

9068

# can be parsed as an integer.

9069

# - `double` can be compared against integers or a string if the string can

9070

# be parsed as a double.

9071

# - `Timestamp` can be compared against strings in RFC 3339 date string

9072

# format.

9073

# - `TimeOfDay` can be compared against timestamps and strings in the format

9074

# of 'HH:mm:ss'.

9075

#

9076

# If we fail to compare do to type mismatch, a warning will be given and

9077

# the condition will evaluate to false.

9078

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

9079

"name": "A String", # Name describing the field.

9080

},

9081

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

9082

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

9083

# Note that for the purposes of inspection or transformation, the number

9084

# of bytes considered to comprise a 'Value' is based on its representation

9085

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9086

# 123456789, the number of bytes would be counted as 9, even though an

9087

# int64 only holds up to 8 bytes of data.

9088

"booleanValue": True or False, # boolean

9089

"floatValue": 3.14, # float

9090

"dayOfWeekValue": "A String", # day of week

9091

"timestampValue": "A String", # timestamp

9092

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9093

# and time zone are either specified elsewhere or are not significant. The date

9094

# is relative to the Proleptic Gregorian Calendar. This can represent:

9095

#

9096

# * A full date, with non-zero year, month and day values

9097

# * A month and day value, with a zero year, e.g. an anniversary

9098

# * A year on its own, with zero month and day values

9099

# * A year and month value, with a zero day, e.g. a credit card expiration date

9100

#

9101

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9102

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9103

# a year.

9104

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9105

# month and day.

9106

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9107

# if specifying a year by itself or a year and month where the day is not

9108

# significant.

9109

},

9110

"stringValue": "A String", # string

9111

"integerValue": "A String", # integer

9112

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9113

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9114

# types are google.type.Date and `google.protobuf.Timestamp`.

9115

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9116

# allow the value 60 if it allows leap-seconds.

9117

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9118

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9119

# to allow the value "24:00:00" for scenarios like business closing time.

9120

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

],

},

},

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9128

},

9129

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9130

"field": { # General identifier of a data field in a storage service. # Set if the transformation was limited to a specific FieldId.

9131

"name": "A String", # Name describing the field.

9132

},

9133

"transformation": { # A rule for transforming a value. # The specific transformation these stats apply to.

9134

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

9135

# portion of the value.

9136

"partToExtract": "A String", # The part of the time to keep.

9137

},

9138

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

9139

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

9140

# to learn more.

9141

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

9142

# If set, must also set cryptoKey. If set, shift will be consistent for the

9143

# given context.

9144

"name": "A String", # Name describing the field.

9145

},

9146

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

9147

# range (inclusive ends). Negative means shift to earlier in time. Must not

9148

# be more than 365250 days (1000 years) each direction.

9149

#

9150

# For example, 3 means shift date to at most 3 days into the future.

9151

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

9152

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

9153

# results in the same shift for the same context and crypto_key. If

9154

# set, must also set context. Can only be applied to table items.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9155

# a key encryption key (KEK) stored by KMS).

9156

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9157

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9158

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9159

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9160

# The wrapped key must be a 128/192/256 bit key.

9161

# Authorization requires the following IAM permissions when sending a request

9162

# to perform a crypto transformation using a kms-wrapped crypto key:

9163

# dlp.kms.encrypt

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9164

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9165

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9166

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9167

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9168

# leaking the key. Choose another type of key if possible.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9169

"key": "A String", # Required. A 128/192/256 bit key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9170

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9171

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9172

# It will be discarded after the request finishes.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9173

"name": "A String", # Required. Name of the key.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9174

# This is an arbitrary string used to differentiate different keys.

9175

# A unique key is generated per name: two separate `TransientCryptoKey`

9176

# protos share the same generated key if their names are the same.

9177

# When the data crypto key is generated, this name is not used in any way

9178

# (repeating the api call will result in a different key being generated).

9179

},

9180

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9181

},

9182

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

9183

},

9184

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

9185

# Uses SHA-256.

9186

# The key size must be either 32 or 64 bytes.

9187

# Outputs a base64 encoded representation of the hashed output

9188

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

9189

# Currently, only string and integer values can be hashed.

9190

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

9191

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

9192

# a key encryption key (KEK) stored by KMS).

9193

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9194

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9195

# unwrap the data crypto key.

9196

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9197

# The wrapped key must be a 128/192/256 bit key.

9198

# Authorization requires the following IAM permissions when sending a request

9199

# to perform a crypto transformation using a kms-wrapped crypto key:

9200

# dlp.kms.encrypt

9201

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9202

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9203

},

9204

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9205

# leaking the key. Choose another type of key if possible.

9206

"key": "A String", # Required. A 128/192/256 bit key.

9207

},

9208

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9209

# It will be discarded after the request finishes.

9210

"name": "A String", # Required. Name of the key.

9211

# This is an arbitrary string used to differentiate different keys.

9212

# A unique key is generated per name: two separate `TransientCryptoKey`

9213

# protos share the same generated key if their names are the same.

9214

# When the data crypto key is generated, this name is not used in any way

9215

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

9220

# (FPE) with the FFX mode of operation; however when used in the

9221

# `ReidentifyContent` API method, it serves the opposite function by reversing

9222

# the surrogate back into the original identifier. The identifier must be

9223

# encoded as ASCII. For a given crypto key and context, the same identifier

9224

# will be replaced with the same surrogate. Identifiers must be at least two

9225

# characters long. In the case that the identifier is the empty string, it will

9226

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

9227

# more.

9228

#

9229

# Note: We recommend using CryptoDeterministicConfig for all use cases which

9230

# do not require preserving the input alphabet space and size, plus warrant

9231

# referential integrity.

9232

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

9233

# that the FFX mode natively supports. This happens before/after

9234

# encryption/decryption.

9235

# Each character listed must appear only once.

9236

# Number of characters must be in the range [2, 95].

9237

# This must be encoded as ASCII.

9238

# The order of characters does not matter.

9239

"commonAlphabet": "A String", # Common alphabets.

9240

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

9241

# This annotation will be applied to the surrogate by prefixing it with

9242

# the name of the custom infoType followed by the number of

9243

# characters comprising the surrogate. The following scheme defines the

9244

# format: info_type_name(surrogate_character_count):surrogate

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9245

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9246

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

9247

# the surrogate is 'abc', the full replacement value

9248

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

9249

#

9250

# This annotation identifies the surrogate when inspecting content using the

9251

# custom infoType

9252

# [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

9253

# This facilitates reversal of the surrogate when it occurs in free text.

9254

#

9255

# In order for inspection to work properly, the name of this infoType must

9256

# not occur naturally anywhere in your data; otherwise, inspection may

9257

# find a surrogate that does not correspond to an actual identifier.

9258

# Therefore, choose your custom infoType name carefully after considering

9259

# what your data looks like. One way to select a name that has a high chance

9260

# of yielding reliable detection is to include one or more unicode characters

9261

# that are highly improbable to exist in your data.

9262

# For example, assuming your data is entered from a regular ASCII keyboard,

9263

# the symbol with the hex code point 29DD might be used like so:

9264

# ⧝MY_TOKEN_TYPE

9265

"name": "A String", # Name of the information type. Either a name of your choosing when

9266

# creating a CustomInfoType, or one of the names listed

9267

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

9268

# a built-in type. InfoType names should conform to the pattern

9269

# `[a-zA-Z0-9_]{1,64}`.

9270

},

9271

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

9272

# identifier in two different contexts won't be given the same surrogate. If

9273

# the context is not set, a default tweak will be used.

9274

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9275

# If the context is set but:

9276

#

9277

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9278

# 1. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9279

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9280

# a default tweak will be used.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9281

#

9282

# Note that case (1) is expected when an `InfoTypeTransformation` is

9283

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9284

# Currently, the referenced field may be of value type integer or string.

9285

#

9286

# The tweak is constructed as a sequence of bytes in big endian byte order

9287

# such that:

9288

#

9289

# - a 64 bit integer is encoded followed by a single byte of value 1

9290

# - a string is encoded in UTF-8 format followed by a single byte of value 2

9291

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9292

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9293

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

9294

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

9295

# a key encryption key (KEK) stored by KMS).

9296

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9297

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9298

# unwrap the data crypto key.

9299

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9300

# The wrapped key must be a 128/192/256 bit key.

9301

# Authorization requires the following IAM permissions when sending a request

9302

# to perform a crypto transformation using a kms-wrapped crypto key:

9303

# dlp.kms.encrypt

9304

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9305

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9306

},

9307

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9308

# leaking the key. Choose another type of key if possible.

9309

"key": "A String", # Required. A 128/192/256 bit key.

9310

},

9311

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9312

# It will be discarded after the request finishes.

9313

"name": "A String", # Required. Name of the key.

9314

# This is an arbitrary string used to differentiate different keys.

9315

# A unique key is generated per name: two separate `TransientCryptoKey`

9316

# protos share the same generated key if their names are the same.

9317

# When the data crypto key is generated, this name is not used in any way

9318

# (repeating the api call will result in a different key being generated).

},

},

},

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

9323

# input. Outputs a base64 encoded representation of the encrypted output.

9324

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

9325

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9326

# This annotation will be applied to the surrogate by prefixing it with

9327

# the name of the custom info type followed by the number of

9328

# characters comprising the surrogate. The following scheme defines the

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9329

# format: {info type name}({surrogate character count}):{surrogate}

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9330

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9331

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

9332

# the surrogate is 'abc', the full replacement value

9333

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9334

#

9335

# This annotation identifies the surrogate when inspecting content using the

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9336

# custom info type 'Surrogate'. This facilitates reversal of the

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9337

# surrogate when it occurs in free text.

9338

#

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9339

# Note: For record transformations where the entire cell in a table is being

9340

# transformed, surrogates are not mandatory. Surrogates are used to denote

9341

# the location of the token and are necessary for re-identification in free

9342

# form text.

9343

#

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9344

# In order for inspection to work properly, the name of this info type must

9345

# not occur naturally anywhere in your data; otherwise, inspection may either

9346

#

9347

# - reverse a surrogate that does not correspond to an actual identifier

9348

# - be unable to parse the surrogate and result in an error

9349

#

9350

# Therefore, choose your custom info type name carefully after considering

9351

# what your data looks like. One way to select a name that has a high chance

9352

# of yielding reliable detection is to include one or more unicode characters

9353

# that are highly improbable to exist in your data.

9354

# For example, assuming your data is entered from a regular ASCII keyboard,

9355

# the symbol with the hex code point 29DD might be used like so:

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9356

# ⧝MY_TOKEN_TYPE.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9357

"name": "A String", # Name of the information type. Either a name of your choosing when

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9358

# creating a CustomInfoType, or one of the names listed

9359

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

9360

# a built-in type. InfoType names should conform to the pattern

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9361

# `[a-zA-Z0-9_]{1,64}`.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9362

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9363

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

9364

# referential integrity such that the same identifier in two different

9365

# contexts will be given a distinct surrogate. The context is appended to

9366

# plaintext value being encrypted. On decryption the provided context is

9367

# validated against the value used during encryption. If a context was

9368

# provided during encryption, same context must be provided during decryption

9369

# as well.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9370

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9371

# If the context is not set, plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9372

# If the context is set but:

9373

#

9374

# 1. there is no record present when transforming a given value or

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9375

# 2. the field is not present when transforming a given value,

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9376

#

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9377

# plaintext would be used as is for encryption.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9378

#

9379

# Note that case (1) is expected when an `InfoTypeTransformation` is

9380

# applied to both structured and non-structured `ContentItem`s.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9381

"name": "A String", # Name describing the field.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9382

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9383

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

9384

# a key encryption key (KEK) stored by KMS).

9385

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9386

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9387

# unwrap the data crypto key.

9388

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9389

# The wrapped key must be a 128/192/256 bit key.

9390

# Authorization requires the following IAM permissions when sending a request

9391

# to perform a crypto transformation using a kms-wrapped crypto key:

9392

# dlp.kms.encrypt

9393

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9394

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9395

},

9396

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9397

# leaking the key. Choose another type of key if possible.

9398

"key": "A String", # Required. A 128/192/256 bit key.

9399

},

9400

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9401

# It will be discarded after the request finishes.

9402

"name": "A String", # Required. Name of the key.

9403

# This is an arbitrary string used to differentiate different keys.

9404

# A unique key is generated per name: two separate `TransientCryptoKey`

9405

# protos share the same generated key if their names are the same.

9406

# When the data crypto key is generated, this name is not used in any way

9407

# (repeating the api call will result in a different key being generated).

9408

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9409

},

9410

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9411

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

9412

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

9413

# output would be 'My phone number is '.

9414

},

9415

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9416

# replacement values are dynamically provided by the user for custom behavior,

9417

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

9418

# This can be used on

9419

# data of type: number, long, string, timestamp.

9420

# If the bound `Value` type differs from the type of data being transformed, we

9421

# will first attempt converting the type of the data to be transformed to match

9422

# the type of the bound before comparing.

9423

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9424

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9425

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9426

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9427

# used.

9428

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9429

# of bytes considered to comprise a 'Value' is based on its representation

9430

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9431

# 123456789, the number of bytes would be counted as 9, even though an

9432

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9433

"booleanValue": True or False, # boolean

9434

"floatValue": 3.14, # float

9435

"dayOfWeekValue": "A String", # day of week

9436

"timestampValue": "A String", # timestamp

9437

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9438

# and time zone are either specified elsewhere or are not significant. The date

9439

# is relative to the Proleptic Gregorian Calendar. This can represent:

9440

#

9441

# * A full date, with non-zero year, month and day values

9442

# * A month and day value, with a zero year, e.g. an anniversary

9443

# * A year on its own, with zero month and day values

9444

# * A year and month value, with a zero day, e.g. a credit card expiration date

9445

#

9446

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9447

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9448

# a year.

9449

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9450

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9451

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9452

# if specifying a year by itself or a year and month where the day is not

9453

# significant.

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9454

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9455

"stringValue": "A String", # string

9456

"integerValue": "A String", # integer

9457

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9458

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9459

# types are google.type.Date and `google.protobuf.Timestamp`.

9460

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9461

# allow the value 60 if it allows leap-seconds.

9462

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9463

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9464

# to allow the value "24:00:00" for scenarios like business closing time.

9465

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9466

},

9467

},

9468

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

9469

# Note that for the purposes of inspection or transformation, the number

9470

# of bytes considered to comprise a 'Value' is based on its representation

9471

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9472

# 123456789, the number of bytes would be counted as 9, even though an

9473

# int64 only holds up to 8 bytes of data.

9474

"booleanValue": True or False, # boolean

9475

"floatValue": 3.14, # float

9476

"dayOfWeekValue": "A String", # day of week

9477

"timestampValue": "A String", # timestamp

9478

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9479

# and time zone are either specified elsewhere or are not significant. The date

9480

# is relative to the Proleptic Gregorian Calendar. This can represent:

9481

#

9482

# * A full date, with non-zero year, month and day values

9483

# * A month and day value, with a zero year, e.g. an anniversary

9484

# * A year on its own, with zero month and day values

9485

# * A year and month value, with a zero day, e.g. a credit card expiration date

9486

#

9487

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9488

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9489

# a year.

9490

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9491

# month and day.

9492

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9493

# if specifying a year by itself or a year and month where the day is not

9494

# significant.

9495

},

9496

"stringValue": "A String", # string

9497

"integerValue": "A String", # integer

9498

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9499

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9500

# types are google.type.Date and `google.protobuf.Timestamp`.

9501

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9502

# allow the value 60 if it allows leap-seconds.

9503

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9504

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9505

# to allow the value "24:00:00" for scenarios like business closing time.

9506

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9507

},

9508

},

9509

"replacementValue": { # Set of primitive values supported by the system. # Replacement value for this bucket. If not provided

9510

# the default behavior will be to hyphenate the min-max range.

9511

# Note that for the purposes of inspection or transformation, the number

9512

# of bytes considered to comprise a 'Value' is based on its representation

9513

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9514

# 123456789, the number of bytes would be counted as 9, even though an

9515

# int64 only holds up to 8 bytes of data.

9516

"booleanValue": True or False, # boolean

9517

"floatValue": 3.14, # float

9518

"dayOfWeekValue": "A String", # day of week

9519

"timestampValue": "A String", # timestamp

9520

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9521

# and time zone are either specified elsewhere or are not significant. The date

9522

# is relative to the Proleptic Gregorian Calendar. This can represent:

9523

#

9524

# * A full date, with non-zero year, month and day values

9525

# * A month and day value, with a zero year, e.g. an anniversary

9526

# * A year on its own, with zero month and day values

9527

# * A year and month value, with a zero day, e.g. a credit card expiration date

9528

#

9529

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9530

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9531

# a year.

9532

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9533

# month and day.

9534

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9535

# if specifying a year by itself or a year and month where the day is not

9536

# significant.

9537

},

9538

"stringValue": "A String", # string

9539

"integerValue": "A String", # integer

9540

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9541

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9542

# types are google.type.Date and `google.protobuf.Timestamp`.

9543

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9544

# allow the value 60 if it allows leap-seconds.

9545

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9546

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9547

# to allow the value "24:00:00" for scenarios like business closing time.

9548

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9549

},

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9554

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

9555

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9556

# Note that for the purposes of inspection or transformation, the number

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9557

# of bytes considered to comprise a 'Value' is based on its representation

9558

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9559

# 123456789, the number of bytes would be counted as 9, even though an

9560

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9561

"booleanValue": True or False, # boolean

9562

"floatValue": 3.14, # float

9563

"dayOfWeekValue": "A String", # day of week

9564

"timestampValue": "A String", # timestamp

9565

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9566

# and time zone are either specified elsewhere or are not significant. The date

9567

# is relative to the Proleptic Gregorian Calendar. This can represent:

9568

#

9569

# * A full date, with non-zero year, month and day values

9570

# * A month and day value, with a zero year, e.g. an anniversary

9571

# * A year on its own, with zero month and day values

9572

# * A year and month value, with a zero day, e.g. a credit card expiration date

9573

#

9574

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9575

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9576

# a year.

9577

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

Dan O'Meara

2020-05-01 07:42:23 -0700

[diff] [blame]

9578

# month and day.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9579

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9580

# if specifying a year by itself or a year and month where the day is not

9581

# significant.

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9582

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9583

"stringValue": "A String", # string

9584

"integerValue": "A String", # integer

9585

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9586

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9587

# types are google.type.Date and `google.protobuf.Timestamp`.

9588

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9589

# allow the value 60 if it allows leap-seconds.

9590

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9591

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9592

# to allow the value "24:00:00" for scenarios like business closing time.

9593

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

9598

# fixed character. Masking can start from the beginning or end of the string.

9599

# This can be used on data of any type (numbers, longs, and so on) and when

9600

# de-identifying structured data we'll attempt to preserve the original data's

9601

# type. (This allows you to take a long like 123 and modify it to a string like

9602

# **3.

9603

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

9604

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

9605

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

9606

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

9607

# is `true`, then the string `12345` is masked as `12***`.

9608

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

9609

# characters. For example, if the input string is `555-555-5555` and you

9610

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

9611

# returns `***-**5-5555`.

9612

{ # Characters to skip when doing deidentification of a value. These will be left

9613

# alone and skipped.

9614

"charactersToSkip": "A String", # Characters to not transform when masking.

9615

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

9620

# masked. Skipped characters do not count towards this tally.

9621

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

9622

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

9623

# code or credit card number. This string must have a length of 1. If not

9624

# supplied, this value defaults to `*` for strings, and `0` for digits.

9625

},

9626

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

9627

# Bucketing transformation can provide all of this functionality,

9628

# but requires more configuration. This message is provided as a convenience to

9629

# the user for simple bucketing strategies.

9630

#

9631

# The transformed value will be a hyphenated string of

9632

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

9633

# all values that are within this bucket will be replaced with "10-20".

9634

#

9635

# This can be used on data of type: double, long.

9636

#

9637

# If the bound Value type differs from the type of data

9638

# being transformed, we will first attempt converting the type of the data to

9639

# be transformed to match the type of the bound before comparing.

9640

#

9641

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

9642

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

9643

# grouped together into a single bucket; for example if `lower_bound` = 10,

9644

# then all values less than 10 are replaced with the value "-10".

9645

# Note that for the purposes of inspection or transformation, the number

9646

# of bytes considered to comprise a 'Value' is based on its representation

9647

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9648

# 123456789, the number of bytes would be counted as 9, even though an

9649

# int64 only holds up to 8 bytes of data.

9650

"booleanValue": True or False, # boolean

9651

"floatValue": 3.14, # float

9652

"dayOfWeekValue": "A String", # day of week

9653

"timestampValue": "A String", # timestamp

9654

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9655

# and time zone are either specified elsewhere or are not significant. The date

9656

# is relative to the Proleptic Gregorian Calendar. This can represent:

9657

#

9658

# * A full date, with non-zero year, month and day values

9659

# * A month and day value, with a zero year, e.g. an anniversary

9660

# * A year on its own, with zero month and day values

9661

# * A year and month value, with a zero day, e.g. a credit card expiration date

9662

#

9663

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9664

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9665

# a year.

9666

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9667

# month and day.

9668

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9669

# if specifying a year by itself or a year and month where the day is not

9670

# significant.

9671

},

9672

"stringValue": "A String", # string

9673

"integerValue": "A String", # integer

9674

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9675

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9676

# types are google.type.Date and `google.protobuf.Timestamp`.

9677

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9678

# allow the value 60 if it allows leap-seconds.

9679

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9680

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9681

# to allow the value "24:00:00" for scenarios like business closing time.

9682

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9683

},

9684

},

9685

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

9686

# grouped together into a single bucket; for example if `upper_bound` = 89,

9687

# then all values greater than 89 are replaced with the value "89+".

9688

# Note that for the purposes of inspection or transformation, the number

9689

# of bytes considered to comprise a 'Value' is based on its representation

9690

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9691

# 123456789, the number of bytes would be counted as 9, even though an

9692

# int64 only holds up to 8 bytes of data.

9693

"booleanValue": True or False, # boolean

9694

"floatValue": 3.14, # float

9695

"dayOfWeekValue": "A String", # day of week

9696

"timestampValue": "A String", # timestamp

9697

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9698

# and time zone are either specified elsewhere or are not significant. The date

9699

# is relative to the Proleptic Gregorian Calendar. This can represent:

9700

#

9701

# * A full date, with non-zero year, month and day values

9702

# * A month and day value, with a zero year, e.g. an anniversary

9703

# * A year on its own, with zero month and day values

9704

# * A year and month value, with a zero day, e.g. a credit card expiration date

9705

#

9706

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9707

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9708

# a year.

9709

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9710

# month and day.

9711

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9712

# if specifying a year by itself or a year and month where the day is not

9713

# significant.

9714

},

9715

"stringValue": "A String", # string

9716

"integerValue": "A String", # integer

9717

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9718

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9719

# types are google.type.Date and `google.protobuf.Timestamp`.

9720

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9721

# allow the value 60 if it allows leap-seconds.

9722

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9723

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9724

# to allow the value "24:00:00" for scenarios like business closing time.

9725

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9726

},

9727

},

9728

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

9729

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

9730

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

9731

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

9732

},

9733

},

9734

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

9735

"recordSuppress": { # Configuration to suppress records whose suppression conditions evaluate to # The specific suppression option these stats apply to.

9736

# true.

9737

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

9738

# evaluated to be suppressed from the transformed content.

9739

# a field.

9740

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

9741

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

9742

# only supported value is `AND`.

9743

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

9744

"conditions": [ # A collection of conditions.

9745

{ # The field type of `value` and `field` do not need to match to be

9746

# considered equal, but not all comparisons are possible.

9747

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

9748

# but all other comparisons are invalid with incompatible types.

9749

# A `value` of type:

9750

#

9751

# - `string` can be compared against all other types

9752

# - `boolean` can only be compared against other booleans

9753

# - `integer` can be compared against doubles or a string if the string value

9754

# can be parsed as an integer.

9755

# - `double` can be compared against integers or a string if the string can

9756

# be parsed as a double.

9757

# - `Timestamp` can be compared against strings in RFC 3339 date string

9758

# format.

9759

# - `TimeOfDay` can be compared against timestamps and strings in the format

9760

# of 'HH:mm:ss'.

9761

#

9762

# If we fail to compare do to type mismatch, a warning will be given and

9763

# the condition will evaluate to false.

9764

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

9765

"name": "A String", # Name describing the field.

9766

},

9767

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

9768

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

9769

# Note that for the purposes of inspection or transformation, the number

9770

# of bytes considered to comprise a 'Value' is based on its representation

9771

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9772

# 123456789, the number of bytes would be counted as 9, even though an

9773

# int64 only holds up to 8 bytes of data.

9774

"booleanValue": True or False, # boolean

9775

"floatValue": 3.14, # float

9776

"dayOfWeekValue": "A String", # day of week

9777

"timestampValue": "A String", # timestamp

9778

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9779

# and time zone are either specified elsewhere or are not significant. The date

9780

# is relative to the Proleptic Gregorian Calendar. This can represent:

9781

#

9782

# * A full date, with non-zero year, month and day values

9783

# * A month and day value, with a zero year, e.g. an anniversary

9784

# * A year on its own, with zero month and day values

9785

# * A year and month value, with a zero day, e.g. a credit card expiration date

9786

#

9787

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9788

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9789

# a year.

9790

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9791

# month and day.

9792

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9793

# if specifying a year by itself or a year and month where the day is not

9794

# significant.

9795

},

9796

"stringValue": "A String", # string

9797

"integerValue": "A String", # integer

9798

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9799

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9800

# types are google.type.Date and `google.protobuf.Timestamp`.

9801

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9802

# allow the value 60 if it allows leap-seconds.

9803

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9804

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9805

# to allow the value "24:00:00" for scenarios like business closing time.

9806

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

},

],

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9812

},

9813

},

9814

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9815

"infoType": { # Type of information detected by the API. # Set if the transformation was limited to a specific InfoType.

9816

"name": "A String", # Name of the information type. Either a name of your choosing when

9817

# creating a CustomInfoType, or one of the names listed

9818

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

9819

# a built-in type. InfoType names should conform to the pattern

9820

# `[a-zA-Z0-9_]{1,64}`.

9821

},

9822

"results": [ # Collection of all transformations that took place or had an error.

9823

{ # A collection that informs the user the number of times a particular

9824

# `TransformationResultCode` and error details occurred.

9825

"code": "A String", # Outcome of the transformation.

9826

"count": "A String", # Number of transformations counted by this result.

9827

"details": "A String", # A place for warnings or errors to show up if a transformation didn't

9828

# work as expected.

9829

},

9830

],

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9831

},

9832

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9833

"transformedBytes": "A String", # Total size in bytes that were transformed in some way.

9834

},

9835

"item": { # Container structure for the content to inspect. # The re-identified item.

9836

"byteItem": { # Container for bytes to inspect or redact. # Content data to inspect or redact. Replaces `type` and `data`.

9837

"type": "A String", # The type of data stored in the bytes string. Default will be TEXT_UTF8.

9838

"data": "A String", # Content data to inspect or redact.

9839

},

9840

"value": "A String", # String data to inspect or redact.

9841

"table": { # Structured content to inspect. Up to 50,000 `Value`s per request allowed. # Structured content for inspection. See

9842

# https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

9843

# learn more.

9844

# See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to

9845

# learn more.

9846

"rows": [ # Rows of the table.

9847

{ # Values of the row.

9848

"values": [ # Individual cells.

9849

{ # Set of primitive values supported by the system.

9850

# Note that for the purposes of inspection or transformation, the number

9851

# of bytes considered to comprise a 'Value' is based on its representation

9852

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9853

# 123456789, the number of bytes would be counted as 9, even though an

9854

# int64 only holds up to 8 bytes of data.

9855

"booleanValue": True or False, # boolean

9856

"floatValue": 3.14, # float

9857

"dayOfWeekValue": "A String", # day of week

9858

"timestampValue": "A String", # timestamp

9859

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9860

# and time zone are either specified elsewhere or are not significant. The date

9861

# is relative to the Proleptic Gregorian Calendar. This can represent:

9862

#

9863

# * A full date, with non-zero year, month and day values

9864

# * A month and day value, with a zero year, e.g. an anniversary

9865

# * A year on its own, with zero month and day values

9866

# * A year and month value, with a zero day, e.g. a credit card expiration date

9867

#

9868

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9869

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9870

# a year.

9871

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9872

# month and day.

9873

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9874

# if specifying a year by itself or a year and month where the day is not

9875

# significant.

9876

},

9877

"stringValue": "A String", # string

9878

"integerValue": "A String", # integer

9879

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9880

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9881

# types are google.type.Date and `google.protobuf.Timestamp`.

9882

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9883

# allow the value 60 if it allows leap-seconds.

9884

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9885

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9886

# to allow the value "24:00:00" for scenarios like business closing time.

9887

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

},

},

],

},

],

"headers": [ # Headers of the table.

9894

{ # General identifier of a data field in a storage service.

9895

"name": "A String", # Name describing the field.

9896

},

9897

],

9898

},

Bu Sun Kim

2019-06-14 16:50:42 -0700

[diff] [blame]

9899

},

Bu Sun Kim