Blame - docs/dyn/dlp_v2.projects.locations.deidentifyTemplates.html - platform/external/python/google-api-python-client

2020-07-22 17:02:09 -0700

[diff] [blame^]

78

<code><a href="#create">create(parent, body=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

79

<p class="firstline">Creates a DeidentifyTemplate for re-using frequently used configuration</p>

80

81

<code><a href="#delete">delete(name, x__xgafv=None)</a></code></p>

82

<p class="firstline">Deletes a DeidentifyTemplate.</p>

83

84

<code><a href="#get">get(name, x__xgafv=None)</a></code></p>

85

<p class="firstline">Gets a DeidentifyTemplate.</p>

86

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

87

<code><a href="#list">list(parent, pageSize=None, locationId=None, orderBy=None, pageToken=None, x__xgafv=None)</a></code></p>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

88

<p class="firstline">Lists DeidentifyTemplates.</p>

89

90

<code><a href="#list_next">list_next(previous_request, previous_response)</a></code></p>

91

<p class="firstline">Retrieves the next page of results.</p>

92

93

<code><a href="#patch">patch(name, body=None, x__xgafv=None)</a></code></p>

94

<p class="firstline">Updates the DeidentifyTemplate.</p>

95

<h3>Method Details</h3>

96

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

97

<code class="details" id="create">create(parent, body=None, x__xgafv=None)</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

98

<pre>Creates a DeidentifyTemplate for re-using frequently used configuration

99

for de-identifying content, images, and storage.

100

See https://cloud.google.com/dlp/docs/creating-templates-deid to learn

101

more.

102

103

Args:

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

104

parent: string, Required. Parent resource name.

105

- Format:projects/[PROJECT-ID]

106

- Format:organizations/[ORGANIZATION-ID]

107

- Format:projects/[PROJECT-ID]/locations/[LOCATION-ID]

108

- Format:organizations/[ORGANIZATION-ID]/locations/[LOCATION-ID] (required)

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

109

body: object, The request body.

110

The object takes the form of:

111

112

{ # Request message for CreateDeidentifyTemplate.

113

"templateId": "A String", # The template id can contain uppercase and lowercase letters,

114

# numbers, and hyphens; that is, it must match the regular

115

# expression: `[a-zA-Z\\d-_]+`. The maximum length is 100

116

# characters. Can be empty to allow the system to generate one.

117

"deidentifyTemplate": { # DeidentifyTemplates contains instructions on how to de-identify content. # Required. The DeidentifyTemplate to create.

118

# See https://cloud.google.com/dlp/docs/concepts-templates to learn more.

119

"name": "A String", # Output only. The template name.

120

#

121

# The template will have one of the following formats:

122

# `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR

123

# `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

124

"deidentifyConfig": { # The configuration that controls how the data will change. # ///////////// // The core content of the template // ///////////////

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

125

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text

126

# transformation everywhere.

127

# apply various `PrimitiveTransformation`s to each finding, where the

128

# transformation is applied to only values that were identified as a specific

129

# info_type.

130

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

131

# for a given infoType.

132

{ # A transformation to apply to text that is identified as a specific

133

# info_type.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

134

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

135

# this transformation to apply to all findings that correspond to

136

# infoTypes that were requested in `InspectConfig`.

137

{ # Type of information detected by the API.

138

"name": "A String", # Name of the information type. Either a name of your choosing when

139

# creating a CustomInfoType, or one of the names listed

140

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

141

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

142

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

143

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

144

],

145

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

146

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

147

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

148

# to learn more.

149

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

150

# If set, must also set cryptoKey. If set, shift will be consistent for the

151

# given context.

152

"name": "A String", # Name describing the field.

153

},

154

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

155

# range (inclusive ends). Negative means shift to earlier in time. Must not

156

# be more than 365250 days (1000 years) each direction.

157

#

158

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

159

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

160

# results in the same shift for the same context and crypto_key. If

161

# set, must also set context. Can only be applied to table items.

162

# a key encryption key (KEK) stored by KMS).

163

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

164

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

165

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

166

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

167

# It will be discarded after the request finishes.

168

"name": "A String", # Required. Name of the key.

169

# This is an arbitrary string used to differentiate different keys.

170

# A unique key is generated per name: two separate `TransientCryptoKey`

171

# protos share the same generated key if their names are the same.

172

# When the data crypto key is generated, this name is not used in any way

173

# (repeating the api call will result in a different key being generated).

174

},

175

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

176

# The wrapped key must be a 128/192/256 bit key.

177

# Authorization requires the following IAM permissions when sending a request

178

# to perform a crypto transformation using a kms-wrapped crypto key:

179

# dlp.kms.encrypt

180

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

181

"wrappedKey": "A String", # Required. The wrapped data crypto key.

182

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

183

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

184

# leaking the key. Choose another type of key if possible.

185

"key": "A String", # Required. A 128/192/256 bit key.

186

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

187

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

188

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

189

},

190

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

191

# portion of the value.

192

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

193

},

194

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

195

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

196

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

197

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

198

# Note that for the purposes of inspection or transformation, the number

199

# of bytes considered to comprise a 'Value' is based on its representation

200

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

201

# 123456789, the number of bytes would be counted as 9, even though an

202

# int64 only holds up to 8 bytes of data.

203

"integerValue": "A String", # integer

204

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

205

# or are specified elsewhere. An API may choose to allow leap seconds. Related

206

# types are google.type.Date and `google.protobuf.Timestamp`.

207

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

208

# allow the value 60 if it allows leap-seconds.

209

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

210

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

211

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

212

# to allow the value "24:00:00" for scenarios like business closing time.

213

},

214

"dayOfWeekValue": "A String", # day of week

215

"floatValue": 3.14, # float

216

"stringValue": "A String", # string

217

"timestampValue": "A String", # timestamp

218

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

219

# and time zone are either specified elsewhere or are not significant. The date

220

# is relative to the Proleptic Gregorian Calendar. This can represent:

221

#

222

# * A full date, with non-zero year, month and day values

223

# * A month and day value, with a zero year, e.g. an anniversary

224

# * A year on its own, with zero month and day values

225

# * A year and month value, with a zero day, e.g. a credit card expiration date

226

#

227

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

228

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

229

# month and day.

230

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

231

# a year.

232

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

233

# if specifying a year by itself or a year and month where the day is not

234

# significant.

235

},

236

"booleanValue": True or False, # boolean

237

},

238

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

239

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

240

# Uses SHA-256.

241

# The key size must be either 32 or 64 bytes.

242

# Outputs a base64 encoded representation of the hashed output

243

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

244

# Currently, only string and integer values can be hashed.

245

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

246

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

247

# a key encryption key (KEK) stored by KMS).

248

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

249

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

250

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

251

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

252

# It will be discarded after the request finishes.

253

"name": "A String", # Required. Name of the key.

254

# This is an arbitrary string used to differentiate different keys.

255

# A unique key is generated per name: two separate `TransientCryptoKey`

256

# protos share the same generated key if their names are the same.

257

# When the data crypto key is generated, this name is not used in any way

258

# (repeating the api call will result in a different key being generated).

259

},

260

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

261

# The wrapped key must be a 128/192/256 bit key.

262

# Authorization requires the following IAM permissions when sending a request

263

# to perform a crypto transformation using a kms-wrapped crypto key:

264

# dlp.kms.encrypt

265

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

266

"wrappedKey": "A String", # Required. The wrapped data crypto key.

267

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

268

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

269

# leaking the key. Choose another type of key if possible.

270

"key": "A String", # Required. A 128/192/256 bit key.

271

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

272

},

273

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

274

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

275

# fixed character. Masking can start from the beginning or end of the string.

276

# This can be used on data of any type (numbers, longs, and so on) and when

277

# de-identifying structured data we'll attempt to preserve the original data's

278

# type. (This allows you to take a long like 123 and modify it to a string like

279

# **3.

280

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

281

# characters. For example, if the input string is `555-555-5555` and you

282

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

283

# returns `***-**5-5555`.

284

{ # Characters to skip when doing deidentification of a value. These will be left

285

# alone and skipped.

286

"charactersToSkip": "A String", # Characters to not transform when masking.

287

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

292

# masked. Skipped characters do not count towards this tally.

293

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

294

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

295

# code or credit card number. This string must have a length of 1. If not

296

# supplied, this value defaults to `*` for strings, and `0` for digits.

297

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

298

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

299

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

300

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

301

# is `true`, then the string `12345` is masked as `12***`.

302

},

303

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

304

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

305

# output would be 'My phone number is '.

306

},

307

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

308

# Bucketing transformation can provide all of this functionality,

309

# but requires more configuration. This message is provided as a convenience to

310

# the user for simple bucketing strategies.

311

#

312

# The transformed value will be a hyphenated string of

313

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

314

# all values that are within this bucket will be replaced with "10-20".

315

#

316

# This can be used on data of type: double, long.

317

#

318

# If the bound Value type differs from the type of data

319

# being transformed, we will first attempt converting the type of the data to

320

# be transformed to match the type of the bound before comparing.

321

#

322

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

323

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

324

# grouped together into a single bucket; for example if `upper_bound` = 89,

325

# then all values greater than 89 are replaced with the value "89+".

326

# Note that for the purposes of inspection or transformation, the number

327

# of bytes considered to comprise a 'Value' is based on its representation

328

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

329

# 123456789, the number of bytes would be counted as 9, even though an

330

# int64 only holds up to 8 bytes of data.

331

"integerValue": "A String", # integer

332

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

333

# or are specified elsewhere. An API may choose to allow leap seconds. Related

334

# types are google.type.Date and `google.protobuf.Timestamp`.

335

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

336

# allow the value 60 if it allows leap-seconds.

337

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

338

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

339

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

340

# to allow the value "24:00:00" for scenarios like business closing time.

341

},

342

"dayOfWeekValue": "A String", # day of week

343

"floatValue": 3.14, # float

344

"stringValue": "A String", # string

345

"timestampValue": "A String", # timestamp

346

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

347

# and time zone are either specified elsewhere or are not significant. The date

348

# is relative to the Proleptic Gregorian Calendar. This can represent:

349

#

350

# * A full date, with non-zero year, month and day values

351

# * A month and day value, with a zero year, e.g. an anniversary

352

# * A year on its own, with zero month and day values

353

# * A year and month value, with a zero day, e.g. a credit card expiration date

354

#

355

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

356

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

357

# month and day.

358

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

359

# a year.

360

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

361

# if specifying a year by itself or a year and month where the day is not

362

# significant.

363

},

364

"booleanValue": True or False, # boolean

365

},

366

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

367

# grouped together into a single bucket; for example if `lower_bound` = 10,

368

# then all values less than 10 are replaced with the value "-10".

369

# Note that for the purposes of inspection or transformation, the number

370

# of bytes considered to comprise a 'Value' is based on its representation

371

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

372

# 123456789, the number of bytes would be counted as 9, even though an

373

# int64 only holds up to 8 bytes of data.

374

"integerValue": "A String", # integer

375

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

376

# or are specified elsewhere. An API may choose to allow leap seconds. Related

377

# types are google.type.Date and `google.protobuf.Timestamp`.

378

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

379

# allow the value 60 if it allows leap-seconds.

380

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

381

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

382

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

383

# to allow the value "24:00:00" for scenarios like business closing time.

384

},

385

"dayOfWeekValue": "A String", # day of week

386

"floatValue": 3.14, # float

387

"stringValue": "A String", # string

388

"timestampValue": "A String", # timestamp

389

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

390

# and time zone are either specified elsewhere or are not significant. The date

391

# is relative to the Proleptic Gregorian Calendar. This can represent:

392

#

393

# * A full date, with non-zero year, month and day values

394

# * A month and day value, with a zero year, e.g. an anniversary

395

# * A year on its own, with zero month and day values

396

# * A year and month value, with a zero day, e.g. a credit card expiration date

397

#

398

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

399

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

400

# month and day.

401

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

402

# a year.

403

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

404

# if specifying a year by itself or a year and month where the day is not

405

# significant.

406

},

407

"booleanValue": True or False, # boolean

408

},

409

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

410

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

411

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

412

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

413

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

414

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

415

# (FPE) with the FFX mode of operation; however when used in the

416

# `ReidentifyContent` API method, it serves the opposite function by reversing

417

# the surrogate back into the original identifier. The identifier must be

418

# encoded as ASCII. For a given crypto key and context, the same identifier

419

# will be replaced with the same surrogate. Identifiers must be at least two

420

# characters long. In the case that the identifier is the empty string, it will

421

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

422

# more.

423

#

424

# Note: We recommend using CryptoDeterministicConfig for all use cases which

425

# do not require preserving the input alphabet space and size, plus warrant

426

# referential integrity.

427

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

428

# This annotation will be applied to the surrogate by prefixing it with

429

# the name of the custom infoType followed by the number of

430

# characters comprising the surrogate. The following scheme defines the

431

# format: info_type_name(surrogate_character_count):surrogate

432

#

433

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

434

# the surrogate is 'abc', the full replacement value

435

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

436

#

437

# This annotation identifies the surrogate when inspecting content using the

438

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

439

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

440

# This facilitates reversal of the surrogate when it occurs in free text.

441

#

442

# In order for inspection to work properly, the name of this infoType must

443

# not occur naturally anywhere in your data; otherwise, inspection may

444

# find a surrogate that does not correspond to an actual identifier.

445

# Therefore, choose your custom infoType name carefully after considering

446

# what your data looks like. One way to select a name that has a high chance

447

# of yielding reliable detection is to include one or more unicode characters

448

# that are highly improbable to exist in your data.

449

# For example, assuming your data is entered from a regular ASCII keyboard,

450

# the symbol with the hex code point 29DD might be used like so:

451

# ⧝MY_TOKEN_TYPE

452

"name": "A String", # Name of the information type. Either a name of your choosing when

453

# creating a CustomInfoType, or one of the names listed

454

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

455

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

456

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

457

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

458

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

459

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

460

# identifier in two different contexts won't be given the same surrogate. If

461

# the context is not set, a default tweak will be used.

462

#

463

# If the context is set but:

464

#

465

# 1. there is no record present when transforming a given value or

466

# 1. the field is not present when transforming a given value,

467

#

468

# a default tweak will be used.

469

#

470

# Note that case (1) is expected when an `InfoTypeTransformation` is

471

# applied to both structured and non-structured `ContentItem`s.

472

# Currently, the referenced field may be of value type integer or string.

473

#

474

# The tweak is constructed as a sequence of bytes in big endian byte order

475

# such that:

476

#

477

# - a 64 bit integer is encoded followed by a single byte of value 1

478

# - a string is encoded in UTF-8 format followed by a single byte of value 2

479

"name": "A String", # Name describing the field.

480

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

481

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

482

# that the FFX mode natively supports. This happens before/after

483

# encryption/decryption.

484

# Each character listed must appear only once.

485

# Number of characters must be in the range [2, 95].

486

# This must be encoded as ASCII.

487

# The order of characters does not matter.

488

# The full list of allowed characters is:

489

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

490

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

491

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

492

# a key encryption key (KEK) stored by KMS).

493

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

494

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

495

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

496

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

497

# It will be discarded after the request finishes.

498

"name": "A String", # Required. Name of the key.

499

# This is an arbitrary string used to differentiate different keys.

500

# A unique key is generated per name: two separate `TransientCryptoKey`

501

# protos share the same generated key if their names are the same.

502

# When the data crypto key is generated, this name is not used in any way

503

# (repeating the api call will result in a different key being generated).

504

},

505

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

506

# The wrapped key must be a 128/192/256 bit key.

507

# Authorization requires the following IAM permissions when sending a request

508

# to perform a crypto transformation using a kms-wrapped crypto key:

509

# dlp.kms.encrypt

510

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

511

"wrappedKey": "A String", # Required. The wrapped data crypto key.

512

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

513

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

514

# leaking the key. Choose another type of key if possible.

515

"key": "A String", # Required. A 128/192/256 bit key.

516

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

517

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

518

"commonAlphabet": "A String", # Common alphabets.

519

},

520

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

521

# input. Outputs a base64 encoded representation of the encrypted output.

522

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

523

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

524

# referential integrity such that the same identifier in two different

525

# contexts will be given a distinct surrogate. The context is appended to

526

# plaintext value being encrypted. On decryption the provided context is

527

# validated against the value used during encryption. If a context was

528

# provided during encryption, same context must be provided during decryption

529

# as well.

530

#

531

# If the context is not set, plaintext would be used as is for encryption.

532

# If the context is set but:

533

#

534

# 1. there is no record present when transforming a given value or

535

# 2. the field is not present when transforming a given value,

536

#

537

# plaintext would be used as is for encryption.

538

#

539

# Note that case (1) is expected when an `InfoTypeTransformation` is

540

# applied to both structured and non-structured `ContentItem`s.

541

"name": "A String", # Name describing the field.

542

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

543

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

544

# This annotation will be applied to the surrogate by prefixing it with

545

# the name of the custom info type followed by the number of

546

# characters comprising the surrogate. The following scheme defines the

547

# format: {info type name}({surrogate character count}):{surrogate}

548

#

549

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

550

# the surrogate is 'abc', the full replacement value

551

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

552

#

553

# This annotation identifies the surrogate when inspecting content using the

554

# custom info type 'Surrogate'. This facilitates reversal of the

555

# surrogate when it occurs in free text.

556

#

557

# Note: For record transformations where the entire cell in a table is being

558

# transformed, surrogates are not mandatory. Surrogates are used to denote

559

# the location of the token and are necessary for re-identification in free

560

# form text.

561

#

562

# In order for inspection to work properly, the name of this info type must

563

# not occur naturally anywhere in your data; otherwise, inspection may either

564

#

565

# - reverse a surrogate that does not correspond to an actual identifier

566

# - be unable to parse the surrogate and result in an error

567

#

568

# Therefore, choose your custom info type name carefully after considering

569

# what your data looks like. One way to select a name that has a high chance

570

# of yielding reliable detection is to include one or more unicode characters

571

# that are highly improbable to exist in your data.

572

# For example, assuming your data is entered from a regular ASCII keyboard,

573

# the symbol with the hex code point 29DD might be used like so:

574

# ⧝MY_TOKEN_TYPE.

575

"name": "A String", # Name of the information type. Either a name of your choosing when

576

# creating a CustomInfoType, or one of the names listed

577

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

578

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

579

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

580

},

581

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

582

# a key encryption key (KEK) stored by KMS).

583

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

584

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

585

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

586

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

587

# It will be discarded after the request finishes.

588

"name": "A String", # Required. Name of the key.

589

# This is an arbitrary string used to differentiate different keys.

590

# A unique key is generated per name: two separate `TransientCryptoKey`

591

# protos share the same generated key if their names are the same.

592

# When the data crypto key is generated, this name is not used in any way

593

# (repeating the api call will result in a different key being generated).

594

},

595

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

596

# The wrapped key must be a 128/192/256 bit key.

597

# Authorization requires the following IAM permissions when sending a request

598

# to perform a crypto transformation using a kms-wrapped crypto key:

599

# dlp.kms.encrypt

600

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

601

"wrappedKey": "A String", # Required. The wrapped data crypto key.

602

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

603

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

604

# leaking the key. Choose another type of key if possible.

605

"key": "A String", # Required. A 128/192/256 bit key.

606

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

607

},

608

},

609

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

610

# replacement values are dynamically provided by the user for custom behavior,

611

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

612

# This can be used on

613

# data of type: number, long, string, timestamp.

614

# If the bound `Value` type differs from the type of data being transformed, we

615

# will first attempt converting the type of the data to be transformed to match

616

# the type of the bound before comparing.

617

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

618

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

619

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

620

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

621

# Note that for the purposes of inspection or transformation, the number

622

# of bytes considered to comprise a 'Value' is based on its representation

623

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

624

# 123456789, the number of bytes would be counted as 9, even though an

625

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

626

"integerValue": "A String", # integer

627

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

628

# or are specified elsewhere. An API may choose to allow leap seconds. Related

629

# types are google.type.Date and `google.protobuf.Timestamp`.

630

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

631

# allow the value 60 if it allows leap-seconds.

632

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

633

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

634

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

635

# to allow the value "24:00:00" for scenarios like business closing time.

636

},

637

"dayOfWeekValue": "A String", # day of week

638

"floatValue": 3.14, # float

639

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

640

"timestampValue": "A String", # timestamp

641

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

642

# and time zone are either specified elsewhere or are not significant. The date

643

# is relative to the Proleptic Gregorian Calendar. This can represent:

644

#

645

# * A full date, with non-zero year, month and day values

646

# * A month and day value, with a zero year, e.g. an anniversary

647

# * A year on its own, with zero month and day values

648

# * A year and month value, with a zero day, e.g. a credit card expiration date

649

#

650

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

651

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

652

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

653

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

654

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

655

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

656

# if specifying a year by itself or a year and month where the day is not

657

# significant.

658

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

659

"booleanValue": True or False, # boolean

660

},

661

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

662

# Note that for the purposes of inspection or transformation, the number

663

# of bytes considered to comprise a 'Value' is based on its representation

664

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

665

# 123456789, the number of bytes would be counted as 9, even though an

666

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

667

"integerValue": "A String", # integer

668

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

669

# or are specified elsewhere. An API may choose to allow leap seconds. Related

670

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

671

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

672

# allow the value 60 if it allows leap-seconds.

673

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

674

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

675

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

676

# to allow the value "24:00:00" for scenarios like business closing time.

677

},

678

"dayOfWeekValue": "A String", # day of week

679

"floatValue": 3.14, # float

680

"stringValue": "A String", # string

681

"timestampValue": "A String", # timestamp

682

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

683

# and time zone are either specified elsewhere or are not significant. The date

684

# is relative to the Proleptic Gregorian Calendar. This can represent:

685

#

686

# * A full date, with non-zero year, month and day values

687

# * A month and day value, with a zero year, e.g. an anniversary

688

# * A year on its own, with zero month and day values

689

# * A year and month value, with a zero day, e.g. a credit card expiration date

690

#

691

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

692

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

693

# month and day.

694

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

695

# a year.

696

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

697

# if specifying a year by itself or a year and month where the day is not

698

# significant.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

699

},

700

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

701

},

702

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

703

# used.

704

# Note that for the purposes of inspection or transformation, the number

705

# of bytes considered to comprise a 'Value' is based on its representation

706

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

707

# 123456789, the number of bytes would be counted as 9, even though an

708

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

709

"integerValue": "A String", # integer

710

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

711

# or are specified elsewhere. An API may choose to allow leap seconds. Related

712

# types are google.type.Date and `google.protobuf.Timestamp`.

713

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

714

# allow the value 60 if it allows leap-seconds.

715

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

716

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

717

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

718

# to allow the value "24:00:00" for scenarios like business closing time.

719

},

720

"dayOfWeekValue": "A String", # day of week

721

"floatValue": 3.14, # float

722

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

723

"timestampValue": "A String", # timestamp

724

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

725

# and time zone are either specified elsewhere or are not significant. The date

726

# is relative to the Proleptic Gregorian Calendar. This can represent:

727

#

728

# * A full date, with non-zero year, month and day values

729

# * A month and day value, with a zero year, e.g. an anniversary

730

# * A year on its own, with zero month and day values

731

# * A year and month value, with a zero day, e.g. a credit card expiration date

732

#

733

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

734

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

735

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

736

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

737

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

738

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

739

# if specifying a year by itself or a year and month where the day is not

740

# significant.

741

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

742

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

747

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

748

},

749

],

750

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

751

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default

752

# mode is `TransformationErrorHandling.ThrowError`.

753

# transformation error occurs when the requested transformation is incompatible

754

# with the data. For example, trying to de-identify an IP address using a

755

# `DateShift` transformation would result in a transformation error, since date

756

# info cannot be extracted from an IP address.

757

# Information about any incompatible transformations, and how they were

758

# handled, is returned in the response as part of the

759

# `TransformationOverviews`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

760

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would # Ignore errors

761

# cause an error. For example, if a `DateShift` transformation were applied

762

# an an IP address, this mode would leave the IP address unchanged in the

763

# response.

764

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

765

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

766

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

767

},

768

"recordTransformations": { # A type of transformation that is applied over structured data such as a # Treat the dataset as structured. Transformations can be applied to

769

# specific locations within structured datasets, such as transforming

770

# a column within a table.

771

# table.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

772

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that

773

# match any suppression rule are omitted from the output.

774

{ # Configuration to suppress records whose suppression conditions evaluate to

775

# true.

776

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

777

# evaluated to be suppressed from the transformed content.

778

# a field.

779

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

780

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

781

"conditions": [ # A collection of conditions.

782

{ # The field type of `value` and `field` do not need to match to be

783

# considered equal, but not all comparisons are possible.

784

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

785

# but all other comparisons are invalid with incompatible types.

786

# A `value` of type:

787

#

788

# - `string` can be compared against all other types

789

# - `boolean` can only be compared against other booleans

790

# - `integer` can be compared against doubles or a string if the string value

791

# can be parsed as an integer.

792

# - `double` can be compared against integers or a string if the string can

793

# be parsed as a double.

794

# - `Timestamp` can be compared against strings in RFC 3339 date string

795

# format.

796

# - `TimeOfDay` can be compared against timestamps and strings in the format

797

# of 'HH:mm:ss'.

798

#

799

# If we fail to compare do to type mismatch, a warning will be given and

800

# the condition will evaluate to false.

801

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

802

"name": "A String", # Name describing the field.

803

},

804

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

805

# Note that for the purposes of inspection or transformation, the number

806

# of bytes considered to comprise a 'Value' is based on its representation

807

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

808

# 123456789, the number of bytes would be counted as 9, even though an

809

# int64 only holds up to 8 bytes of data.

810

"integerValue": "A String", # integer

811

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

812

# or are specified elsewhere. An API may choose to allow leap seconds. Related

813

# types are google.type.Date and `google.protobuf.Timestamp`.

814

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

815

# allow the value 60 if it allows leap-seconds.

816

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

817

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

818

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

819

# to allow the value "24:00:00" for scenarios like business closing time.

820

},

821

"dayOfWeekValue": "A String", # day of week

822

"floatValue": 3.14, # float

823

"stringValue": "A String", # string

824

"timestampValue": "A String", # timestamp

825

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

826

# and time zone are either specified elsewhere or are not significant. The date

827

# is relative to the Proleptic Gregorian Calendar. This can represent:

828

#

829

# * A full date, with non-zero year, month and day values

830

# * A month and day value, with a zero year, e.g. an anniversary

831

# * A year on its own, with zero month and day values

832

# * A year and month value, with a zero day, e.g. a credit card expiration date

833

#

834

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

835

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

836

# month and day.

837

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

838

# a year.

839

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

840

# if specifying a year by itself or a year and month where the day is not

841

# significant.

842

},

843

"booleanValue": True or False, # boolean

844

},

845

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

},

],

},

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

850

# only supported value is `AND`.

},

},

},

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

855

"fieldTransformations": [ # Transform the record by applying various field transformations.

856

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

857

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

858

# transform content that matches an `InfoType`.

859

# apply various `PrimitiveTransformation`s to each finding, where the

860

# transformation is applied to only values that were identified as a specific

861

# info_type.

862

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

863

# for a given infoType.

864

{ # A transformation to apply to text that is identified as a specific

865

# info_type.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

866

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

867

# this transformation to apply to all findings that correspond to

868

# infoTypes that were requested in `InspectConfig`.

869

{ # Type of information detected by the API.

870

"name": "A String", # Name of the information type. Either a name of your choosing when

871

# creating a CustomInfoType, or one of the names listed

872

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

873

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

874

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

875

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

876

],

877

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

878

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

879

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

880

# to learn more.

881

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

882

# If set, must also set cryptoKey. If set, shift will be consistent for the

883

# given context.

884

"name": "A String", # Name describing the field.

885

},

886

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

887

# range (inclusive ends). Negative means shift to earlier in time. Must not

888

# be more than 365250 days (1000 years) each direction.

889

#

890

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

891

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

892

# results in the same shift for the same context and crypto_key. If

893

# set, must also set context. Can only be applied to table items.

894

# a key encryption key (KEK) stored by KMS).

895

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

896

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

897

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

898

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

899

# It will be discarded after the request finishes.

900

"name": "A String", # Required. Name of the key.

901

# This is an arbitrary string used to differentiate different keys.

902

# A unique key is generated per name: two separate `TransientCryptoKey`

903

# protos share the same generated key if their names are the same.

904

# When the data crypto key is generated, this name is not used in any way

905

# (repeating the api call will result in a different key being generated).

906

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

907

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

908

# The wrapped key must be a 128/192/256 bit key.

909

# Authorization requires the following IAM permissions when sending a request

910

# to perform a crypto transformation using a kms-wrapped crypto key:

911

# dlp.kms.encrypt

912

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

913

"wrappedKey": "A String", # Required. The wrapped data crypto key.

914

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

915

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

916

# leaking the key. Choose another type of key if possible.

917

"key": "A String", # Required. A 128/192/256 bit key.

918

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

919

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

920

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

921

},

922

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

923

# portion of the value.

924

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

925

},

926

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

927

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

928

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

929

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

930

# Note that for the purposes of inspection or transformation, the number

931

# of bytes considered to comprise a 'Value' is based on its representation

932

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

933

# 123456789, the number of bytes would be counted as 9, even though an

934

# int64 only holds up to 8 bytes of data.

935

"integerValue": "A String", # integer

936

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

937

# or are specified elsewhere. An API may choose to allow leap seconds. Related

938

# types are google.type.Date and `google.protobuf.Timestamp`.

939

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

940

# allow the value 60 if it allows leap-seconds.

941

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

942

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

943

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

944

# to allow the value "24:00:00" for scenarios like business closing time.

945

},

946

"dayOfWeekValue": "A String", # day of week

947

"floatValue": 3.14, # float

948

"stringValue": "A String", # string

949

"timestampValue": "A String", # timestamp

950

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

951

# and time zone are either specified elsewhere or are not significant. The date

952

# is relative to the Proleptic Gregorian Calendar. This can represent:

953

#

954

# * A full date, with non-zero year, month and day values

955

# * A month and day value, with a zero year, e.g. an anniversary

956

# * A year on its own, with zero month and day values

957

# * A year and month value, with a zero day, e.g. a credit card expiration date

958

#

959

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

960

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

961

# month and day.

962

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

963

# a year.

964

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

965

# if specifying a year by itself or a year and month where the day is not

966

# significant.

967

},

968

"booleanValue": True or False, # boolean

969

},

970

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

971

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

972

# Uses SHA-256.

973

# The key size must be either 32 or 64 bytes.

974

# Outputs a base64 encoded representation of the hashed output

975

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

976

# Currently, only string and integer values can be hashed.

977

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

978

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

979

# a key encryption key (KEK) stored by KMS).

980

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

981

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

982

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

983

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

984

# It will be discarded after the request finishes.

985

"name": "A String", # Required. Name of the key.

986

# This is an arbitrary string used to differentiate different keys.

987

# A unique key is generated per name: two separate `TransientCryptoKey`

988

# protos share the same generated key if their names are the same.

989

# When the data crypto key is generated, this name is not used in any way

990

# (repeating the api call will result in a different key being generated).

991

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

992

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

993

# The wrapped key must be a 128/192/256 bit key.

994

# Authorization requires the following IAM permissions when sending a request

995

# to perform a crypto transformation using a kms-wrapped crypto key:

996

# dlp.kms.encrypt

997

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

998

"wrappedKey": "A String", # Required. The wrapped data crypto key.

999

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1000

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1001

# leaking the key. Choose another type of key if possible.

1002

"key": "A String", # Required. A 128/192/256 bit key.

1003

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1004

},

1005

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1006

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

1007

# fixed character. Masking can start from the beginning or end of the string.

1008

# This can be used on data of any type (numbers, longs, and so on) and when

1009

# de-identifying structured data we'll attempt to preserve the original data's

1010

# type. (This allows you to take a long like 123 and modify it to a string like

1011

# **3.

1012

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

1013

# characters. For example, if the input string is `555-555-5555` and you

1014

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

1015

# returns `***-**5-5555`.

1016

{ # Characters to skip when doing deidentification of a value. These will be left

1017

# alone and skipped.

1018

"charactersToSkip": "A String", # Characters to not transform when masking.

1019

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

1024

# masked. Skipped characters do not count towards this tally.

1025

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

1026

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

1027

# code or credit card number. This string must have a length of 1. If not

1028

# supplied, this value defaults to `*` for strings, and `0` for digits.

1029

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

1030

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

1031

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

1032

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

1033

# is `true`, then the string `12345` is masked as `12***`.

1034

},

1035

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

1036

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

1037

# output would be 'My phone number is '.

1038

},

1039

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

1040

# Bucketing transformation can provide all of this functionality,

1041

# but requires more configuration. This message is provided as a convenience to

1042

# the user for simple bucketing strategies.

1043

#

1044

# The transformed value will be a hyphenated string of

1045

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

1046

# all values that are within this bucket will be replaced with "10-20".

1047

#

1048

# This can be used on data of type: double, long.

1049

#

1050

# If the bound Value type differs from the type of data

1051

# being transformed, we will first attempt converting the type of the data to

1052

# be transformed to match the type of the bound before comparing.

1053

#

1054

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

1055

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

1056

# grouped together into a single bucket; for example if `upper_bound` = 89,

1057

# then all values greater than 89 are replaced with the value "89+".

1058

# Note that for the purposes of inspection or transformation, the number

1059

# of bytes considered to comprise a 'Value' is based on its representation

1060

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1061

# 123456789, the number of bytes would be counted as 9, even though an

1062

# int64 only holds up to 8 bytes of data.

1063

"integerValue": "A String", # integer

1064

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1065

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1066

# types are google.type.Date and `google.protobuf.Timestamp`.

1067

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1068

# allow the value 60 if it allows leap-seconds.

1069

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1070

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1071

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1072

# to allow the value "24:00:00" for scenarios like business closing time.

1073

},

1074

"dayOfWeekValue": "A String", # day of week

1075

"floatValue": 3.14, # float

1076

"stringValue": "A String", # string

1077

"timestampValue": "A String", # timestamp

1078

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1079

# and time zone are either specified elsewhere or are not significant. The date

1080

# is relative to the Proleptic Gregorian Calendar. This can represent:

1081

#

1082

# * A full date, with non-zero year, month and day values

1083

# * A month and day value, with a zero year, e.g. an anniversary

1084

# * A year on its own, with zero month and day values

1085

# * A year and month value, with a zero day, e.g. a credit card expiration date

1086

#

1087

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1088

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1089

# month and day.

1090

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1091

# a year.

1092

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1093

# if specifying a year by itself or a year and month where the day is not

1094

# significant.

1095

},

1096

"booleanValue": True or False, # boolean

1097

},

1098

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

1099

# grouped together into a single bucket; for example if `lower_bound` = 10,

1100

# then all values less than 10 are replaced with the value "-10".

1101

# Note that for the purposes of inspection or transformation, the number

1102

# of bytes considered to comprise a 'Value' is based on its representation

1103

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1104

# 123456789, the number of bytes would be counted as 9, even though an

1105

# int64 only holds up to 8 bytes of data.

1106

"integerValue": "A String", # integer

1107

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1108

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1109

# types are google.type.Date and `google.protobuf.Timestamp`.

1110

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1111

# allow the value 60 if it allows leap-seconds.

1112

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1113

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1114

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1115

# to allow the value "24:00:00" for scenarios like business closing time.

1116

},

1117

"dayOfWeekValue": "A String", # day of week

1118

"floatValue": 3.14, # float

1119

"stringValue": "A String", # string

1120

"timestampValue": "A String", # timestamp

1121

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1122

# and time zone are either specified elsewhere or are not significant. The date

1123

# is relative to the Proleptic Gregorian Calendar. This can represent:

1124

#

1125

# * A full date, with non-zero year, month and day values

1126

# * A month and day value, with a zero year, e.g. an anniversary

1127

# * A year on its own, with zero month and day values

1128

# * A year and month value, with a zero day, e.g. a credit card expiration date

1129

#

1130

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1131

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1132

# month and day.

1133

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1134

# a year.

1135

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1136

# if specifying a year by itself or a year and month where the day is not

1137

# significant.

1138

},

1139

"booleanValue": True or False, # boolean

1140

},

1141

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

1142

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

1143

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

1144

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

1145

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1146

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

1147

# (FPE) with the FFX mode of operation; however when used in the

1148

# `ReidentifyContent` API method, it serves the opposite function by reversing

1149

# the surrogate back into the original identifier. The identifier must be

1150

# encoded as ASCII. For a given crypto key and context, the same identifier

1151

# will be replaced with the same surrogate. Identifiers must be at least two

1152

# characters long. In the case that the identifier is the empty string, it will

1153

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

1154

# more.

1155

#

1156

# Note: We recommend using CryptoDeterministicConfig for all use cases which

1157

# do not require preserving the input alphabet space and size, plus warrant

1158

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1159

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

1160

# This annotation will be applied to the surrogate by prefixing it with

1161

# the name of the custom infoType followed by the number of

1162

# characters comprising the surrogate. The following scheme defines the

1163

# format: info_type_name(surrogate_character_count):surrogate

1164

#

1165

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

1166

# the surrogate is 'abc', the full replacement value

1167

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1168

#

1169

# This annotation identifies the surrogate when inspecting content using the

1170

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1171

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1172

# This facilitates reversal of the surrogate when it occurs in free text.

1173

#

1174

# In order for inspection to work properly, the name of this infoType must

1175

# not occur naturally anywhere in your data; otherwise, inspection may

1176

# find a surrogate that does not correspond to an actual identifier.

1177

# Therefore, choose your custom infoType name carefully after considering

1178

# what your data looks like. One way to select a name that has a high chance

1179

# of yielding reliable detection is to include one or more unicode characters

1180

# that are highly improbable to exist in your data.

1181

# For example, assuming your data is entered from a regular ASCII keyboard,

1182

# the symbol with the hex code point 29DD might be used like so:

1183

# ⧝MY_TOKEN_TYPE

1184

"name": "A String", # Name of the information type. Either a name of your choosing when

1185

# creating a CustomInfoType, or one of the names listed

1186

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1187

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

1188

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1189

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1190

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1191

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

1192

# identifier in two different contexts won't be given the same surrogate. If

1193

# the context is not set, a default tweak will be used.

1194

#

1195

# If the context is set but:

1196

#

1197

# 1. there is no record present when transforming a given value or

1198

# 1. the field is not present when transforming a given value,

1199

#

1200

# a default tweak will be used.

1201

#

1202

# Note that case (1) is expected when an `InfoTypeTransformation` is

1203

# applied to both structured and non-structured `ContentItem`s.

1204

# Currently, the referenced field may be of value type integer or string.

1205

#

1206

# The tweak is constructed as a sequence of bytes in big endian byte order

1207

# such that:

1208

#

1209

# - a 64 bit integer is encoded followed by a single byte of value 1

1210

# - a string is encoded in UTF-8 format followed by a single byte of value 2

1211

"name": "A String", # Name describing the field.

1212

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1213

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

1214

# that the FFX mode natively supports. This happens before/after

1215

# encryption/decryption.

1216

# Each character listed must appear only once.

1217

# Number of characters must be in the range [2, 95].

1218

# This must be encoded as ASCII.

1219

# The order of characters does not matter.

1220

# The full list of allowed characters is:

1221

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

1222

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1223

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

1224

# a key encryption key (KEK) stored by KMS).

1225

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1226

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1227

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1228

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1229

# It will be discarded after the request finishes.

1230

"name": "A String", # Required. Name of the key.

1231

# This is an arbitrary string used to differentiate different keys.

1232

# A unique key is generated per name: two separate `TransientCryptoKey`

1233

# protos share the same generated key if their names are the same.

1234

# When the data crypto key is generated, this name is not used in any way

1235

# (repeating the api call will result in a different key being generated).

1236

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1237

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1238

# The wrapped key must be a 128/192/256 bit key.

1239

# Authorization requires the following IAM permissions when sending a request

1240

# to perform a crypto transformation using a kms-wrapped crypto key:

1241

# dlp.kms.encrypt

1242

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1243

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1244

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1245

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1246

# leaking the key. Choose another type of key if possible.

1247

"key": "A String", # Required. A 128/192/256 bit key.

1248

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1249

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1250

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1251

},

1252

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

1253

# input. Outputs a base64 encoded representation of the encrypted output.

1254

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1255

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

1256

# referential integrity such that the same identifier in two different

1257

# contexts will be given a distinct surrogate. The context is appended to

1258

# plaintext value being encrypted. On decryption the provided context is

1259

# validated against the value used during encryption. If a context was

1260

# provided during encryption, same context must be provided during decryption

1261

# as well.

1262

#

1263

# If the context is not set, plaintext would be used as is for encryption.

1264

# If the context is set but:

1265

#

1266

# 1. there is no record present when transforming a given value or

1267

# 2. the field is not present when transforming a given value,

1268

#

1269

# plaintext would be used as is for encryption.

1270

#

1271

# Note that case (1) is expected when an `InfoTypeTransformation` is

1272

# applied to both structured and non-structured `ContentItem`s.

1273

"name": "A String", # Name describing the field.

1274

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1275

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

1276

# This annotation will be applied to the surrogate by prefixing it with

1277

# the name of the custom info type followed by the number of

1278

# characters comprising the surrogate. The following scheme defines the

1279

# format: {info type name}({surrogate character count}):{surrogate}

1280

#

1281

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

1282

# the surrogate is 'abc', the full replacement value

1283

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1284

#

1285

# This annotation identifies the surrogate when inspecting content using the

1286

# custom info type 'Surrogate'. This facilitates reversal of the

1287

# surrogate when it occurs in free text.

1288

#

1289

# Note: For record transformations where the entire cell in a table is being

1290

# transformed, surrogates are not mandatory. Surrogates are used to denote

1291

# the location of the token and are necessary for re-identification in free

1292

# form text.

1293

#

1294

# In order for inspection to work properly, the name of this info type must

1295

# not occur naturally anywhere in your data; otherwise, inspection may either

1296

#

1297

# - reverse a surrogate that does not correspond to an actual identifier

1298

# - be unable to parse the surrogate and result in an error

1299

#

1300

# Therefore, choose your custom info type name carefully after considering

1301

# what your data looks like. One way to select a name that has a high chance

1302

# of yielding reliable detection is to include one or more unicode characters

1303

# that are highly improbable to exist in your data.

1304

# For example, assuming your data is entered from a regular ASCII keyboard,

1305

# the symbol with the hex code point 29DD might be used like so:

1306

# ⧝MY_TOKEN_TYPE.

1307

"name": "A String", # Name of the information type. Either a name of your choosing when

1308

# creating a CustomInfoType, or one of the names listed

1309

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1310

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

1311

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1312

},

1313

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

1314

# a key encryption key (KEK) stored by KMS).

1315

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1316

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1317

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1318

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1319

# It will be discarded after the request finishes.

1320

"name": "A String", # Required. Name of the key.

1321

# This is an arbitrary string used to differentiate different keys.

1322

# A unique key is generated per name: two separate `TransientCryptoKey`

1323

# protos share the same generated key if their names are the same.

1324

# When the data crypto key is generated, this name is not used in any way

1325

# (repeating the api call will result in a different key being generated).

1326

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1327

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1328

# The wrapped key must be a 128/192/256 bit key.

1329

# Authorization requires the following IAM permissions when sending a request

1330

# to perform a crypto transformation using a kms-wrapped crypto key:

1331

# dlp.kms.encrypt

1332

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1333

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1334

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1335

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1336

# leaking the key. Choose another type of key if possible.

1337

"key": "A String", # Required. A 128/192/256 bit key.

1338

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1339

},

1340

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1341

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

1342

# replacement values are dynamically provided by the user for custom behavior,

1343

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

1344

# This can be used on

1345

# data of type: number, long, string, timestamp.

1346

# If the bound `Value` type differs from the type of data being transformed, we

1347

# will first attempt converting the type of the data to be transformed to match

1348

# the type of the bound before comparing.

1349

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

1350

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

1351

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1352

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1353

# Note that for the purposes of inspection or transformation, the number

1354

# of bytes considered to comprise a 'Value' is based on its representation

1355

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1356

# 123456789, the number of bytes would be counted as 9, even though an

1357

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1358

"integerValue": "A String", # integer

1359

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1360

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1361

# types are google.type.Date and `google.protobuf.Timestamp`.

1362

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1363

# allow the value 60 if it allows leap-seconds.

1364

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1365

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1366

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1367

# to allow the value "24:00:00" for scenarios like business closing time.

1368

},

1369

"dayOfWeekValue": "A String", # day of week

1370

"floatValue": 3.14, # float

1371

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1372

"timestampValue": "A String", # timestamp

1373

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1374

# and time zone are either specified elsewhere or are not significant. The date

1375

# is relative to the Proleptic Gregorian Calendar. This can represent:

1376

#

1377

# * A full date, with non-zero year, month and day values

1378

# * A month and day value, with a zero year, e.g. an anniversary

1379

# * A year on its own, with zero month and day values

1380

# * A year and month value, with a zero day, e.g. a credit card expiration date

1381

#

1382

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1383

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1384

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1385

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1386

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1387

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1388

# if specifying a year by itself or a year and month where the day is not

1389

# significant.

1390

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1391

"booleanValue": True or False, # boolean

1392

},

1393

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

1394

# Note that for the purposes of inspection or transformation, the number

1395

# of bytes considered to comprise a 'Value' is based on its representation

1396

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1397

# 123456789, the number of bytes would be counted as 9, even though an

1398

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1399

"integerValue": "A String", # integer

1400

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1401

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1402

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1403

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1404

# allow the value 60 if it allows leap-seconds.

1405

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1406

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1407

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1408

# to allow the value "24:00:00" for scenarios like business closing time.

1409

},

1410

"dayOfWeekValue": "A String", # day of week

1411

"floatValue": 3.14, # float

1412

"stringValue": "A String", # string

1413

"timestampValue": "A String", # timestamp

1414

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1415

# and time zone are either specified elsewhere or are not significant. The date

1416

# is relative to the Proleptic Gregorian Calendar. This can represent:

1417

#

1418

# * A full date, with non-zero year, month and day values

1419

# * A month and day value, with a zero year, e.g. an anniversary

1420

# * A year on its own, with zero month and day values

1421

# * A year and month value, with a zero day, e.g. a credit card expiration date

1422

#

1423

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1424

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1425

# month and day.

1426

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1427

# a year.

1428

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1429

# if specifying a year by itself or a year and month where the day is not

1430

# significant.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1431

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1432

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1433

},

1434

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

1435

# used.

1436

# Note that for the purposes of inspection or transformation, the number

1437

# of bytes considered to comprise a 'Value' is based on its representation

1438

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1439

# 123456789, the number of bytes would be counted as 9, even though an

1440

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1441

"integerValue": "A String", # integer

1442

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1443

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1444

# types are google.type.Date and `google.protobuf.Timestamp`.

1445

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1446

# allow the value 60 if it allows leap-seconds.

1447

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1448

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1449

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1450

# to allow the value "24:00:00" for scenarios like business closing time.

1451

},

1452

"dayOfWeekValue": "A String", # day of week

1453

"floatValue": 3.14, # float

1454

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1455

"timestampValue": "A String", # timestamp

1456

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1457

# and time zone are either specified elsewhere or are not significant. The date

1458

# is relative to the Proleptic Gregorian Calendar. This can represent:

1459

#

1460

# * A full date, with non-zero year, month and day values

1461

# * A month and day value, with a zero year, e.g. an anniversary

1462

# * A year on its own, with zero month and day values

1463

# * A year and month value, with a zero day, e.g. a credit card expiration date

1464

#

1465

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1466

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1467

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1468

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1469

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1470

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1471

# if specifying a year by itself or a year and month where the day is not

1472

# significant.

1473

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1474

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1484

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

1485

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

1486

# to learn more.

1487

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

1488

# If set, must also set cryptoKey. If set, shift will be consistent for the

1489

# given context.

1490

"name": "A String", # Name describing the field.

1491

},

1492

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

1493

# range (inclusive ends). Negative means shift to earlier in time. Must not

1494

# be more than 365250 days (1000 years) each direction.

1495

#

1496

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1497

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

1498

# results in the same shift for the same context and crypto_key. If

1499

# set, must also set context. Can only be applied to table items.

1500

# a key encryption key (KEK) stored by KMS).

1501

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1502

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1503

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1504

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1505

# It will be discarded after the request finishes.

1506

"name": "A String", # Required. Name of the key.

1507

# This is an arbitrary string used to differentiate different keys.

1508

# A unique key is generated per name: two separate `TransientCryptoKey`

1509

# protos share the same generated key if their names are the same.

1510

# When the data crypto key is generated, this name is not used in any way

1511

# (repeating the api call will result in a different key being generated).

1512

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1513

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1514

# The wrapped key must be a 128/192/256 bit key.

1515

# Authorization requires the following IAM permissions when sending a request

1516

# to perform a crypto transformation using a kms-wrapped crypto key:

1517

# dlp.kms.encrypt

1518

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1519

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1520

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1521

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1522

# leaking the key. Choose another type of key if possible.

1523

"key": "A String", # Required. A 128/192/256 bit key.

1524

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1525

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1526

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

1527

},

1528

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

1529

# portion of the value.

1530

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1531

},

1532

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

1533

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1534

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

1535

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

1536

# Note that for the purposes of inspection or transformation, the number

1537

# of bytes considered to comprise a 'Value' is based on its representation

1538

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1539

# 123456789, the number of bytes would be counted as 9, even though an

1540

# int64 only holds up to 8 bytes of data.

1541

"integerValue": "A String", # integer

1542

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1543

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1544

# types are google.type.Date and `google.protobuf.Timestamp`.

1545

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1546

# allow the value 60 if it allows leap-seconds.

1547

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1548

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1549

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1550

# to allow the value "24:00:00" for scenarios like business closing time.

1551

},

1552

"dayOfWeekValue": "A String", # day of week

1553

"floatValue": 3.14, # float

1554

"stringValue": "A String", # string

1555

"timestampValue": "A String", # timestamp

1556

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1557

# and time zone are either specified elsewhere or are not significant. The date

1558

# is relative to the Proleptic Gregorian Calendar. This can represent:

1559

#

1560

# * A full date, with non-zero year, month and day values

1561

# * A month and day value, with a zero year, e.g. an anniversary

1562

# * A year on its own, with zero month and day values

1563

# * A year and month value, with a zero day, e.g. a credit card expiration date

1564

#

1565

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1566

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1567

# month and day.

1568

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1569

# a year.

1570

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1571

# if specifying a year by itself or a year and month where the day is not

1572

# significant.

1573

},

1574

"booleanValue": True or False, # boolean

1575

},

1576

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1577

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

1578

# Uses SHA-256.

1579

# The key size must be either 32 or 64 bytes.

1580

# Outputs a base64 encoded representation of the hashed output

1581

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

1582

# Currently, only string and integer values can be hashed.

1583

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

1584

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

1585

# a key encryption key (KEK) stored by KMS).

1586

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1587

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1588

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1589

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1590

# It will be discarded after the request finishes.

1591

"name": "A String", # Required. Name of the key.

1592

# This is an arbitrary string used to differentiate different keys.

1593

# A unique key is generated per name: two separate `TransientCryptoKey`

1594

# protos share the same generated key if their names are the same.

1595

# When the data crypto key is generated, this name is not used in any way

1596

# (repeating the api call will result in a different key being generated).

1597

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1598

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1599

# The wrapped key must be a 128/192/256 bit key.

1600

# Authorization requires the following IAM permissions when sending a request

1601

# to perform a crypto transformation using a kms-wrapped crypto key:

1602

# dlp.kms.encrypt

1603

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1604

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1605

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1606

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1607

# leaking the key. Choose another type of key if possible.

1608

"key": "A String", # Required. A 128/192/256 bit key.

1609

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1610

},

1611

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1612

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

1613

# fixed character. Masking can start from the beginning or end of the string.

1614

# This can be used on data of any type (numbers, longs, and so on) and when

1615

# de-identifying structured data we'll attempt to preserve the original data's

1616

# type. (This allows you to take a long like 123 and modify it to a string like

1617

# **3.

1618

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

1619

# characters. For example, if the input string is `555-555-5555` and you

1620

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

1621

# returns `***-**5-5555`.

1622

{ # Characters to skip when doing deidentification of a value. These will be left

1623

# alone and skipped.

1624

"charactersToSkip": "A String", # Characters to not transform when masking.

1625

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

1630

# masked. Skipped characters do not count towards this tally.

1631

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

1632

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

1633

# code or credit card number. This string must have a length of 1. If not

1634

# supplied, this value defaults to `*` for strings, and `0` for digits.

1635

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

1636

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

1637

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

1638

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

1639

# is `true`, then the string `12345` is masked as `12***`.

1640

},

1641

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

1642

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

1643

# output would be 'My phone number is '.

1644

},

1645

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

1646

# Bucketing transformation can provide all of this functionality,

1647

# but requires more configuration. This message is provided as a convenience to

1648

# the user for simple bucketing strategies.

1649

#

1650

# The transformed value will be a hyphenated string of

1651

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

1652

# all values that are within this bucket will be replaced with "10-20".

1653

#

1654

# This can be used on data of type: double, long.

1655

#

1656

# If the bound Value type differs from the type of data

1657

# being transformed, we will first attempt converting the type of the data to

1658

# be transformed to match the type of the bound before comparing.

1659

#

1660

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

1661

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

1662

# grouped together into a single bucket; for example if `upper_bound` = 89,

1663

# then all values greater than 89 are replaced with the value "89+".

1664

# Note that for the purposes of inspection or transformation, the number

1665

# of bytes considered to comprise a 'Value' is based on its representation

1666

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1667

# 123456789, the number of bytes would be counted as 9, even though an

1668

# int64 only holds up to 8 bytes of data.

1669

"integerValue": "A String", # integer

1670

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1671

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1672

# types are google.type.Date and `google.protobuf.Timestamp`.

1673

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1674

# allow the value 60 if it allows leap-seconds.

1675

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1676

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1677

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1678

# to allow the value "24:00:00" for scenarios like business closing time.

1679

},

1680

"dayOfWeekValue": "A String", # day of week

1681

"floatValue": 3.14, # float

1682

"stringValue": "A String", # string

1683

"timestampValue": "A String", # timestamp

1684

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1685

# and time zone are either specified elsewhere or are not significant. The date

1686

# is relative to the Proleptic Gregorian Calendar. This can represent:

1687

#

1688

# * A full date, with non-zero year, month and day values

1689

# * A month and day value, with a zero year, e.g. an anniversary

1690

# * A year on its own, with zero month and day values

1691

# * A year and month value, with a zero day, e.g. a credit card expiration date

1692

#

1693

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1694

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1695

# month and day.

1696

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1697

# a year.

1698

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1699

# if specifying a year by itself or a year and month where the day is not

1700

# significant.

1701

},

1702

"booleanValue": True or False, # boolean

1703

},

1704

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

1705

# grouped together into a single bucket; for example if `lower_bound` = 10,

1706

# then all values less than 10 are replaced with the value "-10".

1707

# Note that for the purposes of inspection or transformation, the number

1708

# of bytes considered to comprise a 'Value' is based on its representation

1709

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1710

# 123456789, the number of bytes would be counted as 9, even though an

1711

# int64 only holds up to 8 bytes of data.

1712

"integerValue": "A String", # integer

1713

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1714

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1715

# types are google.type.Date and `google.protobuf.Timestamp`.

1716

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1717

# allow the value 60 if it allows leap-seconds.

1718

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1719

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1720

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1721

# to allow the value "24:00:00" for scenarios like business closing time.

1722

},

1723

"dayOfWeekValue": "A String", # day of week

1724

"floatValue": 3.14, # float

1725

"stringValue": "A String", # string

1726

"timestampValue": "A String", # timestamp

1727

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1728

# and time zone are either specified elsewhere or are not significant. The date

1729

# is relative to the Proleptic Gregorian Calendar. This can represent:

1730

#

1731

# * A full date, with non-zero year, month and day values

1732

# * A month and day value, with a zero year, e.g. an anniversary

1733

# * A year on its own, with zero month and day values

1734

# * A year and month value, with a zero day, e.g. a credit card expiration date

1735

#

1736

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

1737

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1738

# month and day.

1739

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1740

# a year.

1741

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1742

# if specifying a year by itself or a year and month where the day is not

1743

# significant.

1744

},

1745

"booleanValue": True or False, # boolean

1746

},

1747

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

1748

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

1749

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

1750

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

1751

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1752

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

1753

# (FPE) with the FFX mode of operation; however when used in the

1754

# `ReidentifyContent` API method, it serves the opposite function by reversing

1755

# the surrogate back into the original identifier. The identifier must be

1756

# encoded as ASCII. For a given crypto key and context, the same identifier

1757

# will be replaced with the same surrogate. Identifiers must be at least two

1758

# characters long. In the case that the identifier is the empty string, it will

1759

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

1760

# more.

1761

#

1762

# Note: We recommend using CryptoDeterministicConfig for all use cases which

1763

# do not require preserving the input alphabet space and size, plus warrant

1764

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1765

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

1766

# This annotation will be applied to the surrogate by prefixing it with

1767

# the name of the custom infoType followed by the number of

1768

# characters comprising the surrogate. The following scheme defines the

1769

# format: info_type_name(surrogate_character_count):surrogate

1770

#

1771

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

1772

# the surrogate is 'abc', the full replacement value

1773

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1774

#

1775

# This annotation identifies the surrogate when inspecting content using the

1776

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1777

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1778

# This facilitates reversal of the surrogate when it occurs in free text.

1779

#

1780

# In order for inspection to work properly, the name of this infoType must

1781

# not occur naturally anywhere in your data; otherwise, inspection may

1782

# find a surrogate that does not correspond to an actual identifier.

1783

# Therefore, choose your custom infoType name carefully after considering

1784

# what your data looks like. One way to select a name that has a high chance

1785

# of yielding reliable detection is to include one or more unicode characters

1786

# that are highly improbable to exist in your data.

1787

# For example, assuming your data is entered from a regular ASCII keyboard,

1788

# the symbol with the hex code point 29DD might be used like so:

1789

# ⧝MY_TOKEN_TYPE

1790

"name": "A String", # Name of the information type. Either a name of your choosing when

1791

# creating a CustomInfoType, or one of the names listed

1792

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1793

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

1794

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1795

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1796

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1797

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

1798

# identifier in two different contexts won't be given the same surrogate. If

1799

# the context is not set, a default tweak will be used.

1800

#

1801

# If the context is set but:

1802

#

1803

# 1. there is no record present when transforming a given value or

1804

# 1. the field is not present when transforming a given value,

1805

#

1806

# a default tweak will be used.

1807

#

1808

# Note that case (1) is expected when an `InfoTypeTransformation` is

1809

# applied to both structured and non-structured `ContentItem`s.

1810

# Currently, the referenced field may be of value type integer or string.

1811

#

1812

# The tweak is constructed as a sequence of bytes in big endian byte order

1813

# such that:

1814

#

1815

# - a 64 bit integer is encoded followed by a single byte of value 1

1816

# - a string is encoded in UTF-8 format followed by a single byte of value 2

1817

"name": "A String", # Name describing the field.

1818

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1819

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

1820

# that the FFX mode natively supports. This happens before/after

1821

# encryption/decryption.

1822

# Each character listed must appear only once.

1823

# Number of characters must be in the range [2, 95].

1824

# This must be encoded as ASCII.

1825

# The order of characters does not matter.

1826

# The full list of allowed characters is:

1827

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

1828

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1829

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

1830

# a key encryption key (KEK) stored by KMS).

1831

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1832

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1833

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1834

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1835

# It will be discarded after the request finishes.

1836

"name": "A String", # Required. Name of the key.

1837

# This is an arbitrary string used to differentiate different keys.

1838

# A unique key is generated per name: two separate `TransientCryptoKey`

1839

# protos share the same generated key if their names are the same.

1840

# When the data crypto key is generated, this name is not used in any way

1841

# (repeating the api call will result in a different key being generated).

1842

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1843

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1844

# The wrapped key must be a 128/192/256 bit key.

1845

# Authorization requires the following IAM permissions when sending a request

1846

# to perform a crypto transformation using a kms-wrapped crypto key:

1847

# dlp.kms.encrypt

1848

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1849

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1850

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1851

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1852

# leaking the key. Choose another type of key if possible.

1853

"key": "A String", # Required. A 128/192/256 bit key.

1854

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1855

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1856

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1857

},

1858

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

1859

# input. Outputs a base64 encoded representation of the encrypted output.

1860

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1861

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

1862

# referential integrity such that the same identifier in two different

1863

# contexts will be given a distinct surrogate. The context is appended to

1864

# plaintext value being encrypted. On decryption the provided context is

1865

# validated against the value used during encryption. If a context was

1866

# provided during encryption, same context must be provided during decryption

1867

# as well.

1868

#

1869

# If the context is not set, plaintext would be used as is for encryption.

1870

# If the context is set but:

1871

#

1872

# 1. there is no record present when transforming a given value or

1873

# 2. the field is not present when transforming a given value,

1874

#

1875

# plaintext would be used as is for encryption.

1876

#

1877

# Note that case (1) is expected when an `InfoTypeTransformation` is

1878

# applied to both structured and non-structured `ContentItem`s.

1879

"name": "A String", # Name describing the field.

1880

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1881

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

1882

# This annotation will be applied to the surrogate by prefixing it with

1883

# the name of the custom info type followed by the number of

1884

# characters comprising the surrogate. The following scheme defines the

1885

# format: {info type name}({surrogate character count}):{surrogate}

1886

#

1887

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

1888

# the surrogate is 'abc', the full replacement value

1889

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

1890

#

1891

# This annotation identifies the surrogate when inspecting content using the

1892

# custom info type 'Surrogate'. This facilitates reversal of the

1893

# surrogate when it occurs in free text.

1894

#

1895

# Note: For record transformations where the entire cell in a table is being

1896

# transformed, surrogates are not mandatory. Surrogates are used to denote

1897

# the location of the token and are necessary for re-identification in free

1898

# form text.

1899

#

1900

# In order for inspection to work properly, the name of this info type must

1901

# not occur naturally anywhere in your data; otherwise, inspection may either

1902

#

1903

# - reverse a surrogate that does not correspond to an actual identifier

1904

# - be unable to parse the surrogate and result in an error

1905

#

1906

# Therefore, choose your custom info type name carefully after considering

1907

# what your data looks like. One way to select a name that has a high chance

1908

# of yielding reliable detection is to include one or more unicode characters

1909

# that are highly improbable to exist in your data.

1910

# For example, assuming your data is entered from a regular ASCII keyboard,

1911

# the symbol with the hex code point 29DD might be used like so:

1912

# ⧝MY_TOKEN_TYPE.

1913

"name": "A String", # Name of the information type. Either a name of your choosing when

1914

# creating a CustomInfoType, or one of the names listed

1915

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1916

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

1917

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1918

},

1919

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

1920

# a key encryption key (KEK) stored by KMS).

1921

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

1922

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

1923

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1924

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

1925

# It will be discarded after the request finishes.

1926

"name": "A String", # Required. Name of the key.

1927

# This is an arbitrary string used to differentiate different keys.

1928

# A unique key is generated per name: two separate `TransientCryptoKey`

1929

# protos share the same generated key if their names are the same.

1930

# When the data crypto key is generated, this name is not used in any way

1931

# (repeating the api call will result in a different key being generated).

1932

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

1933

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

1934

# The wrapped key must be a 128/192/256 bit key.

1935

# Authorization requires the following IAM permissions when sending a request

1936

# to perform a crypto transformation using a kms-wrapped crypto key:

1937

# dlp.kms.encrypt

1938

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

1939

"wrappedKey": "A String", # Required. The wrapped data crypto key.

1940

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1941

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

1942

# leaking the key. Choose another type of key if possible.

1943

"key": "A String", # Required. A 128/192/256 bit key.

1944

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1945

},

1946

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1947

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

1948

# replacement values are dynamically provided by the user for custom behavior,

1949

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

1950

# This can be used on

1951

# data of type: number, long, string, timestamp.

1952

# If the bound `Value` type differs from the type of data being transformed, we

1953

# will first attempt converting the type of the data to be transformed to match

1954

# the type of the bound before comparing.

1955

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

1956

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

1957

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1958

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1959

# Note that for the purposes of inspection or transformation, the number

1960

# of bytes considered to comprise a 'Value' is based on its representation

1961

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

1962

# 123456789, the number of bytes would be counted as 9, even though an

1963

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1964

"integerValue": "A String", # integer

1965

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

1966

# or are specified elsewhere. An API may choose to allow leap seconds. Related

1967

# types are google.type.Date and `google.protobuf.Timestamp`.

1968

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

1969

# allow the value 60 if it allows leap-seconds.

1970

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

1971

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

1972

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

1973

# to allow the value "24:00:00" for scenarios like business closing time.

1974

},

1975

"dayOfWeekValue": "A String", # day of week

1976

"floatValue": 3.14, # float

1977

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1978

"timestampValue": "A String", # timestamp

1979

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

1980

# and time zone are either specified elsewhere or are not significant. The date

1981

# is relative to the Proleptic Gregorian Calendar. This can represent:

1982

#

1983

# * A full date, with non-zero year, month and day values

1984

# * A month and day value, with a zero year, e.g. an anniversary

1985

# * A year on its own, with zero month and day values

1986

# * A year and month value, with a zero day, e.g. a credit card expiration date

1987

#

1988

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1989

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

1990

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1991

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

1992

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

1993

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

1994

# if specifying a year by itself or a year and month where the day is not

1995

# significant.

1996

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

1997

"booleanValue": True or False, # boolean

1998

},

1999

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

2000

# Note that for the purposes of inspection or transformation, the number

2001

# of bytes considered to comprise a 'Value' is based on its representation

2002

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2003

# 123456789, the number of bytes would be counted as 9, even though an

2004

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2005

"integerValue": "A String", # integer

2006

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2007

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2008

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2009

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2010

# allow the value 60 if it allows leap-seconds.

2011

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2012

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2013

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2014

# to allow the value "24:00:00" for scenarios like business closing time.

2015

},

2016

"dayOfWeekValue": "A String", # day of week

2017

"floatValue": 3.14, # float

2018

"stringValue": "A String", # string

2019

"timestampValue": "A String", # timestamp

2020

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2021

# and time zone are either specified elsewhere or are not significant. The date

2022

# is relative to the Proleptic Gregorian Calendar. This can represent:

2023

#

2024

# * A full date, with non-zero year, month and day values

2025

# * A month and day value, with a zero year, e.g. an anniversary

2026

# * A year on its own, with zero month and day values

2027

# * A year and month value, with a zero day, e.g. a credit card expiration date

2028

#

2029

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2030

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2031

# month and day.

2032

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2033

# a year.

2034

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2035

# if specifying a year by itself or a year and month where the day is not

2036

# significant.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2037

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2038

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2039

},

2040

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

2041

# used.

2042

# Note that for the purposes of inspection or transformation, the number

2043

# of bytes considered to comprise a 'Value' is based on its representation

2044

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2045

# 123456789, the number of bytes would be counted as 9, even though an

2046

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2047

"integerValue": "A String", # integer

2048

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2049

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2050

# types are google.type.Date and `google.protobuf.Timestamp`.

2051

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2052

# allow the value 60 if it allows leap-seconds.

2053

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2054

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2055

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2056

# to allow the value "24:00:00" for scenarios like business closing time.

2057

},

2058

"dayOfWeekValue": "A String", # day of week

2059

"floatValue": 3.14, # float

2060

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2061

"timestampValue": "A String", # timestamp

2062

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2063

# and time zone are either specified elsewhere or are not significant. The date

2064

# is relative to the Proleptic Gregorian Calendar. This can represent:

2065

#

2066

# * A full date, with non-zero year, month and day values

2067

# * A month and day value, with a zero year, e.g. an anniversary

2068

# * A year on its own, with zero month and day values

2069

# * A year and month value, with a zero day, e.g. a credit card expiration date

2070

#

2071

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2072

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2073

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2074

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2075

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2076

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2077

# if specifying a year by itself or a year and month where the day is not

2078

# significant.

2079

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2080

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2085

},

2086

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

2087

# given `RecordCondition`. The conditions are allowed to reference fields

2088

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

2093

# column for the same record is within a specific range.

2094

# - Redact a field if the date of birth field is greater than 85.

2095

# a field.

2096

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2097

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

2098

"conditions": [ # A collection of conditions.

2099

{ # The field type of `value` and `field` do not need to match to be

2100

# considered equal, but not all comparisons are possible.

2101

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

2102

# but all other comparisons are invalid with incompatible types.

2103

# A `value` of type:

2104

#

2105

# - `string` can be compared against all other types

2106

# - `boolean` can only be compared against other booleans

2107

# - `integer` can be compared against doubles or a string if the string value

2108

# can be parsed as an integer.

2109

# - `double` can be compared against integers or a string if the string can

2110

# be parsed as a double.

2111

# - `Timestamp` can be compared against strings in RFC 3339 date string

2112

# format.

2113

# - `TimeOfDay` can be compared against timestamps and strings in the format

2114

# of 'HH:mm:ss'.

2115

#

2116

# If we fail to compare do to type mismatch, a warning will be given and

2117

# the condition will evaluate to false.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2118

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

2119

"name": "A String", # Name describing the field.

2120

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2121

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

2122

# Note that for the purposes of inspection or transformation, the number

2123

# of bytes considered to comprise a 'Value' is based on its representation

2124

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2125

# 123456789, the number of bytes would be counted as 9, even though an

2126

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2127

"integerValue": "A String", # integer

2128

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2129

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2130

# types are google.type.Date and `google.protobuf.Timestamp`.

2131

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2132

# allow the value 60 if it allows leap-seconds.

2133

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2134

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2135

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2136

# to allow the value "24:00:00" for scenarios like business closing time.

2137

},

2138

"dayOfWeekValue": "A String", # day of week

2139

"floatValue": 3.14, # float

2140

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2141

"timestampValue": "A String", # timestamp

2142

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2143

# and time zone are either specified elsewhere or are not significant. The date

2144

# is relative to the Proleptic Gregorian Calendar. This can represent:

2145

#

2146

# * A full date, with non-zero year, month and day values

2147

# * A month and day value, with a zero year, e.g. an anniversary

2148

# * A year on its own, with zero month and day values

2149

# * A year and month value, with a zero day, e.g. a credit card expiration date

2150

#

2151

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2152

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2153

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2154

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2155

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2156

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2157

# if specifying a year by itself or a year and month where the day is not

2158

# significant.

2159

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2160

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2161

},

2162

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2163

},

2164

],

2165

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2166

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

2167

# only supported value is `AND`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2168

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2169

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2170

"fields": [ # Required. Input field(s) to apply the transformation to.

2171

{ # General identifier of a data field in a storage service.

2172

"name": "A String", # Name describing the field.

2173

},

2174

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2179

"createTime": "A String", # Output only. The creation timestamp of an inspectTemplate.

2180

"updateTime": "A String", # Output only. The last update timestamp of an inspectTemplate.

2181

"description": "A String", # Short description (max 256 chars).

2182

"displayName": "A String", # Display name (max 256 chars).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2183

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2184

"locationId": "A String", # Deprecated. This field has no effect.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2185

}

2186

2187

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

2194

2195

{ # DeidentifyTemplates contains instructions on how to de-identify content.

2196

# See https://cloud.google.com/dlp/docs/concepts-templates to learn more.

2197

"name": "A String", # Output only. The template name.

2198

#

2199

# The template will have one of the following formats:

2200

# `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR

2201

# `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2202

"deidentifyConfig": { # The configuration that controls how the data will change. # ///////////// // The core content of the template // ///////////////

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2203

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text

2204

# transformation everywhere.

2205

# apply various `PrimitiveTransformation`s to each finding, where the

2206

# transformation is applied to only values that were identified as a specific

2207

# info_type.

2208

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

2209

# for a given infoType.

2210

{ # A transformation to apply to text that is identified as a specific

2211

# info_type.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2212

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

2213

# this transformation to apply to all findings that correspond to

2214

# infoTypes that were requested in `InspectConfig`.

2215

{ # Type of information detected by the API.

2216

"name": "A String", # Name of the information type. Either a name of your choosing when

2217

# creating a CustomInfoType, or one of the names listed

2218

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2219

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

2220

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2221

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2222

],

2223

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2224

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

2225

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

2226

# to learn more.

2227

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

2228

# If set, must also set cryptoKey. If set, shift will be consistent for the

2229

# given context.

2230

"name": "A String", # Name describing the field.

2231

},

2232

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

2233

# range (inclusive ends). Negative means shift to earlier in time. Must not

2234

# be more than 365250 days (1000 years) each direction.

2235

#

2236

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2237

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

2238

# results in the same shift for the same context and crypto_key. If

2239

# set, must also set context. Can only be applied to table items.

2240

# a key encryption key (KEK) stored by KMS).

2241

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2242

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2243

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2244

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2245

# It will be discarded after the request finishes.

2246

"name": "A String", # Required. Name of the key.

2247

# This is an arbitrary string used to differentiate different keys.

2248

# A unique key is generated per name: two separate `TransientCryptoKey`

2249

# protos share the same generated key if their names are the same.

2250

# When the data crypto key is generated, this name is not used in any way

2251

# (repeating the api call will result in a different key being generated).

2252

},

2253

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2254

# The wrapped key must be a 128/192/256 bit key.

2255

# Authorization requires the following IAM permissions when sending a request

2256

# to perform a crypto transformation using a kms-wrapped crypto key:

2257

# dlp.kms.encrypt

2258

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2259

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2260

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2261

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2262

# leaking the key. Choose another type of key if possible.

2263

"key": "A String", # Required. A 128/192/256 bit key.

2264

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2265

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2266

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

2267

},

2268

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

2269

# portion of the value.

2270

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2271

},

2272

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

2273

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2274

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

2275

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

2276

# Note that for the purposes of inspection or transformation, the number

2277

# of bytes considered to comprise a 'Value' is based on its representation

2278

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2279

# 123456789, the number of bytes would be counted as 9, even though an

2280

# int64 only holds up to 8 bytes of data.

2281

"integerValue": "A String", # integer

2282

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2283

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2284

# types are google.type.Date and `google.protobuf.Timestamp`.

2285

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2286

# allow the value 60 if it allows leap-seconds.

2287

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2288

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2289

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2290

# to allow the value "24:00:00" for scenarios like business closing time.

2291

},

2292

"dayOfWeekValue": "A String", # day of week

2293

"floatValue": 3.14, # float

2294

"stringValue": "A String", # string

2295

"timestampValue": "A String", # timestamp

2296

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2297

# and time zone are either specified elsewhere or are not significant. The date

2298

# is relative to the Proleptic Gregorian Calendar. This can represent:

2299

#

2300

# * A full date, with non-zero year, month and day values

2301

# * A month and day value, with a zero year, e.g. an anniversary

2302

# * A year on its own, with zero month and day values

2303

# * A year and month value, with a zero day, e.g. a credit card expiration date

2304

#

2305

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2306

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2307

# month and day.

2308

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2309

# a year.

2310

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2311

# if specifying a year by itself or a year and month where the day is not

2312

# significant.

2313

},

2314

"booleanValue": True or False, # boolean

2315

},

2316

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2317

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

2318

# Uses SHA-256.

2319

# The key size must be either 32 or 64 bytes.

2320

# Outputs a base64 encoded representation of the hashed output

2321

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

2322

# Currently, only string and integer values can be hashed.

2323

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

2324

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

2325

# a key encryption key (KEK) stored by KMS).

2326

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2327

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2328

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2329

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2330

# It will be discarded after the request finishes.

2331

"name": "A String", # Required. Name of the key.

2332

# This is an arbitrary string used to differentiate different keys.

2333

# A unique key is generated per name: two separate `TransientCryptoKey`

2334

# protos share the same generated key if their names are the same.

2335

# When the data crypto key is generated, this name is not used in any way

2336

# (repeating the api call will result in a different key being generated).

2337

},

2338

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2339

# The wrapped key must be a 128/192/256 bit key.

2340

# Authorization requires the following IAM permissions when sending a request

2341

# to perform a crypto transformation using a kms-wrapped crypto key:

2342

# dlp.kms.encrypt

2343

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2344

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2345

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2346

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2347

# leaking the key. Choose another type of key if possible.

2348

"key": "A String", # Required. A 128/192/256 bit key.

2349

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2350

},

2351

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2352

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

2353

# fixed character. Masking can start from the beginning or end of the string.

2354

# This can be used on data of any type (numbers, longs, and so on) and when

2355

# de-identifying structured data we'll attempt to preserve the original data's

2356

# type. (This allows you to take a long like 123 and modify it to a string like

2357

# **3.

2358

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

2359

# characters. For example, if the input string is `555-555-5555` and you

2360

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

2361

# returns `***-**5-5555`.

2362

{ # Characters to skip when doing deidentification of a value. These will be left

2363

# alone and skipped.

2364

"charactersToSkip": "A String", # Characters to not transform when masking.

2365

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

2370

# masked. Skipped characters do not count towards this tally.

2371

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

2372

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

2373

# code or credit card number. This string must have a length of 1. If not

2374

# supplied, this value defaults to `*` for strings, and `0` for digits.

2375

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

2376

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

2377

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

2378

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

2379

# is `true`, then the string `12345` is masked as `12***`.

2380

},

2381

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

2382

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

2383

# output would be 'My phone number is '.

2384

},

2385

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

2386

# Bucketing transformation can provide all of this functionality,

2387

# but requires more configuration. This message is provided as a convenience to

2388

# the user for simple bucketing strategies.

2389

#

2390

# The transformed value will be a hyphenated string of

2391

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

2392

# all values that are within this bucket will be replaced with "10-20".

2393

#

2394

# This can be used on data of type: double, long.

2395

#

2396

# If the bound Value type differs from the type of data

2397

# being transformed, we will first attempt converting the type of the data to

2398

# be transformed to match the type of the bound before comparing.

2399

#

2400

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

2401

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

2402

# grouped together into a single bucket; for example if `upper_bound` = 89,

2403

# then all values greater than 89 are replaced with the value "89+".

2404

# Note that for the purposes of inspection or transformation, the number

2405

# of bytes considered to comprise a 'Value' is based on its representation

2406

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2407

# 123456789, the number of bytes would be counted as 9, even though an

2408

# int64 only holds up to 8 bytes of data.

2409

"integerValue": "A String", # integer

2410

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2411

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2412

# types are google.type.Date and `google.protobuf.Timestamp`.

2413

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2414

# allow the value 60 if it allows leap-seconds.

2415

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2416

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2417

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2418

# to allow the value "24:00:00" for scenarios like business closing time.

2419

},

2420

"dayOfWeekValue": "A String", # day of week

2421

"floatValue": 3.14, # float

2422

"stringValue": "A String", # string

2423

"timestampValue": "A String", # timestamp

2424

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2425

# and time zone are either specified elsewhere or are not significant. The date

2426

# is relative to the Proleptic Gregorian Calendar. This can represent:

2427

#

2428

# * A full date, with non-zero year, month and day values

2429

# * A month and day value, with a zero year, e.g. an anniversary

2430

# * A year on its own, with zero month and day values

2431

# * A year and month value, with a zero day, e.g. a credit card expiration date

2432

#

2433

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2434

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2435

# month and day.

2436

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2437

# a year.

2438

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2439

# if specifying a year by itself or a year and month where the day is not

2440

# significant.

2441

},

2442

"booleanValue": True or False, # boolean

2443

},

2444

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

2445

# grouped together into a single bucket; for example if `lower_bound` = 10,

2446

# then all values less than 10 are replaced with the value "-10".

2447

# Note that for the purposes of inspection or transformation, the number

2448

# of bytes considered to comprise a 'Value' is based on its representation

2449

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2450

# 123456789, the number of bytes would be counted as 9, even though an

2451

# int64 only holds up to 8 bytes of data.

2452

"integerValue": "A String", # integer

2453

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2454

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2455

# types are google.type.Date and `google.protobuf.Timestamp`.

2456

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2457

# allow the value 60 if it allows leap-seconds.

2458

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2459

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2460

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2461

# to allow the value "24:00:00" for scenarios like business closing time.

2462

},

2463

"dayOfWeekValue": "A String", # day of week

2464

"floatValue": 3.14, # float

2465

"stringValue": "A String", # string

2466

"timestampValue": "A String", # timestamp

2467

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2468

# and time zone are either specified elsewhere or are not significant. The date

2469

# is relative to the Proleptic Gregorian Calendar. This can represent:

2470

#

2471

# * A full date, with non-zero year, month and day values

2472

# * A month and day value, with a zero year, e.g. an anniversary

2473

# * A year on its own, with zero month and day values

2474

# * A year and month value, with a zero day, e.g. a credit card expiration date

2475

#

2476

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2477

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2478

# month and day.

2479

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2480

# a year.

2481

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2482

# if specifying a year by itself or a year and month where the day is not

2483

# significant.

2484

},

2485

"booleanValue": True or False, # boolean

2486

},

2487

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

2488

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

2489

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

2490

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

2491

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2492

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

2493

# (FPE) with the FFX mode of operation; however when used in the

2494

# `ReidentifyContent` API method, it serves the opposite function by reversing

2495

# the surrogate back into the original identifier. The identifier must be

2496

# encoded as ASCII. For a given crypto key and context, the same identifier

2497

# will be replaced with the same surrogate. Identifiers must be at least two

2498

# characters long. In the case that the identifier is the empty string, it will

2499

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

2500

# more.

2501

#

2502

# Note: We recommend using CryptoDeterministicConfig for all use cases which

2503

# do not require preserving the input alphabet space and size, plus warrant

2504

# referential integrity.

2505

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

2506

# This annotation will be applied to the surrogate by prefixing it with

2507

# the name of the custom infoType followed by the number of

2508

# characters comprising the surrogate. The following scheme defines the

2509

# format: info_type_name(surrogate_character_count):surrogate

2510

#

2511

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

2512

# the surrogate is 'abc', the full replacement value

2513

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

2514

#

2515

# This annotation identifies the surrogate when inspecting content using the

2516

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2517

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2518

# This facilitates reversal of the surrogate when it occurs in free text.

2519

#

2520

# In order for inspection to work properly, the name of this infoType must

2521

# not occur naturally anywhere in your data; otherwise, inspection may

2522

# find a surrogate that does not correspond to an actual identifier.

2523

# Therefore, choose your custom infoType name carefully after considering

2524

# what your data looks like. One way to select a name that has a high chance

2525

# of yielding reliable detection is to include one or more unicode characters

2526

# that are highly improbable to exist in your data.

2527

# For example, assuming your data is entered from a regular ASCII keyboard,

2528

# the symbol with the hex code point 29DD might be used like so:

2529

# ⧝MY_TOKEN_TYPE

2530

"name": "A String", # Name of the information type. Either a name of your choosing when

2531

# creating a CustomInfoType, or one of the names listed

2532

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2533

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

2534

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2535

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2536

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2537

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

2538

# identifier in two different contexts won't be given the same surrogate. If

2539

# the context is not set, a default tweak will be used.

2540

#

2541

# If the context is set but:

2542

#

2543

# 1. there is no record present when transforming a given value or

2544

# 1. the field is not present when transforming a given value,

2545

#

2546

# a default tweak will be used.

2547

#

2548

# Note that case (1) is expected when an `InfoTypeTransformation` is

2549

# applied to both structured and non-structured `ContentItem`s.

2550

# Currently, the referenced field may be of value type integer or string.

2551

#

2552

# The tweak is constructed as a sequence of bytes in big endian byte order

2553

# such that:

2554

#

2555

# - a 64 bit integer is encoded followed by a single byte of value 1

2556

# - a string is encoded in UTF-8 format followed by a single byte of value 2

2557

"name": "A String", # Name describing the field.

2558

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2559

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

2560

# that the FFX mode natively supports. This happens before/after

2561

# encryption/decryption.

2562

# Each character listed must appear only once.

2563

# Number of characters must be in the range [2, 95].

2564

# This must be encoded as ASCII.

2565

# The order of characters does not matter.

2566

# The full list of allowed characters is:

2567

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

2568

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2569

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

2570

# a key encryption key (KEK) stored by KMS).

2571

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2572

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2573

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2574

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2575

# It will be discarded after the request finishes.

2576

"name": "A String", # Required. Name of the key.

2577

# This is an arbitrary string used to differentiate different keys.

2578

# A unique key is generated per name: two separate `TransientCryptoKey`

2579

# protos share the same generated key if their names are the same.

2580

# When the data crypto key is generated, this name is not used in any way

2581

# (repeating the api call will result in a different key being generated).

2582

},

2583

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2584

# The wrapped key must be a 128/192/256 bit key.

2585

# Authorization requires the following IAM permissions when sending a request

2586

# to perform a crypto transformation using a kms-wrapped crypto key:

2587

# dlp.kms.encrypt

2588

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2589

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2590

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2591

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2592

# leaking the key. Choose another type of key if possible.

2593

"key": "A String", # Required. A 128/192/256 bit key.

2594

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2595

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2596

"commonAlphabet": "A String", # Common alphabets.

2597

},

2598

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

2599

# input. Outputs a base64 encoded representation of the encrypted output.

2600

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2601

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

2602

# referential integrity such that the same identifier in two different

2603

# contexts will be given a distinct surrogate. The context is appended to

2604

# plaintext value being encrypted. On decryption the provided context is

2605

# validated against the value used during encryption. If a context was

2606

# provided during encryption, same context must be provided during decryption

2607

# as well.

2608

#

2609

# If the context is not set, plaintext would be used as is for encryption.

2610

# If the context is set but:

2611

#

2612

# 1. there is no record present when transforming a given value or

2613

# 2. the field is not present when transforming a given value,

2614

#

2615

# plaintext would be used as is for encryption.

2616

#

2617

# Note that case (1) is expected when an `InfoTypeTransformation` is

2618

# applied to both structured and non-structured `ContentItem`s.

2619

"name": "A String", # Name describing the field.

2620

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2621

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

2622

# This annotation will be applied to the surrogate by prefixing it with

2623

# the name of the custom info type followed by the number of

2624

# characters comprising the surrogate. The following scheme defines the

2625

# format: {info type name}({surrogate character count}):{surrogate}

2626

#

2627

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

2628

# the surrogate is 'abc', the full replacement value

2629

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

2630

#

2631

# This annotation identifies the surrogate when inspecting content using the

2632

# custom info type 'Surrogate'. This facilitates reversal of the

2633

# surrogate when it occurs in free text.

2634

#

2635

# Note: For record transformations where the entire cell in a table is being

2636

# transformed, surrogates are not mandatory. Surrogates are used to denote

2637

# the location of the token and are necessary for re-identification in free

2638

# form text.

2639

#

2640

# In order for inspection to work properly, the name of this info type must

2641

# not occur naturally anywhere in your data; otherwise, inspection may either

2642

#

2643

# - reverse a surrogate that does not correspond to an actual identifier

2644

# - be unable to parse the surrogate and result in an error

2645

#

2646

# Therefore, choose your custom info type name carefully after considering

2647

# what your data looks like. One way to select a name that has a high chance

2648

# of yielding reliable detection is to include one or more unicode characters

2649

# that are highly improbable to exist in your data.

2650

# For example, assuming your data is entered from a regular ASCII keyboard,

2651

# the symbol with the hex code point 29DD might be used like so:

2652

# ⧝MY_TOKEN_TYPE.

2653

"name": "A String", # Name of the information type. Either a name of your choosing when

2654

# creating a CustomInfoType, or one of the names listed

2655

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2656

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

2657

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2658

},

2659

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

2660

# a key encryption key (KEK) stored by KMS).

2661

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2662

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2663

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2664

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2665

# It will be discarded after the request finishes.

2666

"name": "A String", # Required. Name of the key.

2667

# This is an arbitrary string used to differentiate different keys.

2668

# A unique key is generated per name: two separate `TransientCryptoKey`

2669

# protos share the same generated key if their names are the same.

2670

# When the data crypto key is generated, this name is not used in any way

2671

# (repeating the api call will result in a different key being generated).

2672

},

2673

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2674

# The wrapped key must be a 128/192/256 bit key.

2675

# Authorization requires the following IAM permissions when sending a request

2676

# to perform a crypto transformation using a kms-wrapped crypto key:

2677

# dlp.kms.encrypt

2678

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2679

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2680

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2681

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2682

# leaking the key. Choose another type of key if possible.

2683

"key": "A String", # Required. A 128/192/256 bit key.

2684

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2685

},

2686

},

2687

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

2688

# replacement values are dynamically provided by the user for custom behavior,

2689

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

2690

# This can be used on

2691

# data of type: number, long, string, timestamp.

2692

# If the bound `Value` type differs from the type of data being transformed, we

2693

# will first attempt converting the type of the data to be transformed to match

2694

# the type of the bound before comparing.

2695

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

2696

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

2697

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2698

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2699

# Note that for the purposes of inspection or transformation, the number

2700

# of bytes considered to comprise a 'Value' is based on its representation

2701

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2702

# 123456789, the number of bytes would be counted as 9, even though an

2703

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2704

"integerValue": "A String", # integer

2705

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2706

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2707

# types are google.type.Date and `google.protobuf.Timestamp`.

2708

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2709

# allow the value 60 if it allows leap-seconds.

2710

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2711

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2712

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2713

# to allow the value "24:00:00" for scenarios like business closing time.

2714

},

2715

"dayOfWeekValue": "A String", # day of week

2716

"floatValue": 3.14, # float

2717

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2718

"timestampValue": "A String", # timestamp

2719

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2720

# and time zone are either specified elsewhere or are not significant. The date

2721

# is relative to the Proleptic Gregorian Calendar. This can represent:

2722

#

2723

# * A full date, with non-zero year, month and day values

2724

# * A month and day value, with a zero year, e.g. an anniversary

2725

# * A year on its own, with zero month and day values

2726

# * A year and month value, with a zero day, e.g. a credit card expiration date

2727

#

2728

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2729

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2730

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2731

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2732

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2733

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2734

# if specifying a year by itself or a year and month where the day is not

2735

# significant.

2736

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2737

"booleanValue": True or False, # boolean

2738

},

2739

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

2740

# Note that for the purposes of inspection or transformation, the number

2741

# of bytes considered to comprise a 'Value' is based on its representation

2742

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2743

# 123456789, the number of bytes would be counted as 9, even though an

2744

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2745

"integerValue": "A String", # integer

2746

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2747

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2748

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2749

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2750

# allow the value 60 if it allows leap-seconds.

2751

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2752

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2753

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2754

# to allow the value "24:00:00" for scenarios like business closing time.

2755

},

2756

"dayOfWeekValue": "A String", # day of week

2757

"floatValue": 3.14, # float

2758

"stringValue": "A String", # string

2759

"timestampValue": "A String", # timestamp

2760

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2761

# and time zone are either specified elsewhere or are not significant. The date

2762

# is relative to the Proleptic Gregorian Calendar. This can represent:

2763

#

2764

# * A full date, with non-zero year, month and day values

2765

# * A month and day value, with a zero year, e.g. an anniversary

2766

# * A year on its own, with zero month and day values

2767

# * A year and month value, with a zero day, e.g. a credit card expiration date

2768

#

2769

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2770

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2771

# month and day.

2772

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2773

# a year.

2774

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2775

# if specifying a year by itself or a year and month where the day is not

2776

# significant.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2777

},

2778

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2779

},

2780

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

2781

# used.

2782

# Note that for the purposes of inspection or transformation, the number

2783

# of bytes considered to comprise a 'Value' is based on its representation

2784

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2785

# 123456789, the number of bytes would be counted as 9, even though an

2786

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2787

"integerValue": "A String", # integer

2788

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2789

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2790

# types are google.type.Date and `google.protobuf.Timestamp`.

2791

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2792

# allow the value 60 if it allows leap-seconds.

2793

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2794

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2795

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2796

# to allow the value "24:00:00" for scenarios like business closing time.

2797

},

2798

"dayOfWeekValue": "A String", # day of week

2799

"floatValue": 3.14, # float

2800

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2801

"timestampValue": "A String", # timestamp

2802

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2803

# and time zone are either specified elsewhere or are not significant. The date

2804

# is relative to the Proleptic Gregorian Calendar. This can represent:

2805

#

2806

# * A full date, with non-zero year, month and day values

2807

# * A month and day value, with a zero year, e.g. an anniversary

2808

# * A year on its own, with zero month and day values

2809

# * A year and month value, with a zero day, e.g. a credit card expiration date

2810

#

2811

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2812

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2813

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2814

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2815

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2816

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2817

# if specifying a year by itself or a year and month where the day is not

2818

# significant.

2819

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2820

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2825

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2826

},

2827

],

2828

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2829

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default

2830

# mode is `TransformationErrorHandling.ThrowError`.

2831

# transformation error occurs when the requested transformation is incompatible

2832

# with the data. For example, trying to de-identify an IP address using a

2833

# `DateShift` transformation would result in a transformation error, since date

2834

# info cannot be extracted from an IP address.

2835

# Information about any incompatible transformations, and how they were

2836

# handled, is returned in the response as part of the

2837

# `TransformationOverviews`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2838

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would # Ignore errors

2839

# cause an error. For example, if a `DateShift` transformation were applied

2840

# an an IP address, this mode would leave the IP address unchanged in the

2841

# response.

2842

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2843

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

2844

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2845

},

2846

"recordTransformations": { # A type of transformation that is applied over structured data such as a # Treat the dataset as structured. Transformations can be applied to

2847

# specific locations within structured datasets, such as transforming

2848

# a column within a table.

2849

# table.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2850

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that

2851

# match any suppression rule are omitted from the output.

2852

{ # Configuration to suppress records whose suppression conditions evaluate to

2853

# true.

2854

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

2855

# evaluated to be suppressed from the transformed content.

2856

# a field.

2857

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

2858

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

2859

"conditions": [ # A collection of conditions.

2860

{ # The field type of `value` and `field` do not need to match to be

2861

# considered equal, but not all comparisons are possible.

2862

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

2863

# but all other comparisons are invalid with incompatible types.

2864

# A `value` of type:

2865

#

2866

# - `string` can be compared against all other types

2867

# - `boolean` can only be compared against other booleans

2868

# - `integer` can be compared against doubles or a string if the string value

2869

# can be parsed as an integer.

2870

# - `double` can be compared against integers or a string if the string can

2871

# be parsed as a double.

2872

# - `Timestamp` can be compared against strings in RFC 3339 date string

2873

# format.

2874

# - `TimeOfDay` can be compared against timestamps and strings in the format

2875

# of 'HH:mm:ss'.

2876

#

2877

# If we fail to compare do to type mismatch, a warning will be given and

2878

# the condition will evaluate to false.

2879

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

2880

"name": "A String", # Name describing the field.

2881

},

2882

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

2883

# Note that for the purposes of inspection or transformation, the number

2884

# of bytes considered to comprise a 'Value' is based on its representation

2885

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

2886

# 123456789, the number of bytes would be counted as 9, even though an

2887

# int64 only holds up to 8 bytes of data.

2888

"integerValue": "A String", # integer

2889

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

2890

# or are specified elsewhere. An API may choose to allow leap seconds. Related

2891

# types are google.type.Date and `google.protobuf.Timestamp`.

2892

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

2893

# allow the value 60 if it allows leap-seconds.

2894

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

2895

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

2896

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

2897

# to allow the value "24:00:00" for scenarios like business closing time.

2898

},

2899

"dayOfWeekValue": "A String", # day of week

2900

"floatValue": 3.14, # float

2901

"stringValue": "A String", # string

2902

"timestampValue": "A String", # timestamp

2903

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

2904

# and time zone are either specified elsewhere or are not significant. The date

2905

# is relative to the Proleptic Gregorian Calendar. This can represent:

2906

#

2907

# * A full date, with non-zero year, month and day values

2908

# * A month and day value, with a zero year, e.g. an anniversary

2909

# * A year on its own, with zero month and day values

2910

# * A year and month value, with a zero day, e.g. a credit card expiration date

2911

#

2912

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

2913

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

2914

# month and day.

2915

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

2916

# a year.

2917

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

2918

# if specifying a year by itself or a year and month where the day is not

2919

# significant.

2920

},

2921

"booleanValue": True or False, # boolean

2922

},

2923

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

},

],

},

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

2928

# only supported value is `AND`.

},

},

},

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2933

"fieldTransformations": [ # Transform the record by applying various field transformations.

2934

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2935

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

2936

# transform content that matches an `InfoType`.

2937

# apply various `PrimitiveTransformation`s to each finding, where the

2938

# transformation is applied to only values that were identified as a specific

2939

# info_type.

2940

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

2941

# for a given infoType.

2942

{ # A transformation to apply to text that is identified as a specific

2943

# info_type.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2944

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

2945

# this transformation to apply to all findings that correspond to

2946

# infoTypes that were requested in `InspectConfig`.

2947

{ # Type of information detected by the API.

2948

"name": "A String", # Name of the information type. Either a name of your choosing when

2949

# creating a CustomInfoType, or one of the names listed

2950

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

2951

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

2952

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2953

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2954

],

2955

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2956

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

2957

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

2958

# to learn more.

2959

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

2960

# If set, must also set cryptoKey. If set, shift will be consistent for the

2961

# given context.

2962

"name": "A String", # Name describing the field.

2963

},

2964

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

2965

# range (inclusive ends). Negative means shift to earlier in time. Must not

2966

# be more than 365250 days (1000 years) each direction.

2967

#

2968

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2969

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

2970

# results in the same shift for the same context and crypto_key. If

2971

# set, must also set context. Can only be applied to table items.

2972

# a key encryption key (KEK) stored by KMS).

2973

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

2974

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

2975

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2976

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

2977

# It will be discarded after the request finishes.

2978

"name": "A String", # Required. Name of the key.

2979

# This is an arbitrary string used to differentiate different keys.

2980

# A unique key is generated per name: two separate `TransientCryptoKey`

2981

# protos share the same generated key if their names are the same.

2982

# When the data crypto key is generated, this name is not used in any way

2983

# (repeating the api call will result in a different key being generated).

2984

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

2985

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

2986

# The wrapped key must be a 128/192/256 bit key.

2987

# Authorization requires the following IAM permissions when sending a request

2988

# to perform a crypto transformation using a kms-wrapped crypto key:

2989

# dlp.kms.encrypt

2990

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

2991

"wrappedKey": "A String", # Required. The wrapped data crypto key.

2992

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2993

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

2994

# leaking the key. Choose another type of key if possible.

2995

"key": "A String", # Required. A 128/192/256 bit key.

2996

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

2997

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

2998

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

2999

},

3000

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

3001

# portion of the value.

3002

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3003

},

3004

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3005

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3006

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3007

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

3008

# Note that for the purposes of inspection or transformation, the number

3009

# of bytes considered to comprise a 'Value' is based on its representation

3010

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3011

# 123456789, the number of bytes would be counted as 9, even though an

3012

# int64 only holds up to 8 bytes of data.

3013

"integerValue": "A String", # integer

3014

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3015

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3016

# types are google.type.Date and `google.protobuf.Timestamp`.

3017

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3018

# allow the value 60 if it allows leap-seconds.

3019

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3020

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3021

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3022

# to allow the value "24:00:00" for scenarios like business closing time.

3023

},

3024

"dayOfWeekValue": "A String", # day of week

3025

"floatValue": 3.14, # float

3026

"stringValue": "A String", # string

3027

"timestampValue": "A String", # timestamp

3028

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3029

# and time zone are either specified elsewhere or are not significant. The date

3030

# is relative to the Proleptic Gregorian Calendar. This can represent:

3031

#

3032

# * A full date, with non-zero year, month and day values

3033

# * A month and day value, with a zero year, e.g. an anniversary

3034

# * A year on its own, with zero month and day values

3035

# * A year and month value, with a zero day, e.g. a credit card expiration date

3036

#

3037

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3038

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3039

# month and day.

3040

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3041

# a year.

3042

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3043

# if specifying a year by itself or a year and month where the day is not

3044

# significant.

3045

},

3046

"booleanValue": True or False, # boolean

3047

},

3048

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3049

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

3050

# Uses SHA-256.

3051

# The key size must be either 32 or 64 bytes.

3052

# Outputs a base64 encoded representation of the hashed output

3053

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

3054

# Currently, only string and integer values can be hashed.

3055

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

3056

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

3057

# a key encryption key (KEK) stored by KMS).

3058

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3059

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3060

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3061

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3062

# It will be discarded after the request finishes.

3063

"name": "A String", # Required. Name of the key.

3064

# This is an arbitrary string used to differentiate different keys.

3065

# A unique key is generated per name: two separate `TransientCryptoKey`

3066

# protos share the same generated key if their names are the same.

3067

# When the data crypto key is generated, this name is not used in any way

3068

# (repeating the api call will result in a different key being generated).

3069

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3070

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3071

# The wrapped key must be a 128/192/256 bit key.

3072

# Authorization requires the following IAM permissions when sending a request

3073

# to perform a crypto transformation using a kms-wrapped crypto key:

3074

# dlp.kms.encrypt

3075

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3076

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3077

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3078

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3079

# leaking the key. Choose another type of key if possible.

3080

"key": "A String", # Required. A 128/192/256 bit key.

3081

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3082

},

3083

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3084

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

3085

# fixed character. Masking can start from the beginning or end of the string.

3086

# This can be used on data of any type (numbers, longs, and so on) and when

3087

# de-identifying structured data we'll attempt to preserve the original data's

3088

# type. (This allows you to take a long like 123 and modify it to a string like

3089

# **3.

3090

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

3091

# characters. For example, if the input string is `555-555-5555` and you

3092

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

3093

# returns `***-**5-5555`.

3094

{ # Characters to skip when doing deidentification of a value. These will be left

3095

# alone and skipped.

3096

"charactersToSkip": "A String", # Characters to not transform when masking.

3097

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

3102

# masked. Skipped characters do not count towards this tally.

3103

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

3104

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

3105

# code or credit card number. This string must have a length of 1. If not

3106

# supplied, this value defaults to `*` for strings, and `0` for digits.

3107

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

3108

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

3109

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

3110

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

3111

# is `true`, then the string `12345` is masked as `12***`.

3112

},

3113

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

3114

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

3115

# output would be 'My phone number is '.

3116

},

3117

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

3118

# Bucketing transformation can provide all of this functionality,

3119

# but requires more configuration. This message is provided as a convenience to

3120

# the user for simple bucketing strategies.

3121

#

3122

# The transformed value will be a hyphenated string of

3123

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

3124

# all values that are within this bucket will be replaced with "10-20".

3125

#

3126

# This can be used on data of type: double, long.

3127

#

3128

# If the bound Value type differs from the type of data

3129

# being transformed, we will first attempt converting the type of the data to

3130

# be transformed to match the type of the bound before comparing.

3131

#

3132

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

3133

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

3134

# grouped together into a single bucket; for example if `upper_bound` = 89,

3135

# then all values greater than 89 are replaced with the value "89+".

3136

# Note that for the purposes of inspection or transformation, the number

3137

# of bytes considered to comprise a 'Value' is based on its representation

3138

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3139

# 123456789, the number of bytes would be counted as 9, even though an

3140

# int64 only holds up to 8 bytes of data.

3141

"integerValue": "A String", # integer

3142

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3143

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3144

# types are google.type.Date and `google.protobuf.Timestamp`.

3145

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3146

# allow the value 60 if it allows leap-seconds.

3147

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3148

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3149

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3150

# to allow the value "24:00:00" for scenarios like business closing time.

3151

},

3152

"dayOfWeekValue": "A String", # day of week

3153

"floatValue": 3.14, # float

3154

"stringValue": "A String", # string

3155

"timestampValue": "A String", # timestamp

3156

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3157

# and time zone are either specified elsewhere or are not significant. The date

3158

# is relative to the Proleptic Gregorian Calendar. This can represent:

3159

#

3160

# * A full date, with non-zero year, month and day values

3161

# * A month and day value, with a zero year, e.g. an anniversary

3162

# * A year on its own, with zero month and day values

3163

# * A year and month value, with a zero day, e.g. a credit card expiration date

3164

#

3165

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3166

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3167

# month and day.

3168

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3169

# a year.

3170

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3171

# if specifying a year by itself or a year and month where the day is not

3172

# significant.

3173

},

3174

"booleanValue": True or False, # boolean

3175

},

3176

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

3177

# grouped together into a single bucket; for example if `lower_bound` = 10,

3178

# then all values less than 10 are replaced with the value "-10".

3179

# Note that for the purposes of inspection or transformation, the number

3180

# of bytes considered to comprise a 'Value' is based on its representation

3181

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3182

# 123456789, the number of bytes would be counted as 9, even though an

3183

# int64 only holds up to 8 bytes of data.

3184

"integerValue": "A String", # integer

3185

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3186

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3187

# types are google.type.Date and `google.protobuf.Timestamp`.

3188

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3189

# allow the value 60 if it allows leap-seconds.

3190

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3191

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3192

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3193

# to allow the value "24:00:00" for scenarios like business closing time.

3194

},

3195

"dayOfWeekValue": "A String", # day of week

3196

"floatValue": 3.14, # float

3197

"stringValue": "A String", # string

3198

"timestampValue": "A String", # timestamp

3199

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3200

# and time zone are either specified elsewhere or are not significant. The date

3201

# is relative to the Proleptic Gregorian Calendar. This can represent:

3202

#

3203

# * A full date, with non-zero year, month and day values

3204

# * A month and day value, with a zero year, e.g. an anniversary

3205

# * A year on its own, with zero month and day values

3206

# * A year and month value, with a zero day, e.g. a credit card expiration date

3207

#

3208

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3209

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3210

# month and day.

3211

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3212

# a year.

3213

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3214

# if specifying a year by itself or a year and month where the day is not

3215

# significant.

3216

},

3217

"booleanValue": True or False, # boolean

3218

},

3219

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

3220

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

3221

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

3222

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

3223

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3224

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

3225

# (FPE) with the FFX mode of operation; however when used in the

3226

# `ReidentifyContent` API method, it serves the opposite function by reversing

3227

# the surrogate back into the original identifier. The identifier must be

3228

# encoded as ASCII. For a given crypto key and context, the same identifier

3229

# will be replaced with the same surrogate. Identifiers must be at least two

3230

# characters long. In the case that the identifier is the empty string, it will

3231

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

3232

# more.

3233

#

3234

# Note: We recommend using CryptoDeterministicConfig for all use cases which

3235

# do not require preserving the input alphabet space and size, plus warrant

3236

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3237

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

3238

# This annotation will be applied to the surrogate by prefixing it with

3239

# the name of the custom infoType followed by the number of

3240

# characters comprising the surrogate. The following scheme defines the

3241

# format: info_type_name(surrogate_character_count):surrogate

3242

#

3243

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

3244

# the surrogate is 'abc', the full replacement value

3245

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

3246

#

3247

# This annotation identifies the surrogate when inspecting content using the

3248

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3249

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3250

# This facilitates reversal of the surrogate when it occurs in free text.

3251

#

3252

# In order for inspection to work properly, the name of this infoType must

3253

# not occur naturally anywhere in your data; otherwise, inspection may

3254

# find a surrogate that does not correspond to an actual identifier.

3255

# Therefore, choose your custom infoType name carefully after considering

3256

# what your data looks like. One way to select a name that has a high chance

3257

# of yielding reliable detection is to include one or more unicode characters

3258

# that are highly improbable to exist in your data.

3259

# For example, assuming your data is entered from a regular ASCII keyboard,

3260

# the symbol with the hex code point 29DD might be used like so:

3261

# ⧝MY_TOKEN_TYPE

3262

"name": "A String", # Name of the information type. Either a name of your choosing when

3263

# creating a CustomInfoType, or one of the names listed

3264

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3265

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

3266

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3267

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3268

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3269

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

3270

# identifier in two different contexts won't be given the same surrogate. If

3271

# the context is not set, a default tweak will be used.

3272

#

3273

# If the context is set but:

3274

#

3275

# 1. there is no record present when transforming a given value or

3276

# 1. the field is not present when transforming a given value,

3277

#

3278

# a default tweak will be used.

3279

#

3280

# Note that case (1) is expected when an `InfoTypeTransformation` is

3281

# applied to both structured and non-structured `ContentItem`s.

3282

# Currently, the referenced field may be of value type integer or string.

3283

#

3284

# The tweak is constructed as a sequence of bytes in big endian byte order

3285

# such that:

3286

#

3287

# - a 64 bit integer is encoded followed by a single byte of value 1

3288

# - a string is encoded in UTF-8 format followed by a single byte of value 2

3289

"name": "A String", # Name describing the field.

3290

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3291

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

3292

# that the FFX mode natively supports. This happens before/after

3293

# encryption/decryption.

3294

# Each character listed must appear only once.

3295

# Number of characters must be in the range [2, 95].

3296

# This must be encoded as ASCII.

3297

# The order of characters does not matter.

3298

# The full list of allowed characters is:

3299

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

3300

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3301

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

3302

# a key encryption key (KEK) stored by KMS).

3303

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3304

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3305

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3306

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3307

# It will be discarded after the request finishes.

3308

"name": "A String", # Required. Name of the key.

3309

# This is an arbitrary string used to differentiate different keys.

3310

# A unique key is generated per name: two separate `TransientCryptoKey`

3311

# protos share the same generated key if their names are the same.

3312

# When the data crypto key is generated, this name is not used in any way

3313

# (repeating the api call will result in a different key being generated).

3314

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3315

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3316

# The wrapped key must be a 128/192/256 bit key.

3317

# Authorization requires the following IAM permissions when sending a request

3318

# to perform a crypto transformation using a kms-wrapped crypto key:

3319

# dlp.kms.encrypt

3320

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3321

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3322

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3323

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3324

# leaking the key. Choose another type of key if possible.

3325

"key": "A String", # Required. A 128/192/256 bit key.

3326

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3327

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3328

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3329

},

3330

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

3331

# input. Outputs a base64 encoded representation of the encrypted output.

3332

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3333

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

3334

# referential integrity such that the same identifier in two different

3335

# contexts will be given a distinct surrogate. The context is appended to

3336

# plaintext value being encrypted. On decryption the provided context is

3337

# validated against the value used during encryption. If a context was

3338

# provided during encryption, same context must be provided during decryption

3339

# as well.

3340

#

3341

# If the context is not set, plaintext would be used as is for encryption.

3342

# If the context is set but:

3343

#

3344

# 1. there is no record present when transforming a given value or

3345

# 2. the field is not present when transforming a given value,

3346

#

3347

# plaintext would be used as is for encryption.

3348

#

3349

# Note that case (1) is expected when an `InfoTypeTransformation` is

3350

# applied to both structured and non-structured `ContentItem`s.

3351

"name": "A String", # Name describing the field.

3352

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3353

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

3354

# This annotation will be applied to the surrogate by prefixing it with

3355

# the name of the custom info type followed by the number of

3356

# characters comprising the surrogate. The following scheme defines the

3357

# format: {info type name}({surrogate character count}):{surrogate}

3358

#

3359

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

3360

# the surrogate is 'abc', the full replacement value

3361

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

3362

#

3363

# This annotation identifies the surrogate when inspecting content using the

3364

# custom info type 'Surrogate'. This facilitates reversal of the

3365

# surrogate when it occurs in free text.

3366

#

3367

# Note: For record transformations where the entire cell in a table is being

3368

# transformed, surrogates are not mandatory. Surrogates are used to denote

3369

# the location of the token and are necessary for re-identification in free

3370

# form text.

3371

#

3372

# In order for inspection to work properly, the name of this info type must

3373

# not occur naturally anywhere in your data; otherwise, inspection may either

3374

#

3375

# - reverse a surrogate that does not correspond to an actual identifier

3376

# - be unable to parse the surrogate and result in an error

3377

#

3378

# Therefore, choose your custom info type name carefully after considering

3379

# what your data looks like. One way to select a name that has a high chance

3380

# of yielding reliable detection is to include one or more unicode characters

3381

# that are highly improbable to exist in your data.

3382

# For example, assuming your data is entered from a regular ASCII keyboard,

3383

# the symbol with the hex code point 29DD might be used like so:

3384

# ⧝MY_TOKEN_TYPE.

3385

"name": "A String", # Name of the information type. Either a name of your choosing when

3386

# creating a CustomInfoType, or one of the names listed

3387

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3388

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

3389

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3390

},

3391

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

3392

# a key encryption key (KEK) stored by KMS).

3393

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3394

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3395

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3396

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3397

# It will be discarded after the request finishes.

3398

"name": "A String", # Required. Name of the key.

3399

# This is an arbitrary string used to differentiate different keys.

3400

# A unique key is generated per name: two separate `TransientCryptoKey`

3401

# protos share the same generated key if their names are the same.

3402

# When the data crypto key is generated, this name is not used in any way

3403

# (repeating the api call will result in a different key being generated).

3404

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3405

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3406

# The wrapped key must be a 128/192/256 bit key.

3407

# Authorization requires the following IAM permissions when sending a request

3408

# to perform a crypto transformation using a kms-wrapped crypto key:

3409

# dlp.kms.encrypt

3410

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3411

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3412

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3413

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3414

# leaking the key. Choose another type of key if possible.

3415

"key": "A String", # Required. A 128/192/256 bit key.

3416

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3417

},

3418

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3419

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

3420

# replacement values are dynamically provided by the user for custom behavior,

3421

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

3422

# This can be used on

3423

# data of type: number, long, string, timestamp.

3424

# If the bound `Value` type differs from the type of data being transformed, we

3425

# will first attempt converting the type of the data to be transformed to match

3426

# the type of the bound before comparing.

3427

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

3428

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

3429

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3430

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3431

# Note that for the purposes of inspection or transformation, the number

3432

# of bytes considered to comprise a 'Value' is based on its representation

3433

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3434

# 123456789, the number of bytes would be counted as 9, even though an

3435

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3436

"integerValue": "A String", # integer

3437

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3438

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3439

# types are google.type.Date and `google.protobuf.Timestamp`.

3440

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3441

# allow the value 60 if it allows leap-seconds.

3442

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3443

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3444

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3445

# to allow the value "24:00:00" for scenarios like business closing time.

3446

},

3447

"dayOfWeekValue": "A String", # day of week

3448

"floatValue": 3.14, # float

3449

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3450

"timestampValue": "A String", # timestamp

3451

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3452

# and time zone are either specified elsewhere or are not significant. The date

3453

# is relative to the Proleptic Gregorian Calendar. This can represent:

3454

#

3455

# * A full date, with non-zero year, month and day values

3456

# * A month and day value, with a zero year, e.g. an anniversary

3457

# * A year on its own, with zero month and day values

3458

# * A year and month value, with a zero day, e.g. a credit card expiration date

3459

#

3460

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3461

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3462

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3463

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3464

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3465

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3466

# if specifying a year by itself or a year and month where the day is not

3467

# significant.

3468

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3469

"booleanValue": True or False, # boolean

3470

},

3471

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

3472

# Note that for the purposes of inspection or transformation, the number

3473

# of bytes considered to comprise a 'Value' is based on its representation

3474

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3475

# 123456789, the number of bytes would be counted as 9, even though an

3476

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3477

"integerValue": "A String", # integer

3478

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3479

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3480

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3481

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3482

# allow the value 60 if it allows leap-seconds.

3483

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3484

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3485

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3486

# to allow the value "24:00:00" for scenarios like business closing time.

3487

},

3488

"dayOfWeekValue": "A String", # day of week

3489

"floatValue": 3.14, # float

3490

"stringValue": "A String", # string

3491

"timestampValue": "A String", # timestamp

3492

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3493

# and time zone are either specified elsewhere or are not significant. The date

3494

# is relative to the Proleptic Gregorian Calendar. This can represent:

3495

#

3496

# * A full date, with non-zero year, month and day values

3497

# * A month and day value, with a zero year, e.g. an anniversary

3498

# * A year on its own, with zero month and day values

3499

# * A year and month value, with a zero day, e.g. a credit card expiration date

3500

#

3501

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3502

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3503

# month and day.

3504

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3505

# a year.

3506

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3507

# if specifying a year by itself or a year and month where the day is not

3508

# significant.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3509

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3510

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3511

},

3512

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

3513

# used.

3514

# Note that for the purposes of inspection or transformation, the number

3515

# of bytes considered to comprise a 'Value' is based on its representation

3516

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3517

# 123456789, the number of bytes would be counted as 9, even though an

3518

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3519

"integerValue": "A String", # integer

3520

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3521

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3522

# types are google.type.Date and `google.protobuf.Timestamp`.

3523

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3524

# allow the value 60 if it allows leap-seconds.

3525

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3526

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3527

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3528

# to allow the value "24:00:00" for scenarios like business closing time.

3529

},

3530

"dayOfWeekValue": "A String", # day of week

3531

"floatValue": 3.14, # float

3532

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3533

"timestampValue": "A String", # timestamp

3534

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3535

# and time zone are either specified elsewhere or are not significant. The date

3536

# is relative to the Proleptic Gregorian Calendar. This can represent:

3537

#

3538

# * A full date, with non-zero year, month and day values

3539

# * A month and day value, with a zero year, e.g. an anniversary

3540

# * A year on its own, with zero month and day values

3541

# * A year and month value, with a zero day, e.g. a credit card expiration date

3542

#

3543

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3544

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3545

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3546

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3547

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3548

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3549

# if specifying a year by itself or a year and month where the day is not

3550

# significant.

3551

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3552

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3562

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

3563

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

3564

# to learn more.

3565

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

3566

# If set, must also set cryptoKey. If set, shift will be consistent for the

3567

# given context.

3568

"name": "A String", # Name describing the field.

3569

},

3570

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

3571

# range (inclusive ends). Negative means shift to earlier in time. Must not

3572

# be more than 365250 days (1000 years) each direction.

3573

#

3574

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3575

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

3576

# results in the same shift for the same context and crypto_key. If

3577

# set, must also set context. Can only be applied to table items.

3578

# a key encryption key (KEK) stored by KMS).

3579

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3580

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3581

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3582

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3583

# It will be discarded after the request finishes.

3584

"name": "A String", # Required. Name of the key.

3585

# This is an arbitrary string used to differentiate different keys.

3586

# A unique key is generated per name: two separate `TransientCryptoKey`

3587

# protos share the same generated key if their names are the same.

3588

# When the data crypto key is generated, this name is not used in any way

3589

# (repeating the api call will result in a different key being generated).

3590

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3591

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3592

# The wrapped key must be a 128/192/256 bit key.

3593

# Authorization requires the following IAM permissions when sending a request

3594

# to perform a crypto transformation using a kms-wrapped crypto key:

3595

# dlp.kms.encrypt

3596

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3597

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3598

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3599

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3600

# leaking the key. Choose another type of key if possible.

3601

"key": "A String", # Required. A 128/192/256 bit key.

3602

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3603

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3604

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

3605

},

3606

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

3607

# portion of the value.

3608

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3609

},

3610

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

3611

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3612

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

3613

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

3614

# Note that for the purposes of inspection or transformation, the number

3615

# of bytes considered to comprise a 'Value' is based on its representation

3616

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3617

# 123456789, the number of bytes would be counted as 9, even though an

3618

# int64 only holds up to 8 bytes of data.

3619

"integerValue": "A String", # integer

3620

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3621

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3622

# types are google.type.Date and `google.protobuf.Timestamp`.

3623

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3624

# allow the value 60 if it allows leap-seconds.

3625

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3626

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3627

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3628

# to allow the value "24:00:00" for scenarios like business closing time.

3629

},

3630

"dayOfWeekValue": "A String", # day of week

3631

"floatValue": 3.14, # float

3632

"stringValue": "A String", # string

3633

"timestampValue": "A String", # timestamp

3634

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3635

# and time zone are either specified elsewhere or are not significant. The date

3636

# is relative to the Proleptic Gregorian Calendar. This can represent:

3637

#

3638

# * A full date, with non-zero year, month and day values

3639

# * A month and day value, with a zero year, e.g. an anniversary

3640

# * A year on its own, with zero month and day values

3641

# * A year and month value, with a zero day, e.g. a credit card expiration date

3642

#

3643

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3644

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3645

# month and day.

3646

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3647

# a year.

3648

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3649

# if specifying a year by itself or a year and month where the day is not

3650

# significant.

3651

},

3652

"booleanValue": True or False, # boolean

3653

},

3654

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3655

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

3656

# Uses SHA-256.

3657

# The key size must be either 32 or 64 bytes.

3658

# Outputs a base64 encoded representation of the hashed output

3659

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

3660

# Currently, only string and integer values can be hashed.

3661

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

3662

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

3663

# a key encryption key (KEK) stored by KMS).

3664

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3665

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3666

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3667

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3668

# It will be discarded after the request finishes.

3669

"name": "A String", # Required. Name of the key.

3670

# This is an arbitrary string used to differentiate different keys.

3671

# A unique key is generated per name: two separate `TransientCryptoKey`

3672

# protos share the same generated key if their names are the same.

3673

# When the data crypto key is generated, this name is not used in any way

3674

# (repeating the api call will result in a different key being generated).

3675

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3676

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3677

# The wrapped key must be a 128/192/256 bit key.

3678

# Authorization requires the following IAM permissions when sending a request

3679

# to perform a crypto transformation using a kms-wrapped crypto key:

3680

# dlp.kms.encrypt

3681

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3682

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3683

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3684

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3685

# leaking the key. Choose another type of key if possible.

3686

"key": "A String", # Required. A 128/192/256 bit key.

3687

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3688

},

3689

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3690

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

3691

# fixed character. Masking can start from the beginning or end of the string.

3692

# This can be used on data of any type (numbers, longs, and so on) and when

3693

# de-identifying structured data we'll attempt to preserve the original data's

3694

# type. (This allows you to take a long like 123 and modify it to a string like

3695

# **3.

3696

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

3697

# characters. For example, if the input string is `555-555-5555` and you

3698

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

3699

# returns `***-**5-5555`.

3700

{ # Characters to skip when doing deidentification of a value. These will be left

3701

# alone and skipped.

3702

"charactersToSkip": "A String", # Characters to not transform when masking.

3703

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

3708

# masked. Skipped characters do not count towards this tally.

3709

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

3710

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

3711

# code or credit card number. This string must have a length of 1. If not

3712

# supplied, this value defaults to `*` for strings, and `0` for digits.

3713

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

3714

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

3715

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

3716

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

3717

# is `true`, then the string `12345` is masked as `12***`.

3718

},

3719

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

3720

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

3721

# output would be 'My phone number is '.

3722

},

3723

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

3724

# Bucketing transformation can provide all of this functionality,

3725

# but requires more configuration. This message is provided as a convenience to

3726

# the user for simple bucketing strategies.

3727

#

3728

# The transformed value will be a hyphenated string of

3729

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

3730

# all values that are within this bucket will be replaced with "10-20".

3731

#

3732

# This can be used on data of type: double, long.

3733

#

3734

# If the bound Value type differs from the type of data

3735

# being transformed, we will first attempt converting the type of the data to

3736

# be transformed to match the type of the bound before comparing.

3737

#

3738

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

3739

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

3740

# grouped together into a single bucket; for example if `upper_bound` = 89,

3741

# then all values greater than 89 are replaced with the value "89+".

3742

# Note that for the purposes of inspection or transformation, the number

3743

# of bytes considered to comprise a 'Value' is based on its representation

3744

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3745

# 123456789, the number of bytes would be counted as 9, even though an

3746

# int64 only holds up to 8 bytes of data.

3747

"integerValue": "A String", # integer

3748

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3749

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3750

# types are google.type.Date and `google.protobuf.Timestamp`.

3751

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3752

# allow the value 60 if it allows leap-seconds.

3753

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3754

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3755

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3756

# to allow the value "24:00:00" for scenarios like business closing time.

3757

},

3758

"dayOfWeekValue": "A String", # day of week

3759

"floatValue": 3.14, # float

3760

"stringValue": "A String", # string

3761

"timestampValue": "A String", # timestamp

3762

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3763

# and time zone are either specified elsewhere or are not significant. The date

3764

# is relative to the Proleptic Gregorian Calendar. This can represent:

3765

#

3766

# * A full date, with non-zero year, month and day values

3767

# * A month and day value, with a zero year, e.g. an anniversary

3768

# * A year on its own, with zero month and day values

3769

# * A year and month value, with a zero day, e.g. a credit card expiration date

3770

#

3771

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3772

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3773

# month and day.

3774

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3775

# a year.

3776

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3777

# if specifying a year by itself or a year and month where the day is not

3778

# significant.

3779

},

3780

"booleanValue": True or False, # boolean

3781

},

3782

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

3783

# grouped together into a single bucket; for example if `lower_bound` = 10,

3784

# then all values less than 10 are replaced with the value "-10".

3785

# Note that for the purposes of inspection or transformation, the number

3786

# of bytes considered to comprise a 'Value' is based on its representation

3787

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

3788

# 123456789, the number of bytes would be counted as 9, even though an

3789

# int64 only holds up to 8 bytes of data.

3790

"integerValue": "A String", # integer

3791

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

3792

# or are specified elsewhere. An API may choose to allow leap seconds. Related

3793

# types are google.type.Date and `google.protobuf.Timestamp`.

3794

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

3795

# allow the value 60 if it allows leap-seconds.

3796

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

3797

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

3798

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

3799

# to allow the value "24:00:00" for scenarios like business closing time.

3800

},

3801

"dayOfWeekValue": "A String", # day of week

3802

"floatValue": 3.14, # float

3803

"stringValue": "A String", # string

3804

"timestampValue": "A String", # timestamp

3805

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

3806

# and time zone are either specified elsewhere or are not significant. The date

3807

# is relative to the Proleptic Gregorian Calendar. This can represent:

3808

#

3809

# * A full date, with non-zero year, month and day values

3810

# * A month and day value, with a zero year, e.g. an anniversary

3811

# * A year on its own, with zero month and day values

3812

# * A year and month value, with a zero day, e.g. a credit card expiration date

3813

#

3814

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

3815

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

3816

# month and day.

3817

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

3818

# a year.

3819

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

3820

# if specifying a year by itself or a year and month where the day is not

3821

# significant.

3822

},

3823

"booleanValue": True or False, # boolean

3824

},

3825

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

3826

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

3827

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

3828

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

3829

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3830

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

3831

# (FPE) with the FFX mode of operation; however when used in the

3832

# `ReidentifyContent` API method, it serves the opposite function by reversing

3833

# the surrogate back into the original identifier. The identifier must be

3834

# encoded as ASCII. For a given crypto key and context, the same identifier

3835

# will be replaced with the same surrogate. Identifiers must be at least two

3836

# characters long. In the case that the identifier is the empty string, it will

3837

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

3838

# more.

3839

#

3840

# Note: We recommend using CryptoDeterministicConfig for all use cases which

3841

# do not require preserving the input alphabet space and size, plus warrant

3842

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3843

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

3844

# This annotation will be applied to the surrogate by prefixing it with

3845

# the name of the custom infoType followed by the number of

3846

# characters comprising the surrogate. The following scheme defines the

3847

# format: info_type_name(surrogate_character_count):surrogate

3848

#

3849

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

3850

# the surrogate is 'abc', the full replacement value

3851

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

3852

#

3853

# This annotation identifies the surrogate when inspecting content using the

3854

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3855

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3856

# This facilitates reversal of the surrogate when it occurs in free text.

3857

#

3858

# In order for inspection to work properly, the name of this infoType must

3859

# not occur naturally anywhere in your data; otherwise, inspection may

3860

# find a surrogate that does not correspond to an actual identifier.

3861

# Therefore, choose your custom infoType name carefully after considering

3862

# what your data looks like. One way to select a name that has a high chance

3863

# of yielding reliable detection is to include one or more unicode characters

3864

# that are highly improbable to exist in your data.

3865

# For example, assuming your data is entered from a regular ASCII keyboard,

3866

# the symbol with the hex code point 29DD might be used like so:

3867

# ⧝MY_TOKEN_TYPE

3868

"name": "A String", # Name of the information type. Either a name of your choosing when

3869

# creating a CustomInfoType, or one of the names listed

3870

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3871

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

3872

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3873

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3874

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3875

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

3876

# identifier in two different contexts won't be given the same surrogate. If

3877

# the context is not set, a default tweak will be used.

3878

#

3879

# If the context is set but:

3880

#

3881

# 1. there is no record present when transforming a given value or

3882

# 1. the field is not present when transforming a given value,

3883

#

3884

# a default tweak will be used.

3885

#

3886

# Note that case (1) is expected when an `InfoTypeTransformation` is

3887

# applied to both structured and non-structured `ContentItem`s.

3888

# Currently, the referenced field may be of value type integer or string.

3889

#

3890

# The tweak is constructed as a sequence of bytes in big endian byte order

3891

# such that:

3892

#

3893

# - a 64 bit integer is encoded followed by a single byte of value 1

3894

# - a string is encoded in UTF-8 format followed by a single byte of value 2

3895

"name": "A String", # Name describing the field.

3896

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3897

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

3898

# that the FFX mode natively supports. This happens before/after

3899

# encryption/decryption.

3900

# Each character listed must appear only once.

3901

# Number of characters must be in the range [2, 95].

3902

# This must be encoded as ASCII.

3903

# The order of characters does not matter.

3904

# The full list of allowed characters is:

3905

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

3906

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3907

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

3908

# a key encryption key (KEK) stored by KMS).

3909

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

3910

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

3911

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3912

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

3913

# It will be discarded after the request finishes.

3914

"name": "A String", # Required. Name of the key.

3915

# This is an arbitrary string used to differentiate different keys.

3916

# A unique key is generated per name: two separate `TransientCryptoKey`

3917

# protos share the same generated key if their names are the same.

3918

# When the data crypto key is generated, this name is not used in any way

3919

# (repeating the api call will result in a different key being generated).

3920

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3921

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

3922

# The wrapped key must be a 128/192/256 bit key.

3923

# Authorization requires the following IAM permissions when sending a request

3924

# to perform a crypto transformation using a kms-wrapped crypto key:

3925

# dlp.kms.encrypt

3926

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

3927

"wrappedKey": "A String", # Required. The wrapped data crypto key.

3928

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3929

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

3930

# leaking the key. Choose another type of key if possible.

3931

"key": "A String", # Required. A 128/192/256 bit key.

3932

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3933

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

3934

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3935

},

3936

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

3937

# input. Outputs a base64 encoded representation of the encrypted output.

3938

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3939

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

3940

# referential integrity such that the same identifier in two different

3941

# contexts will be given a distinct surrogate. The context is appended to

3942

# plaintext value being encrypted. On decryption the provided context is

3943

# validated against the value used during encryption. If a context was

3944

# provided during encryption, same context must be provided during decryption

3945

# as well.

3946

#

3947

# If the context is not set, plaintext would be used as is for encryption.

3948

# If the context is set but:

3949

#

3950

# 1. there is no record present when transforming a given value or

3951

# 2. the field is not present when transforming a given value,

3952

#

3953

# plaintext would be used as is for encryption.

3954

#

3955

# Note that case (1) is expected when an `InfoTypeTransformation` is

3956

# applied to both structured and non-structured `ContentItem`s.

3957

"name": "A String", # Name describing the field.

3958

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3959

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

3960

# This annotation will be applied to the surrogate by prefixing it with

3961

# the name of the custom info type followed by the number of

3962

# characters comprising the surrogate. The following scheme defines the

3963

# format: {info type name}({surrogate character count}):{surrogate}

3964

#

3965

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

3966

# the surrogate is 'abc', the full replacement value

3967

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

3968

#

3969

# This annotation identifies the surrogate when inspecting content using the

3970

# custom info type 'Surrogate'. This facilitates reversal of the

3971

# surrogate when it occurs in free text.

3972

#

3973

# Note: For record transformations where the entire cell in a table is being

3974

# transformed, surrogates are not mandatory. Surrogates are used to denote

3975

# the location of the token and are necessary for re-identification in free

3976

# form text.

3977

#

3978

# In order for inspection to work properly, the name of this info type must

3979

# not occur naturally anywhere in your data; otherwise, inspection may either

3980

#

3981

# - reverse a surrogate that does not correspond to an actual identifier

3982

# - be unable to parse the surrogate and result in an error

3983

#

3984

# Therefore, choose your custom info type name carefully after considering

3985

# what your data looks like. One way to select a name that has a high chance

3986

# of yielding reliable detection is to include one or more unicode characters

3987

# that are highly improbable to exist in your data.

3988

# For example, assuming your data is entered from a regular ASCII keyboard,

3989

# the symbol with the hex code point 29DD might be used like so:

3990

# ⧝MY_TOKEN_TYPE.

3991

"name": "A String", # Name of the information type. Either a name of your choosing when

3992

# creating a CustomInfoType, or one of the names listed

3993

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

3994

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

3995

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

3996

},

3997

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

3998

# a key encryption key (KEK) stored by KMS).

3999

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

4000

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

4001

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4002

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

4003

# It will be discarded after the request finishes.

4004

"name": "A String", # Required. Name of the key.

4005

# This is an arbitrary string used to differentiate different keys.

4006

# A unique key is generated per name: two separate `TransientCryptoKey`

4007

# protos share the same generated key if their names are the same.

4008

# When the data crypto key is generated, this name is not used in any way

4009

# (repeating the api call will result in a different key being generated).

4010

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4011

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

4012

# The wrapped key must be a 128/192/256 bit key.

4013

# Authorization requires the following IAM permissions when sending a request

4014

# to perform a crypto transformation using a kms-wrapped crypto key:

4015

# dlp.kms.encrypt

4016

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4017

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4018

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4019

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

4020

# leaking the key. Choose another type of key if possible.

4021

"key": "A String", # Required. A 128/192/256 bit key.

4022

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4023

},

4024

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4025

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

4026

# replacement values are dynamically provided by the user for custom behavior,

4027

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

4028

# This can be used on

4029

# data of type: number, long, string, timestamp.

4030

# If the bound `Value` type differs from the type of data being transformed, we

4031

# will first attempt converting the type of the data to be transformed to match

4032

# the type of the bound before comparing.

4033

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

4034

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

4035

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4036

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4037

# Note that for the purposes of inspection or transformation, the number

4038

# of bytes considered to comprise a 'Value' is based on its representation

4039

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4040

# 123456789, the number of bytes would be counted as 9, even though an

4041

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4042

"integerValue": "A String", # integer

4043

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4044

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4045

# types are google.type.Date and `google.protobuf.Timestamp`.

4046

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4047

# allow the value 60 if it allows leap-seconds.

4048

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4049

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4050

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4051

# to allow the value "24:00:00" for scenarios like business closing time.

4052

},

4053

"dayOfWeekValue": "A String", # day of week

4054

"floatValue": 3.14, # float

4055

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4056

"timestampValue": "A String", # timestamp

4057

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4058

# and time zone are either specified elsewhere or are not significant. The date

4059

# is relative to the Proleptic Gregorian Calendar. This can represent:

4060

#

4061

# * A full date, with non-zero year, month and day values

4062

# * A month and day value, with a zero year, e.g. an anniversary

4063

# * A year on its own, with zero month and day values

4064

# * A year and month value, with a zero day, e.g. a credit card expiration date

4065

#

4066

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4067

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4068

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4069

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4070

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4071

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4072

# if specifying a year by itself or a year and month where the day is not

4073

# significant.

4074

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4075

"booleanValue": True or False, # boolean

4076

},

4077

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

4078

# Note that for the purposes of inspection or transformation, the number

4079

# of bytes considered to comprise a 'Value' is based on its representation

4080

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4081

# 123456789, the number of bytes would be counted as 9, even though an

4082

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4083

"integerValue": "A String", # integer

4084

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4085

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4086

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4087

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4088

# allow the value 60 if it allows leap-seconds.

4089

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4090

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4091

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4092

# to allow the value "24:00:00" for scenarios like business closing time.

4093

},

4094

"dayOfWeekValue": "A String", # day of week

4095

"floatValue": 3.14, # float

4096

"stringValue": "A String", # string

4097

"timestampValue": "A String", # timestamp

4098

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4099

# and time zone are either specified elsewhere or are not significant. The date

4100

# is relative to the Proleptic Gregorian Calendar. This can represent:

4101

#

4102

# * A full date, with non-zero year, month and day values

4103

# * A month and day value, with a zero year, e.g. an anniversary

4104

# * A year on its own, with zero month and day values

4105

# * A year and month value, with a zero day, e.g. a credit card expiration date

4106

#

4107

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4108

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4109

# month and day.

4110

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4111

# a year.

4112

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4113

# if specifying a year by itself or a year and month where the day is not

4114

# significant.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4115

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4116

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4117

},

4118

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

4119

# used.

4120

# Note that for the purposes of inspection or transformation, the number

4121

# of bytes considered to comprise a 'Value' is based on its representation

4122

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4123

# 123456789, the number of bytes would be counted as 9, even though an

4124

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4125

"integerValue": "A String", # integer

4126

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4127

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4128

# types are google.type.Date and `google.protobuf.Timestamp`.

4129

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4130

# allow the value 60 if it allows leap-seconds.

4131

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4132

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4133

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4134

# to allow the value "24:00:00" for scenarios like business closing time.

4135

},

4136

"dayOfWeekValue": "A String", # day of week

4137

"floatValue": 3.14, # float

4138

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4139

"timestampValue": "A String", # timestamp

4140

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4141

# and time zone are either specified elsewhere or are not significant. The date

4142

# is relative to the Proleptic Gregorian Calendar. This can represent:

4143

#

4144

# * A full date, with non-zero year, month and day values

4145

# * A month and day value, with a zero year, e.g. an anniversary

4146

# * A year on its own, with zero month and day values

4147

# * A year and month value, with a zero day, e.g. a credit card expiration date

4148

#

4149

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4150

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4151

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4152

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4153

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4154

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4155

# if specifying a year by itself or a year and month where the day is not

4156

# significant.

4157

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4158

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4163

},

4164

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

4165

# given `RecordCondition`. The conditions are allowed to reference fields

4166

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

4171

# column for the same record is within a specific range.

4172

# - Redact a field if the date of birth field is greater than 85.

4173

# a field.

4174

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4175

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

4176

"conditions": [ # A collection of conditions.

4177

{ # The field type of `value` and `field` do not need to match to be

4178

# considered equal, but not all comparisons are possible.

4179

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

4180

# but all other comparisons are invalid with incompatible types.

4181

# A `value` of type:

4182

#

4183

# - `string` can be compared against all other types

4184

# - `boolean` can only be compared against other booleans

4185

# - `integer` can be compared against doubles or a string if the string value

4186

# can be parsed as an integer.

4187

# - `double` can be compared against integers or a string if the string can

4188

# be parsed as a double.

4189

# - `Timestamp` can be compared against strings in RFC 3339 date string

4190

# format.

4191

# - `TimeOfDay` can be compared against timestamps and strings in the format

4192

# of 'HH:mm:ss'.

4193

#

4194

# If we fail to compare do to type mismatch, a warning will be given and

4195

# the condition will evaluate to false.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4196

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

4197

"name": "A String", # Name describing the field.

4198

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4199

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

4200

# Note that for the purposes of inspection or transformation, the number

4201

# of bytes considered to comprise a 'Value' is based on its representation

4202

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4203

# 123456789, the number of bytes would be counted as 9, even though an

4204

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4205

"integerValue": "A String", # integer

4206

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4207

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4208

# types are google.type.Date and `google.protobuf.Timestamp`.

4209

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4210

# allow the value 60 if it allows leap-seconds.

4211

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4212

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4213

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4214

# to allow the value "24:00:00" for scenarios like business closing time.

4215

},

4216

"dayOfWeekValue": "A String", # day of week

4217

"floatValue": 3.14, # float

4218

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4219

"timestampValue": "A String", # timestamp

4220

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4221

# and time zone are either specified elsewhere or are not significant. The date

4222

# is relative to the Proleptic Gregorian Calendar. This can represent:

4223

#

4224

# * A full date, with non-zero year, month and day values

4225

# * A month and day value, with a zero year, e.g. an anniversary

4226

# * A year on its own, with zero month and day values

4227

# * A year and month value, with a zero day, e.g. a credit card expiration date

4228

#

4229

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4230

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4231

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4232

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4233

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4234

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4235

# if specifying a year by itself or a year and month where the day is not

4236

# significant.

4237

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4238

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4239

},

4240

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4241

},

4242

],

4243

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4244

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

4245

# only supported value is `AND`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4246

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4247

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4248

"fields": [ # Required. Input field(s) to apply the transformation to.

4249

{ # General identifier of a data field in a storage service.

4250

"name": "A String", # Name describing the field.

4251

},

4252

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4257

"createTime": "A String", # Output only. The creation timestamp of an inspectTemplate.

4258

"updateTime": "A String", # Output only. The last update timestamp of an inspectTemplate.

4259

"description": "A String", # Short description (max 256 chars).

4260

"displayName": "A String", # Display name (max 256 chars).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

}</pre>

</div>

<code class="details" id="delete">delete(name, x__xgafv=None)</code>

4266

<pre>Deletes a DeidentifyTemplate.

4267

See https://cloud.google.com/dlp/docs/creating-templates-deid to learn

more.

Args:

name: string, Required. Resource name of the organization and deidentify template to be deleted,

4272

for example `organizations/433245324/deidentifyTemplates/432452342` or

4273

projects/project-id/deidentifyTemplates/432452342. (required)

4274

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

4281

4282

{ # A generic empty message that you can re-use to avoid defining duplicated

4283

# empty messages in your APIs. A typical example is to use it as the request

4284

# or the response type of an API method. For instance:

4285

#

4286

# service Foo {

4287

# rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty);

4288

# }

4289

#

4290

# The JSON representation for `Empty` is empty JSON object `{}`.

}</pre>

</div>

<code class="details" id="get">get(name, x__xgafv=None)</code>

4296

<pre>Gets a DeidentifyTemplate.

4297

See https://cloud.google.com/dlp/docs/creating-templates-deid to learn

more.

Args:

name: string, Required. Resource name of the organization and deidentify template to be read, for

4302

example `organizations/433245324/deidentifyTemplates/432452342` or

4303

projects/project-id/deidentifyTemplates/432452342. (required)

4304

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

4311

4312

{ # DeidentifyTemplates contains instructions on how to de-identify content.

4313

# See https://cloud.google.com/dlp/docs/concepts-templates to learn more.

4314

"name": "A String", # Output only. The template name.

4315

#

4316

# The template will have one of the following formats:

4317

# `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR

4318

# `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4319

"deidentifyConfig": { # The configuration that controls how the data will change. # ///////////// // The core content of the template // ///////////////

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4320

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text

4321

# transformation everywhere.

4322

# apply various `PrimitiveTransformation`s to each finding, where the

4323

# transformation is applied to only values that were identified as a specific

4324

# info_type.

4325

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

4326

# for a given infoType.

4327

{ # A transformation to apply to text that is identified as a specific

4328

# info_type.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4329

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

4330

# this transformation to apply to all findings that correspond to

4331

# infoTypes that were requested in `InspectConfig`.

4332

{ # Type of information detected by the API.

4333

"name": "A String", # Name of the information type. Either a name of your choosing when

4334

# creating a CustomInfoType, or one of the names listed

4335

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

4336

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

4337

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4338

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4339

],

4340

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4341

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

4342

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

4343

# to learn more.

4344

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

4345

# If set, must also set cryptoKey. If set, shift will be consistent for the

4346

# given context.

4347

"name": "A String", # Name describing the field.

4348

},

4349

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

4350

# range (inclusive ends). Negative means shift to earlier in time. Must not

4351

# be more than 365250 days (1000 years) each direction.

4352

#

4353

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4354

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

4355

# results in the same shift for the same context and crypto_key. If

4356

# set, must also set context. Can only be applied to table items.

4357

# a key encryption key (KEK) stored by KMS).

4358

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

4359

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

4360

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4361

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

4362

# It will be discarded after the request finishes.

4363

"name": "A String", # Required. Name of the key.

4364

# This is an arbitrary string used to differentiate different keys.

4365

# A unique key is generated per name: two separate `TransientCryptoKey`

4366

# protos share the same generated key if their names are the same.

4367

# When the data crypto key is generated, this name is not used in any way

4368

# (repeating the api call will result in a different key being generated).

4369

},

4370

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

4371

# The wrapped key must be a 128/192/256 bit key.

4372

# Authorization requires the following IAM permissions when sending a request

4373

# to perform a crypto transformation using a kms-wrapped crypto key:

4374

# dlp.kms.encrypt

4375

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4376

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4377

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4378

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

4379

# leaking the key. Choose another type of key if possible.

4380

"key": "A String", # Required. A 128/192/256 bit key.

4381

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4382

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4383

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

4384

},

4385

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

4386

# portion of the value.

4387

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4388

},

4389

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

4390

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4391

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

4392

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

4393

# Note that for the purposes of inspection or transformation, the number

4394

# of bytes considered to comprise a 'Value' is based on its representation

4395

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4396

# 123456789, the number of bytes would be counted as 9, even though an

4397

# int64 only holds up to 8 bytes of data.

4398

"integerValue": "A String", # integer

4399

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4400

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4401

# types are google.type.Date and `google.protobuf.Timestamp`.

4402

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4403

# allow the value 60 if it allows leap-seconds.

4404

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4405

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4406

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4407

# to allow the value "24:00:00" for scenarios like business closing time.

4408

},

4409

"dayOfWeekValue": "A String", # day of week

4410

"floatValue": 3.14, # float

4411

"stringValue": "A String", # string

4412

"timestampValue": "A String", # timestamp

4413

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4414

# and time zone are either specified elsewhere or are not significant. The date

4415

# is relative to the Proleptic Gregorian Calendar. This can represent:

4416

#

4417

# * A full date, with non-zero year, month and day values

4418

# * A month and day value, with a zero year, e.g. an anniversary

4419

# * A year on its own, with zero month and day values

4420

# * A year and month value, with a zero day, e.g. a credit card expiration date

4421

#

4422

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4423

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4424

# month and day.

4425

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4426

# a year.

4427

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4428

# if specifying a year by itself or a year and month where the day is not

4429

# significant.

4430

},

4431

"booleanValue": True or False, # boolean

4432

},

4433

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4434

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

4435

# Uses SHA-256.

4436

# The key size must be either 32 or 64 bytes.

4437

# Outputs a base64 encoded representation of the hashed output

4438

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

4439

# Currently, only string and integer values can be hashed.

4440

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

4441

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

4442

# a key encryption key (KEK) stored by KMS).

4443

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

4444

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

4445

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4446

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

4447

# It will be discarded after the request finishes.

4448

"name": "A String", # Required. Name of the key.

4449

# This is an arbitrary string used to differentiate different keys.

4450

# A unique key is generated per name: two separate `TransientCryptoKey`

4451

# protos share the same generated key if their names are the same.

4452

# When the data crypto key is generated, this name is not used in any way

4453

# (repeating the api call will result in a different key being generated).

4454

},

4455

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

4456

# The wrapped key must be a 128/192/256 bit key.

4457

# Authorization requires the following IAM permissions when sending a request

4458

# to perform a crypto transformation using a kms-wrapped crypto key:

4459

# dlp.kms.encrypt

4460

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4461

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4462

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4463

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

4464

# leaking the key. Choose another type of key if possible.

4465

"key": "A String", # Required. A 128/192/256 bit key.

4466

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4467

},

4468

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4469

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

4470

# fixed character. Masking can start from the beginning or end of the string.

4471

# This can be used on data of any type (numbers, longs, and so on) and when

4472

# de-identifying structured data we'll attempt to preserve the original data's

4473

# type. (This allows you to take a long like 123 and modify it to a string like

4474

# **3.

4475

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

4476

# characters. For example, if the input string is `555-555-5555` and you

4477

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

4478

# returns `***-**5-5555`.

4479

{ # Characters to skip when doing deidentification of a value. These will be left

4480

# alone and skipped.

4481

"charactersToSkip": "A String", # Characters to not transform when masking.

4482

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

4487

# masked. Skipped characters do not count towards this tally.

4488

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

4489

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

4490

# code or credit card number. This string must have a length of 1. If not

4491

# supplied, this value defaults to `*` for strings, and `0` for digits.

4492

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

4493

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

4494

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

4495

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

4496

# is `true`, then the string `12345` is masked as `12***`.

4497

},

4498

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

4499

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

4500

# output would be 'My phone number is '.

4501

},

4502

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

4503

# Bucketing transformation can provide all of this functionality,

4504

# but requires more configuration. This message is provided as a convenience to

4505

# the user for simple bucketing strategies.

4506

#

4507

# The transformed value will be a hyphenated string of

4508

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

4509

# all values that are within this bucket will be replaced with "10-20".

4510

#

4511

# This can be used on data of type: double, long.

4512

#

4513

# If the bound Value type differs from the type of data

4514

# being transformed, we will first attempt converting the type of the data to

4515

# be transformed to match the type of the bound before comparing.

4516

#

4517

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

4518

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

4519

# grouped together into a single bucket; for example if `upper_bound` = 89,

4520

# then all values greater than 89 are replaced with the value "89+".

4521

# Note that for the purposes of inspection or transformation, the number

4522

# of bytes considered to comprise a 'Value' is based on its representation

4523

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4524

# 123456789, the number of bytes would be counted as 9, even though an

4525

# int64 only holds up to 8 bytes of data.

4526

"integerValue": "A String", # integer

4527

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4528

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4529

# types are google.type.Date and `google.protobuf.Timestamp`.

4530

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4531

# allow the value 60 if it allows leap-seconds.

4532

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4533

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4534

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4535

# to allow the value "24:00:00" for scenarios like business closing time.

4536

},

4537

"dayOfWeekValue": "A String", # day of week

4538

"floatValue": 3.14, # float

4539

"stringValue": "A String", # string

4540

"timestampValue": "A String", # timestamp

4541

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4542

# and time zone are either specified elsewhere or are not significant. The date

4543

# is relative to the Proleptic Gregorian Calendar. This can represent:

4544

#

4545

# * A full date, with non-zero year, month and day values

4546

# * A month and day value, with a zero year, e.g. an anniversary

4547

# * A year on its own, with zero month and day values

4548

# * A year and month value, with a zero day, e.g. a credit card expiration date

4549

#

4550

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4551

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4552

# month and day.

4553

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4554

# a year.

4555

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4556

# if specifying a year by itself or a year and month where the day is not

4557

# significant.

4558

},

4559

"booleanValue": True or False, # boolean

4560

},

4561

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

4562

# grouped together into a single bucket; for example if `lower_bound` = 10,

4563

# then all values less than 10 are replaced with the value "-10".

4564

# Note that for the purposes of inspection or transformation, the number

4565

# of bytes considered to comprise a 'Value' is based on its representation

4566

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4567

# 123456789, the number of bytes would be counted as 9, even though an

4568

# int64 only holds up to 8 bytes of data.

4569

"integerValue": "A String", # integer

4570

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4571

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4572

# types are google.type.Date and `google.protobuf.Timestamp`.

4573

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4574

# allow the value 60 if it allows leap-seconds.

4575

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4576

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4577

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4578

# to allow the value "24:00:00" for scenarios like business closing time.

4579

},

4580

"dayOfWeekValue": "A String", # day of week

4581

"floatValue": 3.14, # float

4582

"stringValue": "A String", # string

4583

"timestampValue": "A String", # timestamp

4584

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4585

# and time zone are either specified elsewhere or are not significant. The date

4586

# is relative to the Proleptic Gregorian Calendar. This can represent:

4587

#

4588

# * A full date, with non-zero year, month and day values

4589

# * A month and day value, with a zero year, e.g. an anniversary

4590

# * A year on its own, with zero month and day values

4591

# * A year and month value, with a zero day, e.g. a credit card expiration date

4592

#

4593

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4594

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4595

# month and day.

4596

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4597

# a year.

4598

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4599

# if specifying a year by itself or a year and month where the day is not

4600

# significant.

4601

},

4602

"booleanValue": True or False, # boolean

4603

},

4604

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

4605

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

4606

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

4607

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

4608

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4609

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

4610

# (FPE) with the FFX mode of operation; however when used in the

4611

# `ReidentifyContent` API method, it serves the opposite function by reversing

4612

# the surrogate back into the original identifier. The identifier must be

4613

# encoded as ASCII. For a given crypto key and context, the same identifier

4614

# will be replaced with the same surrogate. Identifiers must be at least two

4615

# characters long. In the case that the identifier is the empty string, it will

4616

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

4617

# more.

4618

#

4619

# Note: We recommend using CryptoDeterministicConfig for all use cases which

4620

# do not require preserving the input alphabet space and size, plus warrant

4621

# referential integrity.

4622

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

4623

# This annotation will be applied to the surrogate by prefixing it with

4624

# the name of the custom infoType followed by the number of

4625

# characters comprising the surrogate. The following scheme defines the

4626

# format: info_type_name(surrogate_character_count):surrogate

4627

#

4628

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

4629

# the surrogate is 'abc', the full replacement value

4630

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

4631

#

4632

# This annotation identifies the surrogate when inspecting content using the

4633

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4634

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4635

# This facilitates reversal of the surrogate when it occurs in free text.

4636

#

4637

# In order for inspection to work properly, the name of this infoType must

4638

# not occur naturally anywhere in your data; otherwise, inspection may

4639

# find a surrogate that does not correspond to an actual identifier.

4640

# Therefore, choose your custom infoType name carefully after considering

4641

# what your data looks like. One way to select a name that has a high chance

4642

# of yielding reliable detection is to include one or more unicode characters

4643

# that are highly improbable to exist in your data.

4644

# For example, assuming your data is entered from a regular ASCII keyboard,

4645

# the symbol with the hex code point 29DD might be used like so:

4646

# ⧝MY_TOKEN_TYPE

4647

"name": "A String", # Name of the information type. Either a name of your choosing when

4648

# creating a CustomInfoType, or one of the names listed

4649

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4650

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

4651

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4652

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4653

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4654

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

4655

# identifier in two different contexts won't be given the same surrogate. If

4656

# the context is not set, a default tweak will be used.

4657

#

4658

# If the context is set but:

4659

#

4660

# 1. there is no record present when transforming a given value or

4661

# 1. the field is not present when transforming a given value,

4662

#

4663

# a default tweak will be used.

4664

#

4665

# Note that case (1) is expected when an `InfoTypeTransformation` is

4666

# applied to both structured and non-structured `ContentItem`s.

4667

# Currently, the referenced field may be of value type integer or string.

4668

#

4669

# The tweak is constructed as a sequence of bytes in big endian byte order

4670

# such that:

4671

#

4672

# - a 64 bit integer is encoded followed by a single byte of value 1

4673

# - a string is encoded in UTF-8 format followed by a single byte of value 2

4674

"name": "A String", # Name describing the field.

4675

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4676

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

4677

# that the FFX mode natively supports. This happens before/after

4678

# encryption/decryption.

4679

# Each character listed must appear only once.

4680

# Number of characters must be in the range [2, 95].

4681

# This must be encoded as ASCII.

4682

# The order of characters does not matter.

4683

# The full list of allowed characters is:

4684

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

4685

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4686

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

4687

# a key encryption key (KEK) stored by KMS).

4688

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

4689

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

4690

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4691

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

4692

# It will be discarded after the request finishes.

4693

"name": "A String", # Required. Name of the key.

4694

# This is an arbitrary string used to differentiate different keys.

4695

# A unique key is generated per name: two separate `TransientCryptoKey`

4696

# protos share the same generated key if their names are the same.

4697

# When the data crypto key is generated, this name is not used in any way

4698

# (repeating the api call will result in a different key being generated).

4699

},

4700

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

4701

# The wrapped key must be a 128/192/256 bit key.

4702

# Authorization requires the following IAM permissions when sending a request

4703

# to perform a crypto transformation using a kms-wrapped crypto key:

4704

# dlp.kms.encrypt

4705

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4706

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4707

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4708

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

4709

# leaking the key. Choose another type of key if possible.

4710

"key": "A String", # Required. A 128/192/256 bit key.

4711

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4712

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4713

"commonAlphabet": "A String", # Common alphabets.

4714

},

4715

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

4716

# input. Outputs a base64 encoded representation of the encrypted output.

4717

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4718

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

4719

# referential integrity such that the same identifier in two different

4720

# contexts will be given a distinct surrogate. The context is appended to

4721

# plaintext value being encrypted. On decryption the provided context is

4722

# validated against the value used during encryption. If a context was

4723

# provided during encryption, same context must be provided during decryption

4724

# as well.

4725

#

4726

# If the context is not set, plaintext would be used as is for encryption.

4727

# If the context is set but:

4728

#

4729

# 1. there is no record present when transforming a given value or

4730

# 2. the field is not present when transforming a given value,

4731

#

4732

# plaintext would be used as is for encryption.

4733

#

4734

# Note that case (1) is expected when an `InfoTypeTransformation` is

4735

# applied to both structured and non-structured `ContentItem`s.

4736

"name": "A String", # Name describing the field.

4737

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4738

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

4739

# This annotation will be applied to the surrogate by prefixing it with

4740

# the name of the custom info type followed by the number of

4741

# characters comprising the surrogate. The following scheme defines the

4742

# format: {info type name}({surrogate character count}):{surrogate}

4743

#

4744

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

4745

# the surrogate is 'abc', the full replacement value

4746

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

4747

#

4748

# This annotation identifies the surrogate when inspecting content using the

4749

# custom info type 'Surrogate'. This facilitates reversal of the

4750

# surrogate when it occurs in free text.

4751

#

4752

# Note: For record transformations where the entire cell in a table is being

4753

# transformed, surrogates are not mandatory. Surrogates are used to denote

4754

# the location of the token and are necessary for re-identification in free

4755

# form text.

4756

#

4757

# In order for inspection to work properly, the name of this info type must

4758

# not occur naturally anywhere in your data; otherwise, inspection may either

4759

#

4760

# - reverse a surrogate that does not correspond to an actual identifier

4761

# - be unable to parse the surrogate and result in an error

4762

#

4763

# Therefore, choose your custom info type name carefully after considering

4764

# what your data looks like. One way to select a name that has a high chance

4765

# of yielding reliable detection is to include one or more unicode characters

4766

# that are highly improbable to exist in your data.

4767

# For example, assuming your data is entered from a regular ASCII keyboard,

4768

# the symbol with the hex code point 29DD might be used like so:

4769

# ⧝MY_TOKEN_TYPE.

4770

"name": "A String", # Name of the information type. Either a name of your choosing when

4771

# creating a CustomInfoType, or one of the names listed

4772

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4773

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

4774

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4775

},

4776

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

4777

# a key encryption key (KEK) stored by KMS).

4778

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

4779

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

4780

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4781

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

4782

# It will be discarded after the request finishes.

4783

"name": "A String", # Required. Name of the key.

4784

# This is an arbitrary string used to differentiate different keys.

4785

# A unique key is generated per name: two separate `TransientCryptoKey`

4786

# protos share the same generated key if their names are the same.

4787

# When the data crypto key is generated, this name is not used in any way

4788

# (repeating the api call will result in a different key being generated).

4789

},

4790

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

4791

# The wrapped key must be a 128/192/256 bit key.

4792

# Authorization requires the following IAM permissions when sending a request

4793

# to perform a crypto transformation using a kms-wrapped crypto key:

4794

# dlp.kms.encrypt

4795

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

4796

"wrappedKey": "A String", # Required. The wrapped data crypto key.

4797

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4798

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

4799

# leaking the key. Choose another type of key if possible.

4800

"key": "A String", # Required. A 128/192/256 bit key.

4801

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4802

},

4803

},

4804

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

4805

# replacement values are dynamically provided by the user for custom behavior,

4806

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

4807

# This can be used on

4808

# data of type: number, long, string, timestamp.

4809

# If the bound `Value` type differs from the type of data being transformed, we

4810

# will first attempt converting the type of the data to be transformed to match

4811

# the type of the bound before comparing.

4812

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

4813

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

4814

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4815

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4816

# Note that for the purposes of inspection or transformation, the number

4817

# of bytes considered to comprise a 'Value' is based on its representation

4818

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4819

# 123456789, the number of bytes would be counted as 9, even though an

4820

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4821

"integerValue": "A String", # integer

4822

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4823

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4824

# types are google.type.Date and `google.protobuf.Timestamp`.

4825

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4826

# allow the value 60 if it allows leap-seconds.

4827

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4828

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4829

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4830

# to allow the value "24:00:00" for scenarios like business closing time.

4831

},

4832

"dayOfWeekValue": "A String", # day of week

4833

"floatValue": 3.14, # float

4834

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4835

"timestampValue": "A String", # timestamp

4836

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4837

# and time zone are either specified elsewhere or are not significant. The date

4838

# is relative to the Proleptic Gregorian Calendar. This can represent:

4839

#

4840

# * A full date, with non-zero year, month and day values

4841

# * A month and day value, with a zero year, e.g. an anniversary

4842

# * A year on its own, with zero month and day values

4843

# * A year and month value, with a zero day, e.g. a credit card expiration date

4844

#

4845

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4846

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4847

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4848

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4849

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4850

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4851

# if specifying a year by itself or a year and month where the day is not

4852

# significant.

4853

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4854

"booleanValue": True or False, # boolean

4855

},

4856

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

4857

# Note that for the purposes of inspection or transformation, the number

4858

# of bytes considered to comprise a 'Value' is based on its representation

4859

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4860

# 123456789, the number of bytes would be counted as 9, even though an

4861

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4862

"integerValue": "A String", # integer

4863

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4864

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4865

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4866

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4867

# allow the value 60 if it allows leap-seconds.

4868

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4869

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4870

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4871

# to allow the value "24:00:00" for scenarios like business closing time.

4872

},

4873

"dayOfWeekValue": "A String", # day of week

4874

"floatValue": 3.14, # float

4875

"stringValue": "A String", # string

4876

"timestampValue": "A String", # timestamp

4877

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4878

# and time zone are either specified elsewhere or are not significant. The date

4879

# is relative to the Proleptic Gregorian Calendar. This can represent:

4880

#

4881

# * A full date, with non-zero year, month and day values

4882

# * A month and day value, with a zero year, e.g. an anniversary

4883

# * A year on its own, with zero month and day values

4884

# * A year and month value, with a zero day, e.g. a credit card expiration date

4885

#

4886

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

4887

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4888

# month and day.

4889

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4890

# a year.

4891

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4892

# if specifying a year by itself or a year and month where the day is not

4893

# significant.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4894

},

4895

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4896

},

4897

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

4898

# used.

4899

# Note that for the purposes of inspection or transformation, the number

4900

# of bytes considered to comprise a 'Value' is based on its representation

4901

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

4902

# 123456789, the number of bytes would be counted as 9, even though an

4903

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4904

"integerValue": "A String", # integer

4905

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

4906

# or are specified elsewhere. An API may choose to allow leap seconds. Related

4907

# types are google.type.Date and `google.protobuf.Timestamp`.

4908

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

4909

# allow the value 60 if it allows leap-seconds.

4910

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

4911

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

4912

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

4913

# to allow the value "24:00:00" for scenarios like business closing time.

4914

},

4915

"dayOfWeekValue": "A String", # day of week

4916

"floatValue": 3.14, # float

4917

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4918

"timestampValue": "A String", # timestamp

4919

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

4920

# and time zone are either specified elsewhere or are not significant. The date

4921

# is relative to the Proleptic Gregorian Calendar. This can represent:

4922

#

4923

# * A full date, with non-zero year, month and day values

4924

# * A month and day value, with a zero year, e.g. an anniversary

4925

# * A year on its own, with zero month and day values

4926

# * A year and month value, with a zero day, e.g. a credit card expiration date

4927

#

4928

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4929

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

4930

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4931

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

4932

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4933

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

4934

# if specifying a year by itself or a year and month where the day is not

4935

# significant.

4936

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4937

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4942

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

4943

},

4944

],

4945

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4946

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default

4947

# mode is `TransformationErrorHandling.ThrowError`.

4948

# transformation error occurs when the requested transformation is incompatible

4949

# with the data. For example, trying to de-identify an IP address using a

4950

# `DateShift` transformation would result in a transformation error, since date

4951

# info cannot be extracted from an IP address.

4952

# Information about any incompatible transformations, and how they were

4953

# handled, is returned in the response as part of the

4954

# `TransformationOverviews`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4955

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would # Ignore errors

4956

# cause an error. For example, if a `DateShift` transformation were applied

4957

# an an IP address, this mode would leave the IP address unchanged in the

4958

# response.

4959

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4960

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

4961

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

4962

},

4963

"recordTransformations": { # A type of transformation that is applied over structured data such as a # Treat the dataset as structured. Transformations can be applied to

4964

# specific locations within structured datasets, such as transforming

4965

# a column within a table.

4966

# table.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

4967

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that

4968

# match any suppression rule are omitted from the output.

4969

{ # Configuration to suppress records whose suppression conditions evaluate to

4970

# true.

4971

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

4972

# evaluated to be suppressed from the transformed content.

4973

# a field.

4974

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

4975

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

4976

"conditions": [ # A collection of conditions.

4977

{ # The field type of `value` and `field` do not need to match to be

4978

# considered equal, but not all comparisons are possible.

4979

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

4980

# but all other comparisons are invalid with incompatible types.

4981

# A `value` of type:

4982

#

4983

# - `string` can be compared against all other types

4984

# - `boolean` can only be compared against other booleans

4985

# - `integer` can be compared against doubles or a string if the string value

4986

# can be parsed as an integer.

4987

# - `double` can be compared against integers or a string if the string can

4988

# be parsed as a double.

4989

# - `Timestamp` can be compared against strings in RFC 3339 date string

4990

# format.

4991

# - `TimeOfDay` can be compared against timestamps and strings in the format

4992

# of 'HH:mm:ss'.

4993

#

4994

# If we fail to compare do to type mismatch, a warning will be given and

4995

# the condition will evaluate to false.

4996

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

4997

"name": "A String", # Name describing the field.

4998

},

4999

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

5000

# Note that for the purposes of inspection or transformation, the number

5001

# of bytes considered to comprise a 'Value' is based on its representation

5002

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5003

# 123456789, the number of bytes would be counted as 9, even though an

5004

# int64 only holds up to 8 bytes of data.

5005

"integerValue": "A String", # integer

5006

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

5007

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5008

# types are google.type.Date and `google.protobuf.Timestamp`.

5009

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5010

# allow the value 60 if it allows leap-seconds.

5011

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

5012

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

5013

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5014

# to allow the value "24:00:00" for scenarios like business closing time.

5015

},

5016

"dayOfWeekValue": "A String", # day of week

5017

"floatValue": 3.14, # float

5018

"stringValue": "A String", # string

5019

"timestampValue": "A String", # timestamp

5020

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5021

# and time zone are either specified elsewhere or are not significant. The date

5022

# is relative to the Proleptic Gregorian Calendar. This can represent:

5023

#

5024

# * A full date, with non-zero year, month and day values

5025

# * A month and day value, with a zero year, e.g. an anniversary

5026

# * A year on its own, with zero month and day values

5027

# * A year and month value, with a zero day, e.g. a credit card expiration date

5028

#

5029

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

5030

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5031

# month and day.

5032

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5033

# a year.

5034

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5035

# if specifying a year by itself or a year and month where the day is not

5036

# significant.

5037

},

5038

"booleanValue": True or False, # boolean

5039

},

5040

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

},

],

},

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

5045

# only supported value is `AND`.

},

},

},

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5050

"fieldTransformations": [ # Transform the record by applying various field transformations.

5051

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5052

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

5053

# transform content that matches an `InfoType`.

5054

# apply various `PrimitiveTransformation`s to each finding, where the

5055

# transformation is applied to only values that were identified as a specific

5056

# info_type.

5057

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

5058

# for a given infoType.

5059

{ # A transformation to apply to text that is identified as a specific

5060

# info_type.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5061

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

5062

# this transformation to apply to all findings that correspond to

5063

# infoTypes that were requested in `InspectConfig`.

5064

{ # Type of information detected by the API.

5065

"name": "A String", # Name of the information type. Either a name of your choosing when

5066

# creating a CustomInfoType, or one of the names listed

5067

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

5068

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

5069

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5070

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5071

],

5072

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5073

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

5074

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

5075

# to learn more.

5076

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

5077

# If set, must also set cryptoKey. If set, shift will be consistent for the

5078

# given context.

5079

"name": "A String", # Name describing the field.

5080

},

5081

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

5082

# range (inclusive ends). Negative means shift to earlier in time. Must not

5083

# be more than 365250 days (1000 years) each direction.

5084

#

5085

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5086

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

5087

# results in the same shift for the same context and crypto_key. If

5088

# set, must also set context. Can only be applied to table items.

5089

# a key encryption key (KEK) stored by KMS).

5090

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5091

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5092

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5093

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5094

# It will be discarded after the request finishes.

5095

"name": "A String", # Required. Name of the key.

5096

# This is an arbitrary string used to differentiate different keys.

5097

# A unique key is generated per name: two separate `TransientCryptoKey`

5098

# protos share the same generated key if their names are the same.

5099

# When the data crypto key is generated, this name is not used in any way

5100

# (repeating the api call will result in a different key being generated).

5101

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5102

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5103

# The wrapped key must be a 128/192/256 bit key.

5104

# Authorization requires the following IAM permissions when sending a request

5105

# to perform a crypto transformation using a kms-wrapped crypto key:

5106

# dlp.kms.encrypt

5107

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5108

"wrappedKey": "A String", # Required. The wrapped data crypto key.

5109

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5110

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5111

# leaking the key. Choose another type of key if possible.

5112

"key": "A String", # Required. A 128/192/256 bit key.

5113

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5114

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5115

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

5116

},

5117

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

5118

# portion of the value.

5119

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5120

},

5121

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

5122

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5123

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

5124

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

5125

# Note that for the purposes of inspection or transformation, the number

5126

# of bytes considered to comprise a 'Value' is based on its representation

5127

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5128

# 123456789, the number of bytes would be counted as 9, even though an

5129

# int64 only holds up to 8 bytes of data.

5130

"integerValue": "A String", # integer

5131

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

5132

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5133

# types are google.type.Date and `google.protobuf.Timestamp`.

5134

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5135

# allow the value 60 if it allows leap-seconds.

5136

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

5137

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

5138

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5139

# to allow the value "24:00:00" for scenarios like business closing time.

5140

},

5141

"dayOfWeekValue": "A String", # day of week

5142

"floatValue": 3.14, # float

5143

"stringValue": "A String", # string

5144

"timestampValue": "A String", # timestamp

5145

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5146

# and time zone are either specified elsewhere or are not significant. The date

5147

# is relative to the Proleptic Gregorian Calendar. This can represent:

5148

#

5149

# * A full date, with non-zero year, month and day values

5150

# * A month and day value, with a zero year, e.g. an anniversary

5151

# * A year on its own, with zero month and day values

5152

# * A year and month value, with a zero day, e.g. a credit card expiration date

5153

#

5154

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

5155

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5156

# month and day.

5157

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5158

# a year.

5159

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5160

# if specifying a year by itself or a year and month where the day is not

5161

# significant.

5162

},

5163

"booleanValue": True or False, # boolean

5164

},

5165

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5166

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

5167

# Uses SHA-256.

5168

# The key size must be either 32 or 64 bytes.

5169

# Outputs a base64 encoded representation of the hashed output

5170

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

5171

# Currently, only string and integer values can be hashed.

5172

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

5173

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

5174

# a key encryption key (KEK) stored by KMS).

5175

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5176

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5177

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5178

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5179

# It will be discarded after the request finishes.

5180

"name": "A String", # Required. Name of the key.

5181

# This is an arbitrary string used to differentiate different keys.

5182

# A unique key is generated per name: two separate `TransientCryptoKey`

5183

# protos share the same generated key if their names are the same.

5184

# When the data crypto key is generated, this name is not used in any way

5185

# (repeating the api call will result in a different key being generated).

5186

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5187

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5188

# The wrapped key must be a 128/192/256 bit key.

5189

# Authorization requires the following IAM permissions when sending a request

5190

# to perform a crypto transformation using a kms-wrapped crypto key:

5191

# dlp.kms.encrypt

5192

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5193

"wrappedKey": "A String", # Required. The wrapped data crypto key.

5194

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5195

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5196

# leaking the key. Choose another type of key if possible.

5197

"key": "A String", # Required. A 128/192/256 bit key.

5198

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5199

},

5200

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5201

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

5202

# fixed character. Masking can start from the beginning or end of the string.

5203

# This can be used on data of any type (numbers, longs, and so on) and when

5204

# de-identifying structured data we'll attempt to preserve the original data's

5205

# type. (This allows you to take a long like 123 and modify it to a string like

5206

# **3.

5207

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

5208

# characters. For example, if the input string is `555-555-5555` and you

5209

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

5210

# returns `***-**5-5555`.

5211

{ # Characters to skip when doing deidentification of a value. These will be left

5212

# alone and skipped.

5213

"charactersToSkip": "A String", # Characters to not transform when masking.

5214

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

5219

# masked. Skipped characters do not count towards this tally.

5220

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

5221

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

5222

# code or credit card number. This string must have a length of 1. If not

5223

# supplied, this value defaults to `*` for strings, and `0` for digits.

5224

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

5225

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

5226

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

5227

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

5228

# is `true`, then the string `12345` is masked as `12***`.

5229

},

5230

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

5231

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

5232

# output would be 'My phone number is '.

5233

},

5234

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

5235

# Bucketing transformation can provide all of this functionality,

5236

# but requires more configuration. This message is provided as a convenience to

5237

# the user for simple bucketing strategies.

5238

#

5239

# The transformed value will be a hyphenated string of

5240

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

5241

# all values that are within this bucket will be replaced with "10-20".

5242

#

5243

# This can be used on data of type: double, long.

5244

#

5245

# If the bound Value type differs from the type of data

5246

# being transformed, we will first attempt converting the type of the data to

5247

# be transformed to match the type of the bound before comparing.

5248

#

5249

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

5250

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

5251

# grouped together into a single bucket; for example if `upper_bound` = 89,

5252

# then all values greater than 89 are replaced with the value "89+".

5253

# Note that for the purposes of inspection or transformation, the number

5254

# of bytes considered to comprise a 'Value' is based on its representation

5255

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5256

# 123456789, the number of bytes would be counted as 9, even though an

5257

# int64 only holds up to 8 bytes of data.

5258

"integerValue": "A String", # integer

5259

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

5260

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5261

# types are google.type.Date and `google.protobuf.Timestamp`.

5262

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5263

# allow the value 60 if it allows leap-seconds.

5264

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

5265

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

5266

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5267

# to allow the value "24:00:00" for scenarios like business closing time.

5268

},

5269

"dayOfWeekValue": "A String", # day of week

5270

"floatValue": 3.14, # float

5271

"stringValue": "A String", # string

5272

"timestampValue": "A String", # timestamp

5273

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5274

# and time zone are either specified elsewhere or are not significant. The date

5275

# is relative to the Proleptic Gregorian Calendar. This can represent:

5276

#

5277

# * A full date, with non-zero year, month and day values

5278

# * A month and day value, with a zero year, e.g. an anniversary

5279

# * A year on its own, with zero month and day values

5280

# * A year and month value, with a zero day, e.g. a credit card expiration date

5281

#

5282

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

5283

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5284

# month and day.

5285

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5286

# a year.

5287

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5288

# if specifying a year by itself or a year and month where the day is not

5289

# significant.

5290

},

5291

"booleanValue": True or False, # boolean

5292

},

5293

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

5294

# grouped together into a single bucket; for example if `lower_bound` = 10,

5295

# then all values less than 10 are replaced with the value "-10".

5296

# Note that for the purposes of inspection or transformation, the number

5297

# of bytes considered to comprise a 'Value' is based on its representation

5298

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5299

# 123456789, the number of bytes would be counted as 9, even though an

5300

# int64 only holds up to 8 bytes of data.

5301

"integerValue": "A String", # integer

5302

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

5303

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5304

# types are google.type.Date and `google.protobuf.Timestamp`.

5305

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5306

# allow the value 60 if it allows leap-seconds.

5307

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

5308

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

5309

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5310

# to allow the value "24:00:00" for scenarios like business closing time.

5311

},

5312

"dayOfWeekValue": "A String", # day of week

5313

"floatValue": 3.14, # float

5314

"stringValue": "A String", # string

5315

"timestampValue": "A String", # timestamp

5316

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5317

# and time zone are either specified elsewhere or are not significant. The date

5318

# is relative to the Proleptic Gregorian Calendar. This can represent:

5319

#

5320

# * A full date, with non-zero year, month and day values

5321

# * A month and day value, with a zero year, e.g. an anniversary

5322

# * A year on its own, with zero month and day values

5323

# * A year and month value, with a zero day, e.g. a credit card expiration date

5324

#

5325

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

5326

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5327

# month and day.

5328

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5329

# a year.

5330

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5331

# if specifying a year by itself or a year and month where the day is not

5332

# significant.

5333

},

5334

"booleanValue": True or False, # boolean

5335

},

5336

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

5337

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

5338

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

5339

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

5340

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5341

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

5342

# (FPE) with the FFX mode of operation; however when used in the

5343

# `ReidentifyContent` API method, it serves the opposite function by reversing

5344

# the surrogate back into the original identifier. The identifier must be

5345

# encoded as ASCII. For a given crypto key and context, the same identifier

5346

# will be replaced with the same surrogate. Identifiers must be at least two

5347

# characters long. In the case that the identifier is the empty string, it will

5348

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

5349

# more.

5350

#

5351

# Note: We recommend using CryptoDeterministicConfig for all use cases which

5352

# do not require preserving the input alphabet space and size, plus warrant

5353

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5354

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

5355

# This annotation will be applied to the surrogate by prefixing it with

5356

# the name of the custom infoType followed by the number of

5357

# characters comprising the surrogate. The following scheme defines the

5358

# format: info_type_name(surrogate_character_count):surrogate

5359

#

5360

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

5361

# the surrogate is 'abc', the full replacement value

5362

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

5363

#

5364

# This annotation identifies the surrogate when inspecting content using the

5365

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5366

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5367

# This facilitates reversal of the surrogate when it occurs in free text.

5368

#

5369

# In order for inspection to work properly, the name of this infoType must

5370

# not occur naturally anywhere in your data; otherwise, inspection may

5371

# find a surrogate that does not correspond to an actual identifier.

5372

# Therefore, choose your custom infoType name carefully after considering

5373

# what your data looks like. One way to select a name that has a high chance

5374

# of yielding reliable detection is to include one or more unicode characters

5375

# that are highly improbable to exist in your data.

5376

# For example, assuming your data is entered from a regular ASCII keyboard,

5377

# the symbol with the hex code point 29DD might be used like so:

5378

# ⧝MY_TOKEN_TYPE

5379

"name": "A String", # Name of the information type. Either a name of your choosing when

5380

# creating a CustomInfoType, or one of the names listed

5381

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5382

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

5383

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5384

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5385

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5386

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

5387

# identifier in two different contexts won't be given the same surrogate. If

5388

# the context is not set, a default tweak will be used.

5389

#

5390

# If the context is set but:

5391

#

5392

# 1. there is no record present when transforming a given value or

5393

# 1. the field is not present when transforming a given value,

5394

#

5395

# a default tweak will be used.

5396

#

5397

# Note that case (1) is expected when an `InfoTypeTransformation` is

5398

# applied to both structured and non-structured `ContentItem`s.

5399

# Currently, the referenced field may be of value type integer or string.

5400

#

5401

# The tweak is constructed as a sequence of bytes in big endian byte order

5402

# such that:

5403

#

5404

# - a 64 bit integer is encoded followed by a single byte of value 1

5405

# - a string is encoded in UTF-8 format followed by a single byte of value 2

5406

"name": "A String", # Name describing the field.

5407

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5408

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

5409

# that the FFX mode natively supports. This happens before/after

5410

# encryption/decryption.

5411

# Each character listed must appear only once.

5412

# Number of characters must be in the range [2, 95].

5413

# This must be encoded as ASCII.

5414

# The order of characters does not matter.

5415

# The full list of allowed characters is:

5416

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

5417

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5418

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

5419

# a key encryption key (KEK) stored by KMS).

5420

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5421

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5422

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5423

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5424

# It will be discarded after the request finishes.

5425

"name": "A String", # Required. Name of the key.

5426

# This is an arbitrary string used to differentiate different keys.

5427

# A unique key is generated per name: two separate `TransientCryptoKey`

5428

# protos share the same generated key if their names are the same.

5429

# When the data crypto key is generated, this name is not used in any way

5430

# (repeating the api call will result in a different key being generated).

5431

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5432

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5433

# The wrapped key must be a 128/192/256 bit key.

5434

# Authorization requires the following IAM permissions when sending a request

5435

# to perform a crypto transformation using a kms-wrapped crypto key:

5436

# dlp.kms.encrypt

5437

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5438

"wrappedKey": "A String", # Required. The wrapped data crypto key.

5439

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5440

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5441

# leaking the key. Choose another type of key if possible.

5442

"key": "A String", # Required. A 128/192/256 bit key.

5443

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5444

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5445

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5446

},

5447

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

5448

# input. Outputs a base64 encoded representation of the encrypted output.

5449

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5450

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

5451

# referential integrity such that the same identifier in two different

5452

# contexts will be given a distinct surrogate. The context is appended to

5453

# plaintext value being encrypted. On decryption the provided context is

5454

# validated against the value used during encryption. If a context was

5455

# provided during encryption, same context must be provided during decryption

5456

# as well.

5457

#

5458

# If the context is not set, plaintext would be used as is for encryption.

5459

# If the context is set but:

5460

#

5461

# 1. there is no record present when transforming a given value or

5462

# 2. the field is not present when transforming a given value,

5463

#

5464

# plaintext would be used as is for encryption.

5465

#

5466

# Note that case (1) is expected when an `InfoTypeTransformation` is

5467

# applied to both structured and non-structured `ContentItem`s.

5468

"name": "A String", # Name describing the field.

5469

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5470

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

5471

# This annotation will be applied to the surrogate by prefixing it with

5472

# the name of the custom info type followed by the number of

5473

# characters comprising the surrogate. The following scheme defines the

5474

# format: {info type name}({surrogate character count}):{surrogate}

5475

#

5476

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

5477

# the surrogate is 'abc', the full replacement value

5478

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

5479

#

5480

# This annotation identifies the surrogate when inspecting content using the

5481

# custom info type 'Surrogate'. This facilitates reversal of the

5482

# surrogate when it occurs in free text.

5483

#

5484

# Note: For record transformations where the entire cell in a table is being

5485

# transformed, surrogates are not mandatory. Surrogates are used to denote

5486

# the location of the token and are necessary for re-identification in free

5487

# form text.

5488

#

5489

# In order for inspection to work properly, the name of this info type must

5490

# not occur naturally anywhere in your data; otherwise, inspection may either

5491

#

5492

# - reverse a surrogate that does not correspond to an actual identifier

5493

# - be unable to parse the surrogate and result in an error

5494

#

5495

# Therefore, choose your custom info type name carefully after considering

5496

# what your data looks like. One way to select a name that has a high chance

5497

# of yielding reliable detection is to include one or more unicode characters

5498

# that are highly improbable to exist in your data.

5499

# For example, assuming your data is entered from a regular ASCII keyboard,

5500

# the symbol with the hex code point 29DD might be used like so:

5501

# ⧝MY_TOKEN_TYPE.

5502

"name": "A String", # Name of the information type. Either a name of your choosing when

5503

# creating a CustomInfoType, or one of the names listed

5504

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5505

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

5506

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5507

},

5508

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

5509

# a key encryption key (KEK) stored by KMS).

5510

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5511

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5512

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5513

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5514

# It will be discarded after the request finishes.

5515

"name": "A String", # Required. Name of the key.

5516

# This is an arbitrary string used to differentiate different keys.

5517

# A unique key is generated per name: two separate `TransientCryptoKey`

5518

# protos share the same generated key if their names are the same.

5519

# When the data crypto key is generated, this name is not used in any way

5520

# (repeating the api call will result in a different key being generated).

5521

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5522

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5523

# The wrapped key must be a 128/192/256 bit key.

5524

# Authorization requires the following IAM permissions when sending a request

5525

# to perform a crypto transformation using a kms-wrapped crypto key:

5526

# dlp.kms.encrypt

5527

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5528

"wrappedKey": "A String", # Required. The wrapped data crypto key.

5529

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5530

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5531

# leaking the key. Choose another type of key if possible.

5532

"key": "A String", # Required. A 128/192/256 bit key.

5533

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5534

},

5535

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5536

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

5537

# replacement values are dynamically provided by the user for custom behavior,

5538

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

5539

# This can be used on

5540

# data of type: number, long, string, timestamp.

5541

# If the bound `Value` type differs from the type of data being transformed, we

5542

# will first attempt converting the type of the data to be transformed to match

5543

# the type of the bound before comparing.

5544

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

5545

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

5546

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5547

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5548

# Note that for the purposes of inspection or transformation, the number

5549

# of bytes considered to comprise a 'Value' is based on its representation

5550

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5551

# 123456789, the number of bytes would be counted as 9, even though an

5552

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5553

"integerValue": "A String", # integer

5554

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

5555

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5556

# types are google.type.Date and `google.protobuf.Timestamp`.

5557

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5558

# allow the value 60 if it allows leap-seconds.

5559

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

5560

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

5561

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5562

# to allow the value "24:00:00" for scenarios like business closing time.

5563

},

5564

"dayOfWeekValue": "A String", # day of week

5565

"floatValue": 3.14, # float

5566

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5567

"timestampValue": "A String", # timestamp

5568

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5569

# and time zone are either specified elsewhere or are not significant. The date

5570

# is relative to the Proleptic Gregorian Calendar. This can represent:

5571

#

5572

# * A full date, with non-zero year, month and day values

5573

# * A month and day value, with a zero year, e.g. an anniversary

5574

# * A year on its own, with zero month and day values

5575

# * A year and month value, with a zero day, e.g. a credit card expiration date

5576

#

5577

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5578

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5579

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5580

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5581

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5582

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5583

# if specifying a year by itself or a year and month where the day is not

5584

# significant.

5585

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5586

"booleanValue": True or False, # boolean

5587

},

5588

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

5589

# Note that for the purposes of inspection or transformation, the number

5590

# of bytes considered to comprise a 'Value' is based on its representation

5591

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5592

# 123456789, the number of bytes would be counted as 9, even though an

5593

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5594

"integerValue": "A String", # integer

5595

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

5596

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5597

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5598

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5599

# allow the value 60 if it allows leap-seconds.

5600

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5601

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

5602

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5603

# to allow the value "24:00:00" for scenarios like business closing time.

5604

},

5605

"dayOfWeekValue": "A String", # day of week

5606

"floatValue": 3.14, # float

5607

"stringValue": "A String", # string

5608

"timestampValue": "A String", # timestamp

5609

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5610

# and time zone are either specified elsewhere or are not significant. The date

5611

# is relative to the Proleptic Gregorian Calendar. This can represent:

5612

#

5613

# * A full date, with non-zero year, month and day values

5614

# * A month and day value, with a zero year, e.g. an anniversary

5615

# * A year on its own, with zero month and day values

5616

# * A year and month value, with a zero day, e.g. a credit card expiration date

5617

#

5618

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

5619

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5620

# month and day.

5621

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5622

# a year.

5623

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5624

# if specifying a year by itself or a year and month where the day is not

5625

# significant.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5626

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5627

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5628

},

5629

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

5630

# used.

5631

# Note that for the purposes of inspection or transformation, the number

5632

# of bytes considered to comprise a 'Value' is based on its representation

5633

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5634

# 123456789, the number of bytes would be counted as 9, even though an

5635

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5636

"integerValue": "A String", # integer

5637

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

5638

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5639

# types are google.type.Date and `google.protobuf.Timestamp`.

5640

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5641

# allow the value 60 if it allows leap-seconds.

5642

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

5643

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

5644

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5645

# to allow the value "24:00:00" for scenarios like business closing time.

5646

},

5647

"dayOfWeekValue": "A String", # day of week

5648

"floatValue": 3.14, # float

5649

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5650

"timestampValue": "A String", # timestamp

5651

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5652

# and time zone are either specified elsewhere or are not significant. The date

5653

# is relative to the Proleptic Gregorian Calendar. This can represent:

5654

#

5655

# * A full date, with non-zero year, month and day values

5656

# * A month and day value, with a zero year, e.g. an anniversary

5657

# * A year on its own, with zero month and day values

5658

# * A year and month value, with a zero day, e.g. a credit card expiration date

5659

#

5660

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5661

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5662

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5663

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5664

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5665

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5666

# if specifying a year by itself or a year and month where the day is not

5667

# significant.

5668

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5669

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5679

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

5680

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

5681

# to learn more.

5682

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

5683

# If set, must also set cryptoKey. If set, shift will be consistent for the

5684

# given context.

5685

"name": "A String", # Name describing the field.

5686

},

5687

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

5688

# range (inclusive ends). Negative means shift to earlier in time. Must not

5689

# be more than 365250 days (1000 years) each direction.

5690

#

5691

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5692

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

5693

# results in the same shift for the same context and crypto_key. If

5694

# set, must also set context. Can only be applied to table items.

5695

# a key encryption key (KEK) stored by KMS).

5696

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5697

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5698

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5699

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5700

# It will be discarded after the request finishes.

5701

"name": "A String", # Required. Name of the key.

5702

# This is an arbitrary string used to differentiate different keys.

5703

# A unique key is generated per name: two separate `TransientCryptoKey`

5704

# protos share the same generated key if their names are the same.

5705

# When the data crypto key is generated, this name is not used in any way

5706

# (repeating the api call will result in a different key being generated).

5707

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5708

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5709

# The wrapped key must be a 128/192/256 bit key.

5710

# Authorization requires the following IAM permissions when sending a request

5711

# to perform a crypto transformation using a kms-wrapped crypto key:

5712

# dlp.kms.encrypt

5713

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5714

"wrappedKey": "A String", # Required. The wrapped data crypto key.

5715

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5716

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5717

# leaking the key. Choose another type of key if possible.

5718

"key": "A String", # Required. A 128/192/256 bit key.

5719

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5720

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5721

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

5722

},

5723

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

5724

# portion of the value.

5725

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5726

},

5727

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

5728

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5729

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

5730

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

5731

# Note that for the purposes of inspection or transformation, the number

5732

# of bytes considered to comprise a 'Value' is based on its representation

5733

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5734

# 123456789, the number of bytes would be counted as 9, even though an

5735

# int64 only holds up to 8 bytes of data.

5736

"integerValue": "A String", # integer

5737

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

5738

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5739

# types are google.type.Date and `google.protobuf.Timestamp`.

5740

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5741

# allow the value 60 if it allows leap-seconds.

5742

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

5743

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

5744

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5745

# to allow the value "24:00:00" for scenarios like business closing time.

5746

},

5747

"dayOfWeekValue": "A String", # day of week

5748

"floatValue": 3.14, # float

5749

"stringValue": "A String", # string

5750

"timestampValue": "A String", # timestamp

5751

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5752

# and time zone are either specified elsewhere or are not significant. The date

5753

# is relative to the Proleptic Gregorian Calendar. This can represent:

5754

#

5755

# * A full date, with non-zero year, month and day values

5756

# * A month and day value, with a zero year, e.g. an anniversary

5757

# * A year on its own, with zero month and day values

5758

# * A year and month value, with a zero day, e.g. a credit card expiration date

5759

#

5760

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

5761

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5762

# month and day.

5763

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5764

# a year.

5765

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5766

# if specifying a year by itself or a year and month where the day is not

5767

# significant.

5768

},

5769

"booleanValue": True or False, # boolean

5770

},

5771

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5772

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

5773

# Uses SHA-256.

5774

# The key size must be either 32 or 64 bytes.

5775

# Outputs a base64 encoded representation of the hashed output

5776

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

5777

# Currently, only string and integer values can be hashed.

5778

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

5779

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

5780

# a key encryption key (KEK) stored by KMS).

5781

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

5782

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

5783

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5784

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

5785

# It will be discarded after the request finishes.

5786

"name": "A String", # Required. Name of the key.

5787

# This is an arbitrary string used to differentiate different keys.

5788

# A unique key is generated per name: two separate `TransientCryptoKey`

5789

# protos share the same generated key if their names are the same.

5790

# When the data crypto key is generated, this name is not used in any way

5791

# (repeating the api call will result in a different key being generated).

5792

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

5793

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

5794

# The wrapped key must be a 128/192/256 bit key.

5795

# Authorization requires the following IAM permissions when sending a request

5796

# to perform a crypto transformation using a kms-wrapped crypto key:

5797

# dlp.kms.encrypt

5798

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

5799

"wrappedKey": "A String", # Required. The wrapped data crypto key.

5800

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5801

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

5802

# leaking the key. Choose another type of key if possible.

5803

"key": "A String", # Required. A 128/192/256 bit key.

5804

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5805

},

5806

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5807

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

5808

# fixed character. Masking can start from the beginning or end of the string.

5809

# This can be used on data of any type (numbers, longs, and so on) and when

5810

# de-identifying structured data we'll attempt to preserve the original data's

5811

# type. (This allows you to take a long like 123 and modify it to a string like

5812

# **3.

5813

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

5814

# characters. For example, if the input string is `555-555-5555` and you

5815

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

5816

# returns `***-**5-5555`.

5817

{ # Characters to skip when doing deidentification of a value. These will be left

5818

# alone and skipped.

5819

"charactersToSkip": "A String", # Characters to not transform when masking.

5820

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

5825

# masked. Skipped characters do not count towards this tally.

5826

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

5827

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

5828

# code or credit card number. This string must have a length of 1. If not

5829

# supplied, this value defaults to `*` for strings, and `0` for digits.

5830

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

5831

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

5832

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

5833

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

5834

# is `true`, then the string `12345` is masked as `12***`.

5835

},

5836

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

5837

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

5838

# output would be 'My phone number is '.

5839

},

5840

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

5841

# Bucketing transformation can provide all of this functionality,

5842

# but requires more configuration. This message is provided as a convenience to

5843

# the user for simple bucketing strategies.

5844

#

5845

# The transformed value will be a hyphenated string of

5846

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

5847

# all values that are within this bucket will be replaced with "10-20".

5848

#

5849

# This can be used on data of type: double, long.

5850

#

5851

# If the bound Value type differs from the type of data

5852

# being transformed, we will first attempt converting the type of the data to

5853

# be transformed to match the type of the bound before comparing.

5854

#

5855

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

5856

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

5857

# grouped together into a single bucket; for example if `upper_bound` = 89,

5858

# then all values greater than 89 are replaced with the value "89+".

5859

# Note that for the purposes of inspection or transformation, the number

5860

# of bytes considered to comprise a 'Value' is based on its representation

5861

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5862

# 123456789, the number of bytes would be counted as 9, even though an

5863

# int64 only holds up to 8 bytes of data.

5864

"integerValue": "A String", # integer

5865

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

5866

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5867

# types are google.type.Date and `google.protobuf.Timestamp`.

5868

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5869

# allow the value 60 if it allows leap-seconds.

5870

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

5871

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

5872

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5873

# to allow the value "24:00:00" for scenarios like business closing time.

5874

},

5875

"dayOfWeekValue": "A String", # day of week

5876

"floatValue": 3.14, # float

5877

"stringValue": "A String", # string

5878

"timestampValue": "A String", # timestamp

5879

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5880

# and time zone are either specified elsewhere or are not significant. The date

5881

# is relative to the Proleptic Gregorian Calendar. This can represent:

5882

#

5883

# * A full date, with non-zero year, month and day values

5884

# * A month and day value, with a zero year, e.g. an anniversary

5885

# * A year on its own, with zero month and day values

5886

# * A year and month value, with a zero day, e.g. a credit card expiration date

5887

#

5888

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

5889

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5890

# month and day.

5891

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5892

# a year.

5893

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5894

# if specifying a year by itself or a year and month where the day is not

5895

# significant.

5896

},

5897

"booleanValue": True or False, # boolean

5898

},

5899

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

5900

# grouped together into a single bucket; for example if `lower_bound` = 10,

5901

# then all values less than 10 are replaced with the value "-10".

5902

# Note that for the purposes of inspection or transformation, the number

5903

# of bytes considered to comprise a 'Value' is based on its representation

5904

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

5905

# 123456789, the number of bytes would be counted as 9, even though an

5906

# int64 only holds up to 8 bytes of data.

5907

"integerValue": "A String", # integer

5908

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

5909

# or are specified elsewhere. An API may choose to allow leap seconds. Related

5910

# types are google.type.Date and `google.protobuf.Timestamp`.

5911

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

5912

# allow the value 60 if it allows leap-seconds.

5913

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

5914

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

5915

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

5916

# to allow the value "24:00:00" for scenarios like business closing time.

5917

},

5918

"dayOfWeekValue": "A String", # day of week

5919

"floatValue": 3.14, # float

5920

"stringValue": "A String", # string

5921

"timestampValue": "A String", # timestamp

5922

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

5923

# and time zone are either specified elsewhere or are not significant. The date

5924

# is relative to the Proleptic Gregorian Calendar. This can represent:

5925

#

5926

# * A full date, with non-zero year, month and day values

5927

# * A month and day value, with a zero year, e.g. an anniversary

5928

# * A year on its own, with zero month and day values

5929

# * A year and month value, with a zero day, e.g. a credit card expiration date

5930

#

5931

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

5932

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

5933

# month and day.

5934

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

5935

# a year.

5936

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

5937

# if specifying a year by itself or a year and month where the day is not

5938

# significant.

5939

},

5940

"booleanValue": True or False, # boolean

5941

},

5942

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

5943

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

5944

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

5945

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

5946

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5947

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

5948

# (FPE) with the FFX mode of operation; however when used in the

5949

# `ReidentifyContent` API method, it serves the opposite function by reversing

5950

# the surrogate back into the original identifier. The identifier must be

5951

# encoded as ASCII. For a given crypto key and context, the same identifier

5952

# will be replaced with the same surrogate. Identifiers must be at least two

5953

# characters long. In the case that the identifier is the empty string, it will

5954

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

5955

# more.

5956

#

5957

# Note: We recommend using CryptoDeterministicConfig for all use cases which

5958

# do not require preserving the input alphabet space and size, plus warrant

5959

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5960

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

5961

# This annotation will be applied to the surrogate by prefixing it with

5962

# the name of the custom infoType followed by the number of

5963

# characters comprising the surrogate. The following scheme defines the

5964

# format: info_type_name(surrogate_character_count):surrogate

5965

#

5966

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

5967

# the surrogate is 'abc', the full replacement value

5968

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

5969

#

5970

# This annotation identifies the surrogate when inspecting content using the

5971

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5972

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5973

# This facilitates reversal of the surrogate when it occurs in free text.

5974

#

5975

# In order for inspection to work properly, the name of this infoType must

5976

# not occur naturally anywhere in your data; otherwise, inspection may

5977

# find a surrogate that does not correspond to an actual identifier.

5978

# Therefore, choose your custom infoType name carefully after considering

5979

# what your data looks like. One way to select a name that has a high chance

5980

# of yielding reliable detection is to include one or more unicode characters

5981

# that are highly improbable to exist in your data.

5982

# For example, assuming your data is entered from a regular ASCII keyboard,

5983

# the symbol with the hex code point 29DD might be used like so:

5984

# ⧝MY_TOKEN_TYPE

5985

"name": "A String", # Name of the information type. Either a name of your choosing when

5986

# creating a CustomInfoType, or one of the names listed

5987

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5988

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

5989

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5990

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

5991

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

5992

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

5993

# identifier in two different contexts won't be given the same surrogate. If

5994

# the context is not set, a default tweak will be used.

5995

#

5996

# If the context is set but:

5997

#

5998

# 1. there is no record present when transforming a given value or

5999

# 1. the field is not present when transforming a given value,

6000

#

6001

# a default tweak will be used.

6002

#

6003

# Note that case (1) is expected when an `InfoTypeTransformation` is

6004

# applied to both structured and non-structured `ContentItem`s.

6005

# Currently, the referenced field may be of value type integer or string.

6006

#

6007

# The tweak is constructed as a sequence of bytes in big endian byte order

6008

# such that:

6009

#

6010

# - a 64 bit integer is encoded followed by a single byte of value 1

6011

# - a string is encoded in UTF-8 format followed by a single byte of value 2

6012

"name": "A String", # Name describing the field.

6013

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6014

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

6015

# that the FFX mode natively supports. This happens before/after

6016

# encryption/decryption.

6017

# Each character listed must appear only once.

6018

# Number of characters must be in the range [2, 95].

6019

# This must be encoded as ASCII.

6020

# The order of characters does not matter.

6021

# The full list of allowed characters is:

6022

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

6023

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6024

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

6025

# a key encryption key (KEK) stored by KMS).

6026

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6027

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6028

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6029

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6030

# It will be discarded after the request finishes.

6031

"name": "A String", # Required. Name of the key.

6032

# This is an arbitrary string used to differentiate different keys.

6033

# A unique key is generated per name: two separate `TransientCryptoKey`

6034

# protos share the same generated key if their names are the same.

6035

# When the data crypto key is generated, this name is not used in any way

6036

# (repeating the api call will result in a different key being generated).

6037

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6038

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6039

# The wrapped key must be a 128/192/256 bit key.

6040

# Authorization requires the following IAM permissions when sending a request

6041

# to perform a crypto transformation using a kms-wrapped crypto key:

6042

# dlp.kms.encrypt

6043

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6044

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6045

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6046

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6047

# leaking the key. Choose another type of key if possible.

6048

"key": "A String", # Required. A 128/192/256 bit key.

6049

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6050

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6051

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6052

},

6053

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

6054

# input. Outputs a base64 encoded representation of the encrypted output.

6055

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6056

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

6057

# referential integrity such that the same identifier in two different

6058

# contexts will be given a distinct surrogate. The context is appended to

6059

# plaintext value being encrypted. On decryption the provided context is

6060

# validated against the value used during encryption. If a context was

6061

# provided during encryption, same context must be provided during decryption

6062

# as well.

6063

#

6064

# If the context is not set, plaintext would be used as is for encryption.

6065

# If the context is set but:

6066

#

6067

# 1. there is no record present when transforming a given value or

6068

# 2. the field is not present when transforming a given value,

6069

#

6070

# plaintext would be used as is for encryption.

6071

#

6072

# Note that case (1) is expected when an `InfoTypeTransformation` is

6073

# applied to both structured and non-structured `ContentItem`s.

6074

"name": "A String", # Name describing the field.

6075

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6076

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

6077

# This annotation will be applied to the surrogate by prefixing it with

6078

# the name of the custom info type followed by the number of

6079

# characters comprising the surrogate. The following scheme defines the

6080

# format: {info type name}({surrogate character count}):{surrogate}

6081

#

6082

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

6083

# the surrogate is 'abc', the full replacement value

6084

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

6085

#

6086

# This annotation identifies the surrogate when inspecting content using the

6087

# custom info type 'Surrogate'. This facilitates reversal of the

6088

# surrogate when it occurs in free text.

6089

#

6090

# Note: For record transformations where the entire cell in a table is being

6091

# transformed, surrogates are not mandatory. Surrogates are used to denote

6092

# the location of the token and are necessary for re-identification in free

6093

# form text.

6094

#

6095

# In order for inspection to work properly, the name of this info type must

6096

# not occur naturally anywhere in your data; otherwise, inspection may either

6097

#

6098

# - reverse a surrogate that does not correspond to an actual identifier

6099

# - be unable to parse the surrogate and result in an error

6100

#

6101

# Therefore, choose your custom info type name carefully after considering

6102

# what your data looks like. One way to select a name that has a high chance

6103

# of yielding reliable detection is to include one or more unicode characters

6104

# that are highly improbable to exist in your data.

6105

# For example, assuming your data is entered from a regular ASCII keyboard,

6106

# the symbol with the hex code point 29DD might be used like so:

6107

# ⧝MY_TOKEN_TYPE.

6108

"name": "A String", # Name of the information type. Either a name of your choosing when

6109

# creating a CustomInfoType, or one of the names listed

6110

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6111

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

6112

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6113

},

6114

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

6115

# a key encryption key (KEK) stored by KMS).

6116

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6117

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6118

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6119

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6120

# It will be discarded after the request finishes.

6121

"name": "A String", # Required. Name of the key.

6122

# This is an arbitrary string used to differentiate different keys.

6123

# A unique key is generated per name: two separate `TransientCryptoKey`

6124

# protos share the same generated key if their names are the same.

6125

# When the data crypto key is generated, this name is not used in any way

6126

# (repeating the api call will result in a different key being generated).

6127

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6128

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6129

# The wrapped key must be a 128/192/256 bit key.

6130

# Authorization requires the following IAM permissions when sending a request

6131

# to perform a crypto transformation using a kms-wrapped crypto key:

6132

# dlp.kms.encrypt

6133

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6134

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6135

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6136

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6137

# leaking the key. Choose another type of key if possible.

6138

"key": "A String", # Required. A 128/192/256 bit key.

6139

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6140

},

6141

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6142

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

6143

# replacement values are dynamically provided by the user for custom behavior,

6144

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

6145

# This can be used on

6146

# data of type: number, long, string, timestamp.

6147

# If the bound `Value` type differs from the type of data being transformed, we

6148

# will first attempt converting the type of the data to be transformed to match

6149

# the type of the bound before comparing.

6150

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

6151

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

6152

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6153

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6154

# Note that for the purposes of inspection or transformation, the number

6155

# of bytes considered to comprise a 'Value' is based on its representation

6156

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6157

# 123456789, the number of bytes would be counted as 9, even though an

6158

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6159

"integerValue": "A String", # integer

6160

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6161

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6162

# types are google.type.Date and `google.protobuf.Timestamp`.

6163

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6164

# allow the value 60 if it allows leap-seconds.

6165

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6166

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6167

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6168

# to allow the value "24:00:00" for scenarios like business closing time.

6169

},

6170

"dayOfWeekValue": "A String", # day of week

6171

"floatValue": 3.14, # float

6172

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6173

"timestampValue": "A String", # timestamp

6174

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6175

# and time zone are either specified elsewhere or are not significant. The date

6176

# is relative to the Proleptic Gregorian Calendar. This can represent:

6177

#

6178

# * A full date, with non-zero year, month and day values

6179

# * A month and day value, with a zero year, e.g. an anniversary

6180

# * A year on its own, with zero month and day values

6181

# * A year and month value, with a zero day, e.g. a credit card expiration date

6182

#

6183

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6184

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6185

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6186

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6187

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6188

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6189

# if specifying a year by itself or a year and month where the day is not

6190

# significant.

6191

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6192

"booleanValue": True or False, # boolean

6193

},

6194

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

6195

# Note that for the purposes of inspection or transformation, the number

6196

# of bytes considered to comprise a 'Value' is based on its representation

6197

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6198

# 123456789, the number of bytes would be counted as 9, even though an

6199

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6200

"integerValue": "A String", # integer

6201

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6202

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6203

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6204

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6205

# allow the value 60 if it allows leap-seconds.

6206

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6207

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6208

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6209

# to allow the value "24:00:00" for scenarios like business closing time.

6210

},

6211

"dayOfWeekValue": "A String", # day of week

6212

"floatValue": 3.14, # float

6213

"stringValue": "A String", # string

6214

"timestampValue": "A String", # timestamp

6215

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6216

# and time zone are either specified elsewhere or are not significant. The date

6217

# is relative to the Proleptic Gregorian Calendar. This can represent:

6218

#

6219

# * A full date, with non-zero year, month and day values

6220

# * A month and day value, with a zero year, e.g. an anniversary

6221

# * A year on its own, with zero month and day values

6222

# * A year and month value, with a zero day, e.g. a credit card expiration date

6223

#

6224

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6225

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6226

# month and day.

6227

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6228

# a year.

6229

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6230

# if specifying a year by itself or a year and month where the day is not

6231

# significant.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6232

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6233

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6234

},

6235

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

6236

# used.

6237

# Note that for the purposes of inspection or transformation, the number

6238

# of bytes considered to comprise a 'Value' is based on its representation

6239

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6240

# 123456789, the number of bytes would be counted as 9, even though an

6241

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6242

"integerValue": "A String", # integer

6243

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6244

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6245

# types are google.type.Date and `google.protobuf.Timestamp`.

6246

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6247

# allow the value 60 if it allows leap-seconds.

6248

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6249

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6250

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6251

# to allow the value "24:00:00" for scenarios like business closing time.

6252

},

6253

"dayOfWeekValue": "A String", # day of week

6254

"floatValue": 3.14, # float

6255

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6256

"timestampValue": "A String", # timestamp

6257

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6258

# and time zone are either specified elsewhere or are not significant. The date

6259

# is relative to the Proleptic Gregorian Calendar. This can represent:

6260

#

6261

# * A full date, with non-zero year, month and day values

6262

# * A month and day value, with a zero year, e.g. an anniversary

6263

# * A year on its own, with zero month and day values

6264

# * A year and month value, with a zero day, e.g. a credit card expiration date

6265

#

6266

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6267

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6268

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6269

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6270

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6271

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6272

# if specifying a year by itself or a year and month where the day is not

6273

# significant.

6274

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6275

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6280

},

6281

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

6282

# given `RecordCondition`. The conditions are allowed to reference fields

6283

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

6288

# column for the same record is within a specific range.

6289

# - Redact a field if the date of birth field is greater than 85.

6290

# a field.

6291

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6292

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

6293

"conditions": [ # A collection of conditions.

6294

{ # The field type of `value` and `field` do not need to match to be

6295

# considered equal, but not all comparisons are possible.

6296

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

6297

# but all other comparisons are invalid with incompatible types.

6298

# A `value` of type:

6299

#

6300

# - `string` can be compared against all other types

6301

# - `boolean` can only be compared against other booleans

6302

# - `integer` can be compared against doubles or a string if the string value

6303

# can be parsed as an integer.

6304

# - `double` can be compared against integers or a string if the string can

6305

# be parsed as a double.

6306

# - `Timestamp` can be compared against strings in RFC 3339 date string

6307

# format.

6308

# - `TimeOfDay` can be compared against timestamps and strings in the format

6309

# of 'HH:mm:ss'.

6310

#

6311

# If we fail to compare do to type mismatch, a warning will be given and

6312

# the condition will evaluate to false.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6313

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

6314

"name": "A String", # Name describing the field.

6315

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6316

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

6317

# Note that for the purposes of inspection or transformation, the number

6318

# of bytes considered to comprise a 'Value' is based on its representation

6319

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6320

# 123456789, the number of bytes would be counted as 9, even though an

6321

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6322

"integerValue": "A String", # integer

6323

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6324

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6325

# types are google.type.Date and `google.protobuf.Timestamp`.

6326

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6327

# allow the value 60 if it allows leap-seconds.

6328

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6329

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6330

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6331

# to allow the value "24:00:00" for scenarios like business closing time.

6332

},

6333

"dayOfWeekValue": "A String", # day of week

6334

"floatValue": 3.14, # float

6335

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6336

"timestampValue": "A String", # timestamp

6337

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6338

# and time zone are either specified elsewhere or are not significant. The date

6339

# is relative to the Proleptic Gregorian Calendar. This can represent:

6340

#

6341

# * A full date, with non-zero year, month and day values

6342

# * A month and day value, with a zero year, e.g. an anniversary

6343

# * A year on its own, with zero month and day values

6344

# * A year and month value, with a zero day, e.g. a credit card expiration date

6345

#

6346

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6347

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6348

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6349

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6350

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6351

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6352

# if specifying a year by itself or a year and month where the day is not

6353

# significant.

6354

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6355

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6356

},

6357

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6358

},

6359

],

6360

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6361

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

6362

# only supported value is `AND`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6363

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6364

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6365

"fields": [ # Required. Input field(s) to apply the transformation to.

6366

{ # General identifier of a data field in a storage service.

6367

"name": "A String", # Name describing the field.

6368

},

6369

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6374

"createTime": "A String", # Output only. The creation timestamp of an inspectTemplate.

6375

"updateTime": "A String", # Output only. The last update timestamp of an inspectTemplate.

6376

"description": "A String", # Short description (max 256 chars).

6377

"displayName": "A String", # Display name (max 256 chars).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

}</pre>

</div>

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6382

<code class="details" id="list">list(parent, pageSize=None, locationId=None, orderBy=None, pageToken=None, x__xgafv=None)</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6383

<pre>Lists DeidentifyTemplates.

6384

See https://cloud.google.com/dlp/docs/creating-templates-deid to learn

6385

more.

6386

6387

Args:

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6388

parent: string, Required. Parent resource name.

6389

- Format:projects/[PROJECT-ID]

6390

- Format:organizations/[ORGANIZATION-ID]

6391

- Format:projects/[PROJECT-ID]/locations/[LOCATION-ID]

6392

- Format:organizations/[ORGANIZATION-ID]/locations/[LOCATION-ID] (required)

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6393

pageSize: integer, Size of the page, can be limited by server. If zero server returns

6394

a page of max size 100.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6395

locationId: string, Deprecated. This field has no effect.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6396

orderBy: string, Comma separated list of fields to order by,

6397

followed by `asc` or `desc` postfix. This list is case-insensitive,

6398

default sorting order is ascending, redundant space characters are

6399

insignificant.

6400

6401

Example: `name asc,update_time, create_time desc`

6402

6403

Supported fields are:

6404

6405

- `create_time`: corresponds to time the template was created.

6406

- `update_time`: corresponds to time the template was last updated.

6407

- `name`: corresponds to template's name.

6408

- `display_name`: corresponds to template's display name.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6409

pageToken: string, Page token to continue retrieval. Comes from previous call

6410

to `ListDeidentifyTemplates`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6411

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

6418

6419

{ # Response message for ListDeidentifyTemplates.

6420

"nextPageToken": "A String", # If the next page is available then the next page token to be used

6421

# in following ListDeidentifyTemplates request.

6422

"deidentifyTemplates": [ # List of deidentify templates, up to page_size in

6423

# ListDeidentifyTemplatesRequest.

6424

{ # DeidentifyTemplates contains instructions on how to de-identify content.

6425

# See https://cloud.google.com/dlp/docs/concepts-templates to learn more.

6426

"name": "A String", # Output only. The template name.

6427

#

6428

# The template will have one of the following formats:

6429

# `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR

6430

# `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

6431

"deidentifyConfig": { # The configuration that controls how the data will change. # ///////////// // The core content of the template // ///////////////

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6432

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text

6433

# transformation everywhere.

6434

# apply various `PrimitiveTransformation`s to each finding, where the

6435

# transformation is applied to only values that were identified as a specific

6436

# info_type.

6437

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

6438

# for a given infoType.

6439

{ # A transformation to apply to text that is identified as a specific

6440

# info_type.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6441

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

6442

# this transformation to apply to all findings that correspond to

6443

# infoTypes that were requested in `InspectConfig`.

6444

{ # Type of information detected by the API.

6445

"name": "A String", # Name of the information type. Either a name of your choosing when

6446

# creating a CustomInfoType, or one of the names listed

6447

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

6448

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

6449

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6450

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6451

],

6452

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6453

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

6454

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

6455

# to learn more.

6456

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

6457

# If set, must also set cryptoKey. If set, shift will be consistent for the

6458

# given context.

6459

"name": "A String", # Name describing the field.

6460

},

6461

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

6462

# range (inclusive ends). Negative means shift to earlier in time. Must not

6463

# be more than 365250 days (1000 years) each direction.

6464

#

6465

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6466

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

6467

# results in the same shift for the same context and crypto_key. If

6468

# set, must also set context. Can only be applied to table items.

6469

# a key encryption key (KEK) stored by KMS).

6470

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6471

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6472

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6473

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6474

# It will be discarded after the request finishes.

6475

"name": "A String", # Required. Name of the key.

6476

# This is an arbitrary string used to differentiate different keys.

6477

# A unique key is generated per name: two separate `TransientCryptoKey`

6478

# protos share the same generated key if their names are the same.

6479

# When the data crypto key is generated, this name is not used in any way

6480

# (repeating the api call will result in a different key being generated).

6481

},

6482

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6483

# The wrapped key must be a 128/192/256 bit key.

6484

# Authorization requires the following IAM permissions when sending a request

6485

# to perform a crypto transformation using a kms-wrapped crypto key:

6486

# dlp.kms.encrypt

6487

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6488

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6489

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6490

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6491

# leaking the key. Choose another type of key if possible.

6492

"key": "A String", # Required. A 128/192/256 bit key.

6493

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6494

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6495

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

6496

},

6497

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

6498

# portion of the value.

6499

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6500

},

6501

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

6502

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6503

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

6504

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

6505

# Note that for the purposes of inspection or transformation, the number

6506

# of bytes considered to comprise a 'Value' is based on its representation

6507

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6508

# 123456789, the number of bytes would be counted as 9, even though an

6509

# int64 only holds up to 8 bytes of data.

6510

"integerValue": "A String", # integer

6511

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6512

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6513

# types are google.type.Date and `google.protobuf.Timestamp`.

6514

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6515

# allow the value 60 if it allows leap-seconds.

6516

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6517

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6518

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6519

# to allow the value "24:00:00" for scenarios like business closing time.

6520

},

6521

"dayOfWeekValue": "A String", # day of week

6522

"floatValue": 3.14, # float

6523

"stringValue": "A String", # string

6524

"timestampValue": "A String", # timestamp

6525

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6526

# and time zone are either specified elsewhere or are not significant. The date

6527

# is relative to the Proleptic Gregorian Calendar. This can represent:

6528

#

6529

# * A full date, with non-zero year, month and day values

6530

# * A month and day value, with a zero year, e.g. an anniversary

6531

# * A year on its own, with zero month and day values

6532

# * A year and month value, with a zero day, e.g. a credit card expiration date

6533

#

6534

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6535

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6536

# month and day.

6537

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6538

# a year.

6539

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6540

# if specifying a year by itself or a year and month where the day is not

6541

# significant.

6542

},

6543

"booleanValue": True or False, # boolean

6544

},

6545

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6546

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

6547

# Uses SHA-256.

6548

# The key size must be either 32 or 64 bytes.

6549

# Outputs a base64 encoded representation of the hashed output

6550

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

6551

# Currently, only string and integer values can be hashed.

6552

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

6553

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

6554

# a key encryption key (KEK) stored by KMS).

6555

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6556

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6557

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6558

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6559

# It will be discarded after the request finishes.

6560

"name": "A String", # Required. Name of the key.

6561

# This is an arbitrary string used to differentiate different keys.

6562

# A unique key is generated per name: two separate `TransientCryptoKey`

6563

# protos share the same generated key if their names are the same.

6564

# When the data crypto key is generated, this name is not used in any way

6565

# (repeating the api call will result in a different key being generated).

6566

},

6567

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6568

# The wrapped key must be a 128/192/256 bit key.

6569

# Authorization requires the following IAM permissions when sending a request

6570

# to perform a crypto transformation using a kms-wrapped crypto key:

6571

# dlp.kms.encrypt

6572

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6573

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6574

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6575

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6576

# leaking the key. Choose another type of key if possible.

6577

"key": "A String", # Required. A 128/192/256 bit key.

6578

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6579

},

6580

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6581

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

6582

# fixed character. Masking can start from the beginning or end of the string.

6583

# This can be used on data of any type (numbers, longs, and so on) and when

6584

# de-identifying structured data we'll attempt to preserve the original data's

6585

# type. (This allows you to take a long like 123 and modify it to a string like

6586

# **3.

6587

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

6588

# characters. For example, if the input string is `555-555-5555` and you

6589

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

6590

# returns `***-**5-5555`.

6591

{ # Characters to skip when doing deidentification of a value. These will be left

6592

# alone and skipped.

6593

"charactersToSkip": "A String", # Characters to not transform when masking.

6594

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

6599

# masked. Skipped characters do not count towards this tally.

6600

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

6601

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

6602

# code or credit card number. This string must have a length of 1. If not

6603

# supplied, this value defaults to `*` for strings, and `0` for digits.

6604

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

6605

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

6606

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

6607

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

6608

# is `true`, then the string `12345` is masked as `12***`.

6609

},

6610

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

6611

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

6612

# output would be 'My phone number is '.

6613

},

6614

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

6615

# Bucketing transformation can provide all of this functionality,

6616

# but requires more configuration. This message is provided as a convenience to

6617

# the user for simple bucketing strategies.

6618

#

6619

# The transformed value will be a hyphenated string of

6620

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

6621

# all values that are within this bucket will be replaced with "10-20".

6622

#

6623

# This can be used on data of type: double, long.

6624

#

6625

# If the bound Value type differs from the type of data

6626

# being transformed, we will first attempt converting the type of the data to

6627

# be transformed to match the type of the bound before comparing.

6628

#

6629

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

6630

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

6631

# grouped together into a single bucket; for example if `upper_bound` = 89,

6632

# then all values greater than 89 are replaced with the value "89+".

6633

# Note that for the purposes of inspection or transformation, the number

6634

# of bytes considered to comprise a 'Value' is based on its representation

6635

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6636

# 123456789, the number of bytes would be counted as 9, even though an

6637

# int64 only holds up to 8 bytes of data.

6638

"integerValue": "A String", # integer

6639

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6640

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6641

# types are google.type.Date and `google.protobuf.Timestamp`.

6642

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6643

# allow the value 60 if it allows leap-seconds.

6644

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6645

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6646

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6647

# to allow the value "24:00:00" for scenarios like business closing time.

6648

},

6649

"dayOfWeekValue": "A String", # day of week

6650

"floatValue": 3.14, # float

6651

"stringValue": "A String", # string

6652

"timestampValue": "A String", # timestamp

6653

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6654

# and time zone are either specified elsewhere or are not significant. The date

6655

# is relative to the Proleptic Gregorian Calendar. This can represent:

6656

#

6657

# * A full date, with non-zero year, month and day values

6658

# * A month and day value, with a zero year, e.g. an anniversary

6659

# * A year on its own, with zero month and day values

6660

# * A year and month value, with a zero day, e.g. a credit card expiration date

6661

#

6662

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6663

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6664

# month and day.

6665

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6666

# a year.

6667

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6668

# if specifying a year by itself or a year and month where the day is not

6669

# significant.

6670

},

6671

"booleanValue": True or False, # boolean

6672

},

6673

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

6674

# grouped together into a single bucket; for example if `lower_bound` = 10,

6675

# then all values less than 10 are replaced with the value "-10".

6676

# Note that for the purposes of inspection or transformation, the number

6677

# of bytes considered to comprise a 'Value' is based on its representation

6678

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6679

# 123456789, the number of bytes would be counted as 9, even though an

6680

# int64 only holds up to 8 bytes of data.

6681

"integerValue": "A String", # integer

6682

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6683

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6684

# types are google.type.Date and `google.protobuf.Timestamp`.

6685

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6686

# allow the value 60 if it allows leap-seconds.

6687

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6688

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6689

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6690

# to allow the value "24:00:00" for scenarios like business closing time.

6691

},

6692

"dayOfWeekValue": "A String", # day of week

6693

"floatValue": 3.14, # float

6694

"stringValue": "A String", # string

6695

"timestampValue": "A String", # timestamp

6696

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6697

# and time zone are either specified elsewhere or are not significant. The date

6698

# is relative to the Proleptic Gregorian Calendar. This can represent:

6699

#

6700

# * A full date, with non-zero year, month and day values

6701

# * A month and day value, with a zero year, e.g. an anniversary

6702

# * A year on its own, with zero month and day values

6703

# * A year and month value, with a zero day, e.g. a credit card expiration date

6704

#

6705

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6706

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6707

# month and day.

6708

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6709

# a year.

6710

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6711

# if specifying a year by itself or a year and month where the day is not

6712

# significant.

6713

},

6714

"booleanValue": True or False, # boolean

6715

},

6716

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

6717

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

6718

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

6719

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

6720

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6721

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

6722

# (FPE) with the FFX mode of operation; however when used in the

6723

# `ReidentifyContent` API method, it serves the opposite function by reversing

6724

# the surrogate back into the original identifier. The identifier must be

6725

# encoded as ASCII. For a given crypto key and context, the same identifier

6726

# will be replaced with the same surrogate. Identifiers must be at least two

6727

# characters long. In the case that the identifier is the empty string, it will

6728

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

6729

# more.

6730

#

6731

# Note: We recommend using CryptoDeterministicConfig for all use cases which

6732

# do not require preserving the input alphabet space and size, plus warrant

6733

# referential integrity.

6734

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

6735

# This annotation will be applied to the surrogate by prefixing it with

6736

# the name of the custom infoType followed by the number of

6737

# characters comprising the surrogate. The following scheme defines the

6738

# format: info_type_name(surrogate_character_count):surrogate

6739

#

6740

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

6741

# the surrogate is 'abc', the full replacement value

6742

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

6743

#

6744

# This annotation identifies the surrogate when inspecting content using the

6745

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6746

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6747

# This facilitates reversal of the surrogate when it occurs in free text.

6748

#

6749

# In order for inspection to work properly, the name of this infoType must

6750

# not occur naturally anywhere in your data; otherwise, inspection may

6751

# find a surrogate that does not correspond to an actual identifier.

6752

# Therefore, choose your custom infoType name carefully after considering

6753

# what your data looks like. One way to select a name that has a high chance

6754

# of yielding reliable detection is to include one or more unicode characters

6755

# that are highly improbable to exist in your data.

6756

# For example, assuming your data is entered from a regular ASCII keyboard,

6757

# the symbol with the hex code point 29DD might be used like so:

6758

# ⧝MY_TOKEN_TYPE

6759

"name": "A String", # Name of the information type. Either a name of your choosing when

6760

# creating a CustomInfoType, or one of the names listed

6761

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6762

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

6763

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6764

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6765

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6766

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

6767

# identifier in two different contexts won't be given the same surrogate. If

6768

# the context is not set, a default tweak will be used.

6769

#

6770

# If the context is set but:

6771

#

6772

# 1. there is no record present when transforming a given value or

6773

# 1. the field is not present when transforming a given value,

6774

#

6775

# a default tweak will be used.

6776

#

6777

# Note that case (1) is expected when an `InfoTypeTransformation` is

6778

# applied to both structured and non-structured `ContentItem`s.

6779

# Currently, the referenced field may be of value type integer or string.

6780

#

6781

# The tweak is constructed as a sequence of bytes in big endian byte order

6782

# such that:

6783

#

6784

# - a 64 bit integer is encoded followed by a single byte of value 1

6785

# - a string is encoded in UTF-8 format followed by a single byte of value 2

6786

"name": "A String", # Name describing the field.

6787

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6788

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

6789

# that the FFX mode natively supports. This happens before/after

6790

# encryption/decryption.

6791

# Each character listed must appear only once.

6792

# Number of characters must be in the range [2, 95].

6793

# This must be encoded as ASCII.

6794

# The order of characters does not matter.

6795

# The full list of allowed characters is:

6796

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

6797

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6798

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

6799

# a key encryption key (KEK) stored by KMS).

6800

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6801

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6802

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6803

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6804

# It will be discarded after the request finishes.

6805

"name": "A String", # Required. Name of the key.

6806

# This is an arbitrary string used to differentiate different keys.

6807

# A unique key is generated per name: two separate `TransientCryptoKey`

6808

# protos share the same generated key if their names are the same.

6809

# When the data crypto key is generated, this name is not used in any way

6810

# (repeating the api call will result in a different key being generated).

6811

},

6812

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6813

# The wrapped key must be a 128/192/256 bit key.

6814

# Authorization requires the following IAM permissions when sending a request

6815

# to perform a crypto transformation using a kms-wrapped crypto key:

6816

# dlp.kms.encrypt

6817

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6818

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6819

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6820

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6821

# leaking the key. Choose another type of key if possible.

6822

"key": "A String", # Required. A 128/192/256 bit key.

6823

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6824

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6825

"commonAlphabet": "A String", # Common alphabets.

6826

},

6827

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

6828

# input. Outputs a base64 encoded representation of the encrypted output.

6829

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6830

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

6831

# referential integrity such that the same identifier in two different

6832

# contexts will be given a distinct surrogate. The context is appended to

6833

# plaintext value being encrypted. On decryption the provided context is

6834

# validated against the value used during encryption. If a context was

6835

# provided during encryption, same context must be provided during decryption

6836

# as well.

6837

#

6838

# If the context is not set, plaintext would be used as is for encryption.

6839

# If the context is set but:

6840

#

6841

# 1. there is no record present when transforming a given value or

6842

# 2. the field is not present when transforming a given value,

6843

#

6844

# plaintext would be used as is for encryption.

6845

#

6846

# Note that case (1) is expected when an `InfoTypeTransformation` is

6847

# applied to both structured and non-structured `ContentItem`s.

6848

"name": "A String", # Name describing the field.

6849

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6850

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

6851

# This annotation will be applied to the surrogate by prefixing it with

6852

# the name of the custom info type followed by the number of

6853

# characters comprising the surrogate. The following scheme defines the

6854

# format: {info type name}({surrogate character count}):{surrogate}

6855

#

6856

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

6857

# the surrogate is 'abc', the full replacement value

6858

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

6859

#

6860

# This annotation identifies the surrogate when inspecting content using the

6861

# custom info type 'Surrogate'. This facilitates reversal of the

6862

# surrogate when it occurs in free text.

6863

#

6864

# Note: For record transformations where the entire cell in a table is being

6865

# transformed, surrogates are not mandatory. Surrogates are used to denote

6866

# the location of the token and are necessary for re-identification in free

6867

# form text.

6868

#

6869

# In order for inspection to work properly, the name of this info type must

6870

# not occur naturally anywhere in your data; otherwise, inspection may either

6871

#

6872

# - reverse a surrogate that does not correspond to an actual identifier

6873

# - be unable to parse the surrogate and result in an error

6874

#

6875

# Therefore, choose your custom info type name carefully after considering

6876

# what your data looks like. One way to select a name that has a high chance

6877

# of yielding reliable detection is to include one or more unicode characters

6878

# that are highly improbable to exist in your data.

6879

# For example, assuming your data is entered from a regular ASCII keyboard,

6880

# the symbol with the hex code point 29DD might be used like so:

6881

# ⧝MY_TOKEN_TYPE.

6882

"name": "A String", # Name of the information type. Either a name of your choosing when

6883

# creating a CustomInfoType, or one of the names listed

6884

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6885

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

6886

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6887

},

6888

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

6889

# a key encryption key (KEK) stored by KMS).

6890

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

6891

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

6892

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6893

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

6894

# It will be discarded after the request finishes.

6895

"name": "A String", # Required. Name of the key.

6896

# This is an arbitrary string used to differentiate different keys.

6897

# A unique key is generated per name: two separate `TransientCryptoKey`

6898

# protos share the same generated key if their names are the same.

6899

# When the data crypto key is generated, this name is not used in any way

6900

# (repeating the api call will result in a different key being generated).

6901

},

6902

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

6903

# The wrapped key must be a 128/192/256 bit key.

6904

# Authorization requires the following IAM permissions when sending a request

6905

# to perform a crypto transformation using a kms-wrapped crypto key:

6906

# dlp.kms.encrypt

6907

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

6908

"wrappedKey": "A String", # Required. The wrapped data crypto key.

6909

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6910

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

6911

# leaking the key. Choose another type of key if possible.

6912

"key": "A String", # Required. A 128/192/256 bit key.

6913

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6914

},

6915

},

6916

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

6917

# replacement values are dynamically provided by the user for custom behavior,

6918

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

6919

# This can be used on

6920

# data of type: number, long, string, timestamp.

6921

# If the bound `Value` type differs from the type of data being transformed, we

6922

# will first attempt converting the type of the data to be transformed to match

6923

# the type of the bound before comparing.

6924

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

6925

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

6926

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6927

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6928

# Note that for the purposes of inspection or transformation, the number

6929

# of bytes considered to comprise a 'Value' is based on its representation

6930

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6931

# 123456789, the number of bytes would be counted as 9, even though an

6932

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6933

"integerValue": "A String", # integer

6934

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6935

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6936

# types are google.type.Date and `google.protobuf.Timestamp`.

6937

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6938

# allow the value 60 if it allows leap-seconds.

6939

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

6940

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6941

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6942

# to allow the value "24:00:00" for scenarios like business closing time.

6943

},

6944

"dayOfWeekValue": "A String", # day of week

6945

"floatValue": 3.14, # float

6946

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6947

"timestampValue": "A String", # timestamp

6948

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6949

# and time zone are either specified elsewhere or are not significant. The date

6950

# is relative to the Proleptic Gregorian Calendar. This can represent:

6951

#

6952

# * A full date, with non-zero year, month and day values

6953

# * A month and day value, with a zero year, e.g. an anniversary

6954

# * A year on its own, with zero month and day values

6955

# * A year and month value, with a zero day, e.g. a credit card expiration date

6956

#

6957

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6958

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

6959

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6960

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

6961

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6962

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

6963

# if specifying a year by itself or a year and month where the day is not

6964

# significant.

6965

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6966

"booleanValue": True or False, # boolean

6967

},

6968

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

6969

# Note that for the purposes of inspection or transformation, the number

6970

# of bytes considered to comprise a 'Value' is based on its representation

6971

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

6972

# 123456789, the number of bytes would be counted as 9, even though an

6973

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6974

"integerValue": "A String", # integer

6975

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

6976

# or are specified elsewhere. An API may choose to allow leap seconds. Related

6977

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

6978

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

6979

# allow the value 60 if it allows leap-seconds.

6980

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

6981

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

6982

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

6983

# to allow the value "24:00:00" for scenarios like business closing time.

6984

},

6985

"dayOfWeekValue": "A String", # day of week

6986

"floatValue": 3.14, # float

6987

"stringValue": "A String", # string

6988

"timestampValue": "A String", # timestamp

6989

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

6990

# and time zone are either specified elsewhere or are not significant. The date

6991

# is relative to the Proleptic Gregorian Calendar. This can represent:

6992

#

6993

# * A full date, with non-zero year, month and day values

6994

# * A month and day value, with a zero year, e.g. an anniversary

6995

# * A year on its own, with zero month and day values

6996

# * A year and month value, with a zero day, e.g. a credit card expiration date

6997

#

6998

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

6999

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7000

# month and day.

7001

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7002

# a year.

7003

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7004

# if specifying a year by itself or a year and month where the day is not

7005

# significant.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7006

},

7007

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7008

},

7009

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

7010

# used.

7011

# Note that for the purposes of inspection or transformation, the number

7012

# of bytes considered to comprise a 'Value' is based on its representation

7013

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7014

# 123456789, the number of bytes would be counted as 9, even though an

7015

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7016

"integerValue": "A String", # integer

7017

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7018

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7019

# types are google.type.Date and `google.protobuf.Timestamp`.

7020

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7021

# allow the value 60 if it allows leap-seconds.

7022

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7023

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7024

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7025

# to allow the value "24:00:00" for scenarios like business closing time.

7026

},

7027

"dayOfWeekValue": "A String", # day of week

7028

"floatValue": 3.14, # float

7029

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7030

"timestampValue": "A String", # timestamp

7031

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7032

# and time zone are either specified elsewhere or are not significant. The date

7033

# is relative to the Proleptic Gregorian Calendar. This can represent:

7034

#

7035

# * A full date, with non-zero year, month and day values

7036

# * A month and day value, with a zero year, e.g. an anniversary

7037

# * A year on its own, with zero month and day values

7038

# * A year and month value, with a zero day, e.g. a credit card expiration date

7039

#

7040

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7041

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7042

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7043

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7044

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7045

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7046

# if specifying a year by itself or a year and month where the day is not

7047

# significant.

7048

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7049

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7054

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7055

},

7056

],

7057

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7058

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default

7059

# mode is `TransformationErrorHandling.ThrowError`.

7060

# transformation error occurs when the requested transformation is incompatible

7061

# with the data. For example, trying to de-identify an IP address using a

7062

# `DateShift` transformation would result in a transformation error, since date

7063

# info cannot be extracted from an IP address.

7064

# Information about any incompatible transformations, and how they were

7065

# handled, is returned in the response as part of the

7066

# `TransformationOverviews`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7067

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would # Ignore errors

7068

# cause an error. For example, if a `DateShift` transformation were applied

7069

# an an IP address, this mode would leave the IP address unchanged in the

7070

# response.

7071

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7072

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

7073

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7074

},

7075

"recordTransformations": { # A type of transformation that is applied over structured data such as a # Treat the dataset as structured. Transformations can be applied to

7076

# specific locations within structured datasets, such as transforming

7077

# a column within a table.

7078

# table.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7079

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that

7080

# match any suppression rule are omitted from the output.

7081

{ # Configuration to suppress records whose suppression conditions evaluate to

7082

# true.

7083

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

7084

# evaluated to be suppressed from the transformed content.

7085

# a field.

7086

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

7087

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

7088

"conditions": [ # A collection of conditions.

7089

{ # The field type of `value` and `field` do not need to match to be

7090

# considered equal, but not all comparisons are possible.

7091

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

7092

# but all other comparisons are invalid with incompatible types.

7093

# A `value` of type:

7094

#

7095

# - `string` can be compared against all other types

7096

# - `boolean` can only be compared against other booleans

7097

# - `integer` can be compared against doubles or a string if the string value

7098

# can be parsed as an integer.

7099

# - `double` can be compared against integers or a string if the string can

7100

# be parsed as a double.

7101

# - `Timestamp` can be compared against strings in RFC 3339 date string

7102

# format.

7103

# - `TimeOfDay` can be compared against timestamps and strings in the format

7104

# of 'HH:mm:ss'.

7105

#

7106

# If we fail to compare do to type mismatch, a warning will be given and

7107

# the condition will evaluate to false.

7108

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

7109

"name": "A String", # Name describing the field.

7110

},

7111

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

7112

# Note that for the purposes of inspection or transformation, the number

7113

# of bytes considered to comprise a 'Value' is based on its representation

7114

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7115

# 123456789, the number of bytes would be counted as 9, even though an

7116

# int64 only holds up to 8 bytes of data.

7117

"integerValue": "A String", # integer

7118

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7119

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7120

# types are google.type.Date and `google.protobuf.Timestamp`.

7121

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7122

# allow the value 60 if it allows leap-seconds.

7123

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7124

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7125

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7126

# to allow the value "24:00:00" for scenarios like business closing time.

7127

},

7128

"dayOfWeekValue": "A String", # day of week

7129

"floatValue": 3.14, # float

7130

"stringValue": "A String", # string

7131

"timestampValue": "A String", # timestamp

7132

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7133

# and time zone are either specified elsewhere or are not significant. The date

7134

# is relative to the Proleptic Gregorian Calendar. This can represent:

7135

#

7136

# * A full date, with non-zero year, month and day values

7137

# * A month and day value, with a zero year, e.g. an anniversary

7138

# * A year on its own, with zero month and day values

7139

# * A year and month value, with a zero day, e.g. a credit card expiration date

7140

#

7141

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7142

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7143

# month and day.

7144

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7145

# a year.

7146

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7147

# if specifying a year by itself or a year and month where the day is not

7148

# significant.

7149

},

7150

"booleanValue": True or False, # boolean

7151

},

7152

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

},

],

},

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

7157

# only supported value is `AND`.

},

},

},

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7162

"fieldTransformations": [ # Transform the record by applying various field transformations.

7163

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7164

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

7165

# transform content that matches an `InfoType`.

7166

# apply various `PrimitiveTransformation`s to each finding, where the

7167

# transformation is applied to only values that were identified as a specific

7168

# info_type.

7169

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

7170

# for a given infoType.

7171

{ # A transformation to apply to text that is identified as a specific

7172

# info_type.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7173

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

7174

# this transformation to apply to all findings that correspond to

7175

# infoTypes that were requested in `InspectConfig`.

7176

{ # Type of information detected by the API.

7177

"name": "A String", # Name of the information type. Either a name of your choosing when

7178

# creating a CustomInfoType, or one of the names listed

7179

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

7180

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

7181

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7182

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7183

],

7184

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7185

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

7186

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

7187

# to learn more.

7188

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

7189

# If set, must also set cryptoKey. If set, shift will be consistent for the

7190

# given context.

7191

"name": "A String", # Name describing the field.

7192

},

7193

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

7194

# range (inclusive ends). Negative means shift to earlier in time. Must not

7195

# be more than 365250 days (1000 years) each direction.

7196

#

7197

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7198

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

7199

# results in the same shift for the same context and crypto_key. If

7200

# set, must also set context. Can only be applied to table items.

7201

# a key encryption key (KEK) stored by KMS).

7202

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7203

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7204

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7205

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7206

# It will be discarded after the request finishes.

7207

"name": "A String", # Required. Name of the key.

7208

# This is an arbitrary string used to differentiate different keys.

7209

# A unique key is generated per name: two separate `TransientCryptoKey`

7210

# protos share the same generated key if their names are the same.

7211

# When the data crypto key is generated, this name is not used in any way

7212

# (repeating the api call will result in a different key being generated).

7213

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7214

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7215

# The wrapped key must be a 128/192/256 bit key.

7216

# Authorization requires the following IAM permissions when sending a request

7217

# to perform a crypto transformation using a kms-wrapped crypto key:

7218

# dlp.kms.encrypt

7219

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7220

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7221

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7222

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7223

# leaking the key. Choose another type of key if possible.

7224

"key": "A String", # Required. A 128/192/256 bit key.

7225

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7226

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7227

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

7228

},

7229

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

7230

# portion of the value.

7231

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7232

},

7233

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

7234

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7235

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

7236

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

7237

# Note that for the purposes of inspection or transformation, the number

7238

# of bytes considered to comprise a 'Value' is based on its representation

7239

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7240

# 123456789, the number of bytes would be counted as 9, even though an

7241

# int64 only holds up to 8 bytes of data.

7242

"integerValue": "A String", # integer

7243

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7244

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7245

# types are google.type.Date and `google.protobuf.Timestamp`.

7246

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7247

# allow the value 60 if it allows leap-seconds.

7248

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7249

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7250

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7251

# to allow the value "24:00:00" for scenarios like business closing time.

7252

},

7253

"dayOfWeekValue": "A String", # day of week

7254

"floatValue": 3.14, # float

7255

"stringValue": "A String", # string

7256

"timestampValue": "A String", # timestamp

7257

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7258

# and time zone are either specified elsewhere or are not significant. The date

7259

# is relative to the Proleptic Gregorian Calendar. This can represent:

7260

#

7261

# * A full date, with non-zero year, month and day values

7262

# * A month and day value, with a zero year, e.g. an anniversary

7263

# * A year on its own, with zero month and day values

7264

# * A year and month value, with a zero day, e.g. a credit card expiration date

7265

#

7266

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7267

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7268

# month and day.

7269

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7270

# a year.

7271

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7272

# if specifying a year by itself or a year and month where the day is not

7273

# significant.

7274

},

7275

"booleanValue": True or False, # boolean

7276

},

7277

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7278

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

7279

# Uses SHA-256.

7280

# The key size must be either 32 or 64 bytes.

7281

# Outputs a base64 encoded representation of the hashed output

7282

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

7283

# Currently, only string and integer values can be hashed.

7284

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

7285

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

7286

# a key encryption key (KEK) stored by KMS).

7287

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7288

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7289

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7290

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7291

# It will be discarded after the request finishes.

7292

"name": "A String", # Required. Name of the key.

7293

# This is an arbitrary string used to differentiate different keys.

7294

# A unique key is generated per name: two separate `TransientCryptoKey`

7295

# protos share the same generated key if their names are the same.

7296

# When the data crypto key is generated, this name is not used in any way

7297

# (repeating the api call will result in a different key being generated).

7298

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7299

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7300

# The wrapped key must be a 128/192/256 bit key.

7301

# Authorization requires the following IAM permissions when sending a request

7302

# to perform a crypto transformation using a kms-wrapped crypto key:

7303

# dlp.kms.encrypt

7304

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7305

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7306

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7307

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7308

# leaking the key. Choose another type of key if possible.

7309

"key": "A String", # Required. A 128/192/256 bit key.

7310

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7311

},

7312

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7313

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

7314

# fixed character. Masking can start from the beginning or end of the string.

7315

# This can be used on data of any type (numbers, longs, and so on) and when

7316

# de-identifying structured data we'll attempt to preserve the original data's

7317

# type. (This allows you to take a long like 123 and modify it to a string like

7318

# **3.

7319

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

7320

# characters. For example, if the input string is `555-555-5555` and you

7321

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

7322

# returns `***-**5-5555`.

7323

{ # Characters to skip when doing deidentification of a value. These will be left

7324

# alone and skipped.

7325

"charactersToSkip": "A String", # Characters to not transform when masking.

7326

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

7331

# masked. Skipped characters do not count towards this tally.

7332

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

7333

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

7334

# code or credit card number. This string must have a length of 1. If not

7335

# supplied, this value defaults to `*` for strings, and `0` for digits.

7336

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

7337

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

7338

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

7339

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

7340

# is `true`, then the string `12345` is masked as `12***`.

7341

},

7342

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

7343

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

7344

# output would be 'My phone number is '.

7345

},

7346

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

7347

# Bucketing transformation can provide all of this functionality,

7348

# but requires more configuration. This message is provided as a convenience to

7349

# the user for simple bucketing strategies.

7350

#

7351

# The transformed value will be a hyphenated string of

7352

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

7353

# all values that are within this bucket will be replaced with "10-20".

7354

#

7355

# This can be used on data of type: double, long.

7356

#

7357

# If the bound Value type differs from the type of data

7358

# being transformed, we will first attempt converting the type of the data to

7359

# be transformed to match the type of the bound before comparing.

7360

#

7361

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

7362

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

7363

# grouped together into a single bucket; for example if `upper_bound` = 89,

7364

# then all values greater than 89 are replaced with the value "89+".

7365

# Note that for the purposes of inspection or transformation, the number

7366

# of bytes considered to comprise a 'Value' is based on its representation

7367

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7368

# 123456789, the number of bytes would be counted as 9, even though an

7369

# int64 only holds up to 8 bytes of data.

7370

"integerValue": "A String", # integer

7371

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7372

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7373

# types are google.type.Date and `google.protobuf.Timestamp`.

7374

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7375

# allow the value 60 if it allows leap-seconds.

7376

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7377

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7378

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7379

# to allow the value "24:00:00" for scenarios like business closing time.

7380

},

7381

"dayOfWeekValue": "A String", # day of week

7382

"floatValue": 3.14, # float

7383

"stringValue": "A String", # string

7384

"timestampValue": "A String", # timestamp

7385

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7386

# and time zone are either specified elsewhere or are not significant. The date

7387

# is relative to the Proleptic Gregorian Calendar. This can represent:

7388

#

7389

# * A full date, with non-zero year, month and day values

7390

# * A month and day value, with a zero year, e.g. an anniversary

7391

# * A year on its own, with zero month and day values

7392

# * A year and month value, with a zero day, e.g. a credit card expiration date

7393

#

7394

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7395

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7396

# month and day.

7397

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7398

# a year.

7399

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7400

# if specifying a year by itself or a year and month where the day is not

7401

# significant.

7402

},

7403

"booleanValue": True or False, # boolean

7404

},

7405

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

7406

# grouped together into a single bucket; for example if `lower_bound` = 10,

7407

# then all values less than 10 are replaced with the value "-10".

7408

# Note that for the purposes of inspection or transformation, the number

7409

# of bytes considered to comprise a 'Value' is based on its representation

7410

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7411

# 123456789, the number of bytes would be counted as 9, even though an

7412

# int64 only holds up to 8 bytes of data.

7413

"integerValue": "A String", # integer

7414

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7415

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7416

# types are google.type.Date and `google.protobuf.Timestamp`.

7417

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7418

# allow the value 60 if it allows leap-seconds.

7419

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7420

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7421

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7422

# to allow the value "24:00:00" for scenarios like business closing time.

7423

},

7424

"dayOfWeekValue": "A String", # day of week

7425

"floatValue": 3.14, # float

7426

"stringValue": "A String", # string

7427

"timestampValue": "A String", # timestamp

7428

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7429

# and time zone are either specified elsewhere or are not significant. The date

7430

# is relative to the Proleptic Gregorian Calendar. This can represent:

7431

#

7432

# * A full date, with non-zero year, month and day values

7433

# * A month and day value, with a zero year, e.g. an anniversary

7434

# * A year on its own, with zero month and day values

7435

# * A year and month value, with a zero day, e.g. a credit card expiration date

7436

#

7437

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7438

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7439

# month and day.

7440

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7441

# a year.

7442

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7443

# if specifying a year by itself or a year and month where the day is not

7444

# significant.

7445

},

7446

"booleanValue": True or False, # boolean

7447

},

7448

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

7449

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

7450

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

7451

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

7452

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7453

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

7454

# (FPE) with the FFX mode of operation; however when used in the

7455

# `ReidentifyContent` API method, it serves the opposite function by reversing

7456

# the surrogate back into the original identifier. The identifier must be

7457

# encoded as ASCII. For a given crypto key and context, the same identifier

7458

# will be replaced with the same surrogate. Identifiers must be at least two

7459

# characters long. In the case that the identifier is the empty string, it will

7460

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

7461

# more.

7462

#

7463

# Note: We recommend using CryptoDeterministicConfig for all use cases which

7464

# do not require preserving the input alphabet space and size, plus warrant

7465

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7466

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

7467

# This annotation will be applied to the surrogate by prefixing it with

7468

# the name of the custom infoType followed by the number of

7469

# characters comprising the surrogate. The following scheme defines the

7470

# format: info_type_name(surrogate_character_count):surrogate

7471

#

7472

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

7473

# the surrogate is 'abc', the full replacement value

7474

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

7475

#

7476

# This annotation identifies the surrogate when inspecting content using the

7477

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7478

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7479

# This facilitates reversal of the surrogate when it occurs in free text.

7480

#

7481

# In order for inspection to work properly, the name of this infoType must

7482

# not occur naturally anywhere in your data; otherwise, inspection may

7483

# find a surrogate that does not correspond to an actual identifier.

7484

# Therefore, choose your custom infoType name carefully after considering

7485

# what your data looks like. One way to select a name that has a high chance

7486

# of yielding reliable detection is to include one or more unicode characters

7487

# that are highly improbable to exist in your data.

7488

# For example, assuming your data is entered from a regular ASCII keyboard,

7489

# the symbol with the hex code point 29DD might be used like so:

7490

# ⧝MY_TOKEN_TYPE

7491

"name": "A String", # Name of the information type. Either a name of your choosing when

7492

# creating a CustomInfoType, or one of the names listed

7493

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7494

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

7495

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7496

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7497

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7498

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

7499

# identifier in two different contexts won't be given the same surrogate. If

7500

# the context is not set, a default tweak will be used.

7501

#

7502

# If the context is set but:

7503

#

7504

# 1. there is no record present when transforming a given value or

7505

# 1. the field is not present when transforming a given value,

7506

#

7507

# a default tweak will be used.

7508

#

7509

# Note that case (1) is expected when an `InfoTypeTransformation` is

7510

# applied to both structured and non-structured `ContentItem`s.

7511

# Currently, the referenced field may be of value type integer or string.

7512

#

7513

# The tweak is constructed as a sequence of bytes in big endian byte order

7514

# such that:

7515

#

7516

# - a 64 bit integer is encoded followed by a single byte of value 1

7517

# - a string is encoded in UTF-8 format followed by a single byte of value 2

7518

"name": "A String", # Name describing the field.

7519

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7520

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

7521

# that the FFX mode natively supports. This happens before/after

7522

# encryption/decryption.

7523

# Each character listed must appear only once.

7524

# Number of characters must be in the range [2, 95].

7525

# This must be encoded as ASCII.

7526

# The order of characters does not matter.

7527

# The full list of allowed characters is:

7528

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

7529

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7530

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

7531

# a key encryption key (KEK) stored by KMS).

7532

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7533

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7534

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7535

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7536

# It will be discarded after the request finishes.

7537

"name": "A String", # Required. Name of the key.

7538

# This is an arbitrary string used to differentiate different keys.

7539

# A unique key is generated per name: two separate `TransientCryptoKey`

7540

# protos share the same generated key if their names are the same.

7541

# When the data crypto key is generated, this name is not used in any way

7542

# (repeating the api call will result in a different key being generated).

7543

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7544

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7545

# The wrapped key must be a 128/192/256 bit key.

7546

# Authorization requires the following IAM permissions when sending a request

7547

# to perform a crypto transformation using a kms-wrapped crypto key:

7548

# dlp.kms.encrypt

7549

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7550

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7551

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7552

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7553

# leaking the key. Choose another type of key if possible.

7554

"key": "A String", # Required. A 128/192/256 bit key.

7555

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7556

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7557

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7558

},

7559

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

7560

# input. Outputs a base64 encoded representation of the encrypted output.

7561

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7562

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

7563

# referential integrity such that the same identifier in two different

7564

# contexts will be given a distinct surrogate. The context is appended to

7565

# plaintext value being encrypted. On decryption the provided context is

7566

# validated against the value used during encryption. If a context was

7567

# provided during encryption, same context must be provided during decryption

7568

# as well.

7569

#

7570

# If the context is not set, plaintext would be used as is for encryption.

7571

# If the context is set but:

7572

#

7573

# 1. there is no record present when transforming a given value or

7574

# 2. the field is not present when transforming a given value,

7575

#

7576

# plaintext would be used as is for encryption.

7577

#

7578

# Note that case (1) is expected when an `InfoTypeTransformation` is

7579

# applied to both structured and non-structured `ContentItem`s.

7580

"name": "A String", # Name describing the field.

7581

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7582

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

7583

# This annotation will be applied to the surrogate by prefixing it with

7584

# the name of the custom info type followed by the number of

7585

# characters comprising the surrogate. The following scheme defines the

7586

# format: {info type name}({surrogate character count}):{surrogate}

7587

#

7588

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

7589

# the surrogate is 'abc', the full replacement value

7590

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

7591

#

7592

# This annotation identifies the surrogate when inspecting content using the

7593

# custom info type 'Surrogate'. This facilitates reversal of the

7594

# surrogate when it occurs in free text.

7595

#

7596

# Note: For record transformations where the entire cell in a table is being

7597

# transformed, surrogates are not mandatory. Surrogates are used to denote

7598

# the location of the token and are necessary for re-identification in free

7599

# form text.

7600

#

7601

# In order for inspection to work properly, the name of this info type must

7602

# not occur naturally anywhere in your data; otherwise, inspection may either

7603

#

7604

# - reverse a surrogate that does not correspond to an actual identifier

7605

# - be unable to parse the surrogate and result in an error

7606

#

7607

# Therefore, choose your custom info type name carefully after considering

7608

# what your data looks like. One way to select a name that has a high chance

7609

# of yielding reliable detection is to include one or more unicode characters

7610

# that are highly improbable to exist in your data.

7611

# For example, assuming your data is entered from a regular ASCII keyboard,

7612

# the symbol with the hex code point 29DD might be used like so:

7613

# ⧝MY_TOKEN_TYPE.

7614

"name": "A String", # Name of the information type. Either a name of your choosing when

7615

# creating a CustomInfoType, or one of the names listed

7616

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7617

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

7618

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7619

},

7620

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

7621

# a key encryption key (KEK) stored by KMS).

7622

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7623

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7624

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7625

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7626

# It will be discarded after the request finishes.

7627

"name": "A String", # Required. Name of the key.

7628

# This is an arbitrary string used to differentiate different keys.

7629

# A unique key is generated per name: two separate `TransientCryptoKey`

7630

# protos share the same generated key if their names are the same.

7631

# When the data crypto key is generated, this name is not used in any way

7632

# (repeating the api call will result in a different key being generated).

7633

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7634

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7635

# The wrapped key must be a 128/192/256 bit key.

7636

# Authorization requires the following IAM permissions when sending a request

7637

# to perform a crypto transformation using a kms-wrapped crypto key:

7638

# dlp.kms.encrypt

7639

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7640

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7641

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7642

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7643

# leaking the key. Choose another type of key if possible.

7644

"key": "A String", # Required. A 128/192/256 bit key.

7645

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7646

},

7647

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7648

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

7649

# replacement values are dynamically provided by the user for custom behavior,

7650

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

7651

# This can be used on

7652

# data of type: number, long, string, timestamp.

7653

# If the bound `Value` type differs from the type of data being transformed, we

7654

# will first attempt converting the type of the data to be transformed to match

7655

# the type of the bound before comparing.

7656

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

7657

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

7658

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7659

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7660

# Note that for the purposes of inspection or transformation, the number

7661

# of bytes considered to comprise a 'Value' is based on its representation

7662

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7663

# 123456789, the number of bytes would be counted as 9, even though an

7664

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7665

"integerValue": "A String", # integer

7666

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7667

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7668

# types are google.type.Date and `google.protobuf.Timestamp`.

7669

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7670

# allow the value 60 if it allows leap-seconds.

7671

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7672

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7673

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7674

# to allow the value "24:00:00" for scenarios like business closing time.

7675

},

7676

"dayOfWeekValue": "A String", # day of week

7677

"floatValue": 3.14, # float

7678

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7679

"timestampValue": "A String", # timestamp

7680

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7681

# and time zone are either specified elsewhere or are not significant. The date

7682

# is relative to the Proleptic Gregorian Calendar. This can represent:

7683

#

7684

# * A full date, with non-zero year, month and day values

7685

# * A month and day value, with a zero year, e.g. an anniversary

7686

# * A year on its own, with zero month and day values

7687

# * A year and month value, with a zero day, e.g. a credit card expiration date

7688

#

7689

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7690

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7691

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7692

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7693

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7694

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7695

# if specifying a year by itself or a year and month where the day is not

7696

# significant.

7697

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7698

"booleanValue": True or False, # boolean

7699

},

7700

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

7701

# Note that for the purposes of inspection or transformation, the number

7702

# of bytes considered to comprise a 'Value' is based on its representation

7703

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7704

# 123456789, the number of bytes would be counted as 9, even though an

7705

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7706

"integerValue": "A String", # integer

7707

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7708

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7709

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7710

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7711

# allow the value 60 if it allows leap-seconds.

7712

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7713

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7714

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7715

# to allow the value "24:00:00" for scenarios like business closing time.

7716

},

7717

"dayOfWeekValue": "A String", # day of week

7718

"floatValue": 3.14, # float

7719

"stringValue": "A String", # string

7720

"timestampValue": "A String", # timestamp

7721

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7722

# and time zone are either specified elsewhere or are not significant. The date

7723

# is relative to the Proleptic Gregorian Calendar. This can represent:

7724

#

7725

# * A full date, with non-zero year, month and day values

7726

# * A month and day value, with a zero year, e.g. an anniversary

7727

# * A year on its own, with zero month and day values

7728

# * A year and month value, with a zero day, e.g. a credit card expiration date

7729

#

7730

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7731

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7732

# month and day.

7733

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7734

# a year.

7735

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7736

# if specifying a year by itself or a year and month where the day is not

7737

# significant.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7738

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7739

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7740

},

7741

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

7742

# used.

7743

# Note that for the purposes of inspection or transformation, the number

7744

# of bytes considered to comprise a 'Value' is based on its representation

7745

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7746

# 123456789, the number of bytes would be counted as 9, even though an

7747

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7748

"integerValue": "A String", # integer

7749

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7750

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7751

# types are google.type.Date and `google.protobuf.Timestamp`.

7752

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7753

# allow the value 60 if it allows leap-seconds.

7754

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7755

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7756

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7757

# to allow the value "24:00:00" for scenarios like business closing time.

7758

},

7759

"dayOfWeekValue": "A String", # day of week

7760

"floatValue": 3.14, # float

7761

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7762

"timestampValue": "A String", # timestamp

7763

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7764

# and time zone are either specified elsewhere or are not significant. The date

7765

# is relative to the Proleptic Gregorian Calendar. This can represent:

7766

#

7767

# * A full date, with non-zero year, month and day values

7768

# * A month and day value, with a zero year, e.g. an anniversary

7769

# * A year on its own, with zero month and day values

7770

# * A year and month value, with a zero day, e.g. a credit card expiration date

7771

#

7772

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7773

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7774

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7775

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7776

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7777

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7778

# if specifying a year by itself or a year and month where the day is not

7779

# significant.

7780

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7781

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7791

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

7792

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

7793

# to learn more.

7794

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

7795

# If set, must also set cryptoKey. If set, shift will be consistent for the

7796

# given context.

7797

"name": "A String", # Name describing the field.

7798

},

7799

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

7800

# range (inclusive ends). Negative means shift to earlier in time. Must not

7801

# be more than 365250 days (1000 years) each direction.

7802

#

7803

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7804

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

7805

# results in the same shift for the same context and crypto_key. If

7806

# set, must also set context. Can only be applied to table items.

7807

# a key encryption key (KEK) stored by KMS).

7808

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7809

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7810

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7811

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7812

# It will be discarded after the request finishes.

7813

"name": "A String", # Required. Name of the key.

7814

# This is an arbitrary string used to differentiate different keys.

7815

# A unique key is generated per name: two separate `TransientCryptoKey`

7816

# protos share the same generated key if their names are the same.

7817

# When the data crypto key is generated, this name is not used in any way

7818

# (repeating the api call will result in a different key being generated).

7819

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7820

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7821

# The wrapped key must be a 128/192/256 bit key.

7822

# Authorization requires the following IAM permissions when sending a request

7823

# to perform a crypto transformation using a kms-wrapped crypto key:

7824

# dlp.kms.encrypt

7825

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7826

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7827

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7828

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7829

# leaking the key. Choose another type of key if possible.

7830

"key": "A String", # Required. A 128/192/256 bit key.

7831

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7832

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7833

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

7834

},

7835

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

7836

# portion of the value.

7837

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7838

},

7839

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

7840

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7841

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

7842

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

7843

# Note that for the purposes of inspection or transformation, the number

7844

# of bytes considered to comprise a 'Value' is based on its representation

7845

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7846

# 123456789, the number of bytes would be counted as 9, even though an

7847

# int64 only holds up to 8 bytes of data.

7848

"integerValue": "A String", # integer

7849

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7850

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7851

# types are google.type.Date and `google.protobuf.Timestamp`.

7852

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7853

# allow the value 60 if it allows leap-seconds.

7854

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7855

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7856

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7857

# to allow the value "24:00:00" for scenarios like business closing time.

7858

},

7859

"dayOfWeekValue": "A String", # day of week

7860

"floatValue": 3.14, # float

7861

"stringValue": "A String", # string

7862

"timestampValue": "A String", # timestamp

7863

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7864

# and time zone are either specified elsewhere or are not significant. The date

7865

# is relative to the Proleptic Gregorian Calendar. This can represent:

7866

#

7867

# * A full date, with non-zero year, month and day values

7868

# * A month and day value, with a zero year, e.g. an anniversary

7869

# * A year on its own, with zero month and day values

7870

# * A year and month value, with a zero day, e.g. a credit card expiration date

7871

#

7872

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

7873

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

7874

# month and day.

7875

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

7876

# a year.

7877

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

7878

# if specifying a year by itself or a year and month where the day is not

7879

# significant.

7880

},

7881

"booleanValue": True or False, # boolean

7882

},

7883

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7884

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

7885

# Uses SHA-256.

7886

# The key size must be either 32 or 64 bytes.

7887

# Outputs a base64 encoded representation of the hashed output

7888

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

7889

# Currently, only string and integer values can be hashed.

7890

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

7891

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

7892

# a key encryption key (KEK) stored by KMS).

7893

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

7894

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

7895

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7896

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

7897

# It will be discarded after the request finishes.

7898

"name": "A String", # Required. Name of the key.

7899

# This is an arbitrary string used to differentiate different keys.

7900

# A unique key is generated per name: two separate `TransientCryptoKey`

7901

# protos share the same generated key if their names are the same.

7902

# When the data crypto key is generated, this name is not used in any way

7903

# (repeating the api call will result in a different key being generated).

7904

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

7905

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

7906

# The wrapped key must be a 128/192/256 bit key.

7907

# Authorization requires the following IAM permissions when sending a request

7908

# to perform a crypto transformation using a kms-wrapped crypto key:

7909

# dlp.kms.encrypt

7910

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

7911

"wrappedKey": "A String", # Required. The wrapped data crypto key.

7912

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7913

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

7914

# leaking the key. Choose another type of key if possible.

7915

"key": "A String", # Required. A 128/192/256 bit key.

7916

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

7917

},

7918

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

7919

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

7920

# fixed character. Masking can start from the beginning or end of the string.

7921

# This can be used on data of any type (numbers, longs, and so on) and when

7922

# de-identifying structured data we'll attempt to preserve the original data's

7923

# type. (This allows you to take a long like 123 and modify it to a string like

7924

# **3.

7925

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

7926

# characters. For example, if the input string is `555-555-5555` and you

7927

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

7928

# returns `***-**5-5555`.

7929

{ # Characters to skip when doing deidentification of a value. These will be left

7930

# alone and skipped.

7931

"charactersToSkip": "A String", # Characters to not transform when masking.

7932

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

7937

# masked. Skipped characters do not count towards this tally.

7938

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

7939

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

7940

# code or credit card number. This string must have a length of 1. If not

7941

# supplied, this value defaults to `*` for strings, and `0` for digits.

7942

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

7943

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

7944

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

7945

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

7946

# is `true`, then the string `12345` is masked as `12***`.

7947

},

7948

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

7949

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

7950

# output would be 'My phone number is '.

7951

},

7952

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

7953

# Bucketing transformation can provide all of this functionality,

7954

# but requires more configuration. This message is provided as a convenience to

7955

# the user for simple bucketing strategies.

7956

#

7957

# The transformed value will be a hyphenated string of

7958

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

7959

# all values that are within this bucket will be replaced with "10-20".

7960

#

7961

# This can be used on data of type: double, long.

7962

#

7963

# If the bound Value type differs from the type of data

7964

# being transformed, we will first attempt converting the type of the data to

7965

# be transformed to match the type of the bound before comparing.

7966

#

7967

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

7968

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

7969

# grouped together into a single bucket; for example if `upper_bound` = 89,

7970

# then all values greater than 89 are replaced with the value "89+".

7971

# Note that for the purposes of inspection or transformation, the number

7972

# of bytes considered to comprise a 'Value' is based on its representation

7973

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

7974

# 123456789, the number of bytes would be counted as 9, even though an

7975

# int64 only holds up to 8 bytes of data.

7976

"integerValue": "A String", # integer

7977

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

7978

# or are specified elsewhere. An API may choose to allow leap seconds. Related

7979

# types are google.type.Date and `google.protobuf.Timestamp`.

7980

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

7981

# allow the value 60 if it allows leap-seconds.

7982

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

7983

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

7984

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

7985

# to allow the value "24:00:00" for scenarios like business closing time.

7986

},

7987

"dayOfWeekValue": "A String", # day of week

7988

"floatValue": 3.14, # float

7989

"stringValue": "A String", # string

7990

"timestampValue": "A String", # timestamp

7991

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

7992

# and time zone are either specified elsewhere or are not significant. The date

7993

# is relative to the Proleptic Gregorian Calendar. This can represent:

7994

#

7995

# * A full date, with non-zero year, month and day values

7996

# * A month and day value, with a zero year, e.g. an anniversary

7997

# * A year on its own, with zero month and day values

7998

# * A year and month value, with a zero day, e.g. a credit card expiration date

7999

#

8000

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8001

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8002

# month and day.

8003

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8004

# a year.

8005

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8006

# if specifying a year by itself or a year and month where the day is not

8007

# significant.

8008

},

8009

"booleanValue": True or False, # boolean

8010

},

8011

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

8012

# grouped together into a single bucket; for example if `lower_bound` = 10,

8013

# then all values less than 10 are replaced with the value "-10".

8014

# Note that for the purposes of inspection or transformation, the number

8015

# of bytes considered to comprise a 'Value' is based on its representation

8016

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8017

# 123456789, the number of bytes would be counted as 9, even though an

8018

# int64 only holds up to 8 bytes of data.

8019

"integerValue": "A String", # integer

8020

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8021

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8022

# types are google.type.Date and `google.protobuf.Timestamp`.

8023

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8024

# allow the value 60 if it allows leap-seconds.

8025

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8026

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8027

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8028

# to allow the value "24:00:00" for scenarios like business closing time.

8029

},

8030

"dayOfWeekValue": "A String", # day of week

8031

"floatValue": 3.14, # float

8032

"stringValue": "A String", # string

8033

"timestampValue": "A String", # timestamp

8034

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8035

# and time zone are either specified elsewhere or are not significant. The date

8036

# is relative to the Proleptic Gregorian Calendar. This can represent:

8037

#

8038

# * A full date, with non-zero year, month and day values

8039

# * A month and day value, with a zero year, e.g. an anniversary

8040

# * A year on its own, with zero month and day values

8041

# * A year and month value, with a zero day, e.g. a credit card expiration date

8042

#

8043

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8044

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8045

# month and day.

8046

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8047

# a year.

8048

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8049

# if specifying a year by itself or a year and month where the day is not

8050

# significant.

8051

},

8052

"booleanValue": True or False, # boolean

8053

},

8054

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

8055

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

8056

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

8057

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

8058

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8059

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

8060

# (FPE) with the FFX mode of operation; however when used in the

8061

# `ReidentifyContent` API method, it serves the opposite function by reversing

8062

# the surrogate back into the original identifier. The identifier must be

8063

# encoded as ASCII. For a given crypto key and context, the same identifier

8064

# will be replaced with the same surrogate. Identifiers must be at least two

8065

# characters long. In the case that the identifier is the empty string, it will

8066

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

8067

# more.

8068

#

8069

# Note: We recommend using CryptoDeterministicConfig for all use cases which

8070

# do not require preserving the input alphabet space and size, plus warrant

8071

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8072

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

8073

# This annotation will be applied to the surrogate by prefixing it with

8074

# the name of the custom infoType followed by the number of

8075

# characters comprising the surrogate. The following scheme defines the

8076

# format: info_type_name(surrogate_character_count):surrogate

8077

#

8078

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

8079

# the surrogate is 'abc', the full replacement value

8080

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

8081

#

8082

# This annotation identifies the surrogate when inspecting content using the

8083

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8084

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8085

# This facilitates reversal of the surrogate when it occurs in free text.

8086

#

8087

# In order for inspection to work properly, the name of this infoType must

8088

# not occur naturally anywhere in your data; otherwise, inspection may

8089

# find a surrogate that does not correspond to an actual identifier.

8090

# Therefore, choose your custom infoType name carefully after considering

8091

# what your data looks like. One way to select a name that has a high chance

8092

# of yielding reliable detection is to include one or more unicode characters

8093

# that are highly improbable to exist in your data.

8094

# For example, assuming your data is entered from a regular ASCII keyboard,

8095

# the symbol with the hex code point 29DD might be used like so:

8096

# ⧝MY_TOKEN_TYPE

8097

"name": "A String", # Name of the information type. Either a name of your choosing when

8098

# creating a CustomInfoType, or one of the names listed

8099

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8100

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

8101

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8102

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8103

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8104

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

8105

# identifier in two different contexts won't be given the same surrogate. If

8106

# the context is not set, a default tweak will be used.

8107

#

8108

# If the context is set but:

8109

#

8110

# 1. there is no record present when transforming a given value or

8111

# 1. the field is not present when transforming a given value,

8112

#

8113

# a default tweak will be used.

8114

#

8115

# Note that case (1) is expected when an `InfoTypeTransformation` is

8116

# applied to both structured and non-structured `ContentItem`s.

8117

# Currently, the referenced field may be of value type integer or string.

8118

#

8119

# The tweak is constructed as a sequence of bytes in big endian byte order

8120

# such that:

8121

#

8122

# - a 64 bit integer is encoded followed by a single byte of value 1

8123

# - a string is encoded in UTF-8 format followed by a single byte of value 2

8124

"name": "A String", # Name describing the field.

8125

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8126

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

8127

# that the FFX mode natively supports. This happens before/after

8128

# encryption/decryption.

8129

# Each character listed must appear only once.

8130

# Number of characters must be in the range [2, 95].

8131

# This must be encoded as ASCII.

8132

# The order of characters does not matter.

8133

# The full list of allowed characters is:

8134

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

8135

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8136

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

8137

# a key encryption key (KEK) stored by KMS).

8138

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8139

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8140

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8141

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8142

# It will be discarded after the request finishes.

8143

"name": "A String", # Required. Name of the key.

8144

# This is an arbitrary string used to differentiate different keys.

8145

# A unique key is generated per name: two separate `TransientCryptoKey`

8146

# protos share the same generated key if their names are the same.

8147

# When the data crypto key is generated, this name is not used in any way

8148

# (repeating the api call will result in a different key being generated).

8149

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8150

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8151

# The wrapped key must be a 128/192/256 bit key.

8152

# Authorization requires the following IAM permissions when sending a request

8153

# to perform a crypto transformation using a kms-wrapped crypto key:

8154

# dlp.kms.encrypt

8155

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8156

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8157

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8158

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8159

# leaking the key. Choose another type of key if possible.

8160

"key": "A String", # Required. A 128/192/256 bit key.

8161

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8162

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8163

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8164

},

8165

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

8166

# input. Outputs a base64 encoded representation of the encrypted output.

8167

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8168

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

8169

# referential integrity such that the same identifier in two different

8170

# contexts will be given a distinct surrogate. The context is appended to

8171

# plaintext value being encrypted. On decryption the provided context is

8172

# validated against the value used during encryption. If a context was

8173

# provided during encryption, same context must be provided during decryption

8174

# as well.

8175

#

8176

# If the context is not set, plaintext would be used as is for encryption.

8177

# If the context is set but:

8178

#

8179

# 1. there is no record present when transforming a given value or

8180

# 2. the field is not present when transforming a given value,

8181

#

8182

# plaintext would be used as is for encryption.

8183

#

8184

# Note that case (1) is expected when an `InfoTypeTransformation` is

8185

# applied to both structured and non-structured `ContentItem`s.

8186

"name": "A String", # Name describing the field.

8187

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8188

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

8189

# This annotation will be applied to the surrogate by prefixing it with

8190

# the name of the custom info type followed by the number of

8191

# characters comprising the surrogate. The following scheme defines the

8192

# format: {info type name}({surrogate character count}):{surrogate}

8193

#

8194

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

8195

# the surrogate is 'abc', the full replacement value

8196

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

8197

#

8198

# This annotation identifies the surrogate when inspecting content using the

8199

# custom info type 'Surrogate'. This facilitates reversal of the

8200

# surrogate when it occurs in free text.

8201

#

8202

# Note: For record transformations where the entire cell in a table is being

8203

# transformed, surrogates are not mandatory. Surrogates are used to denote

8204

# the location of the token and are necessary for re-identification in free

8205

# form text.

8206

#

8207

# In order for inspection to work properly, the name of this info type must

8208

# not occur naturally anywhere in your data; otherwise, inspection may either

8209

#

8210

# - reverse a surrogate that does not correspond to an actual identifier

8211

# - be unable to parse the surrogate and result in an error

8212

#

8213

# Therefore, choose your custom info type name carefully after considering

8214

# what your data looks like. One way to select a name that has a high chance

8215

# of yielding reliable detection is to include one or more unicode characters

8216

# that are highly improbable to exist in your data.

8217

# For example, assuming your data is entered from a regular ASCII keyboard,

8218

# the symbol with the hex code point 29DD might be used like so:

8219

# ⧝MY_TOKEN_TYPE.

8220

"name": "A String", # Name of the information type. Either a name of your choosing when

8221

# creating a CustomInfoType, or one of the names listed

8222

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8223

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

8224

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8225

},

8226

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

8227

# a key encryption key (KEK) stored by KMS).

8228

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8229

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8230

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8231

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8232

# It will be discarded after the request finishes.

8233

"name": "A String", # Required. Name of the key.

8234

# This is an arbitrary string used to differentiate different keys.

8235

# A unique key is generated per name: two separate `TransientCryptoKey`

8236

# protos share the same generated key if their names are the same.

8237

# When the data crypto key is generated, this name is not used in any way

8238

# (repeating the api call will result in a different key being generated).

8239

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8240

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8241

# The wrapped key must be a 128/192/256 bit key.

8242

# Authorization requires the following IAM permissions when sending a request

8243

# to perform a crypto transformation using a kms-wrapped crypto key:

8244

# dlp.kms.encrypt

8245

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8246

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8247

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8248

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8249

# leaking the key. Choose another type of key if possible.

8250

"key": "A String", # Required. A 128/192/256 bit key.

8251

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8252

},

8253

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8254

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

8255

# replacement values are dynamically provided by the user for custom behavior,

8256

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

8257

# This can be used on

8258

# data of type: number, long, string, timestamp.

8259

# If the bound `Value` type differs from the type of data being transformed, we

8260

# will first attempt converting the type of the data to be transformed to match

8261

# the type of the bound before comparing.

8262

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

8263

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

8264

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8265

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8266

# Note that for the purposes of inspection or transformation, the number

8267

# of bytes considered to comprise a 'Value' is based on its representation

8268

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8269

# 123456789, the number of bytes would be counted as 9, even though an

8270

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8271

"integerValue": "A String", # integer

8272

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8273

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8274

# types are google.type.Date and `google.protobuf.Timestamp`.

8275

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8276

# allow the value 60 if it allows leap-seconds.

8277

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8278

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8279

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8280

# to allow the value "24:00:00" for scenarios like business closing time.

8281

},

8282

"dayOfWeekValue": "A String", # day of week

8283

"floatValue": 3.14, # float

8284

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8285

"timestampValue": "A String", # timestamp

8286

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8287

# and time zone are either specified elsewhere or are not significant. The date

8288

# is relative to the Proleptic Gregorian Calendar. This can represent:

8289

#

8290

# * A full date, with non-zero year, month and day values

8291

# * A month and day value, with a zero year, e.g. an anniversary

8292

# * A year on its own, with zero month and day values

8293

# * A year and month value, with a zero day, e.g. a credit card expiration date

8294

#

8295

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8296

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8297

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8298

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8299

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8300

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8301

# if specifying a year by itself or a year and month where the day is not

8302

# significant.

8303

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8304

"booleanValue": True or False, # boolean

8305

},

8306

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

8307

# Note that for the purposes of inspection or transformation, the number

8308

# of bytes considered to comprise a 'Value' is based on its representation

8309

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8310

# 123456789, the number of bytes would be counted as 9, even though an

8311

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8312

"integerValue": "A String", # integer

8313

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8314

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8315

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8316

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8317

# allow the value 60 if it allows leap-seconds.

8318

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8319

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8320

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8321

# to allow the value "24:00:00" for scenarios like business closing time.

8322

},

8323

"dayOfWeekValue": "A String", # day of week

8324

"floatValue": 3.14, # float

8325

"stringValue": "A String", # string

8326

"timestampValue": "A String", # timestamp

8327

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8328

# and time zone are either specified elsewhere or are not significant. The date

8329

# is relative to the Proleptic Gregorian Calendar. This can represent:

8330

#

8331

# * A full date, with non-zero year, month and day values

8332

# * A month and day value, with a zero year, e.g. an anniversary

8333

# * A year on its own, with zero month and day values

8334

# * A year and month value, with a zero day, e.g. a credit card expiration date

8335

#

8336

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8337

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8338

# month and day.

8339

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8340

# a year.

8341

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8342

# if specifying a year by itself or a year and month where the day is not

8343

# significant.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8344

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8345

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8346

},

8347

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

8348

# used.

8349

# Note that for the purposes of inspection or transformation, the number

8350

# of bytes considered to comprise a 'Value' is based on its representation

8351

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8352

# 123456789, the number of bytes would be counted as 9, even though an

8353

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8354

"integerValue": "A String", # integer

8355

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8356

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8357

# types are google.type.Date and `google.protobuf.Timestamp`.

8358

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8359

# allow the value 60 if it allows leap-seconds.

8360

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8361

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8362

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8363

# to allow the value "24:00:00" for scenarios like business closing time.

8364

},

8365

"dayOfWeekValue": "A String", # day of week

8366

"floatValue": 3.14, # float

8367

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8368

"timestampValue": "A String", # timestamp

8369

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8370

# and time zone are either specified elsewhere or are not significant. The date

8371

# is relative to the Proleptic Gregorian Calendar. This can represent:

8372

#

8373

# * A full date, with non-zero year, month and day values

8374

# * A month and day value, with a zero year, e.g. an anniversary

8375

# * A year on its own, with zero month and day values

8376

# * A year and month value, with a zero day, e.g. a credit card expiration date

8377

#

8378

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8379

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8380

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8381

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8382

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8383

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8384

# if specifying a year by itself or a year and month where the day is not

8385

# significant.

8386

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8387

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8392

},

8393

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

8394

# given `RecordCondition`. The conditions are allowed to reference fields

8395

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

8400

# column for the same record is within a specific range.

8401

# - Redact a field if the date of birth field is greater than 85.

8402

# a field.

8403

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8404

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

8405

"conditions": [ # A collection of conditions.

8406

{ # The field type of `value` and `field` do not need to match to be

8407

# considered equal, but not all comparisons are possible.

8408

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

8409

# but all other comparisons are invalid with incompatible types.

8410

# A `value` of type:

8411

#

8412

# - `string` can be compared against all other types

8413

# - `boolean` can only be compared against other booleans

8414

# - `integer` can be compared against doubles or a string if the string value

8415

# can be parsed as an integer.

8416

# - `double` can be compared against integers or a string if the string can

8417

# be parsed as a double.

8418

# - `Timestamp` can be compared against strings in RFC 3339 date string

8419

# format.

8420

# - `TimeOfDay` can be compared against timestamps and strings in the format

8421

# of 'HH:mm:ss'.

8422

#

8423

# If we fail to compare do to type mismatch, a warning will be given and

8424

# the condition will evaluate to false.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8425

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

8426

"name": "A String", # Name describing the field.

8427

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8428

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

8429

# Note that for the purposes of inspection or transformation, the number

8430

# of bytes considered to comprise a 'Value' is based on its representation

8431

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8432

# 123456789, the number of bytes would be counted as 9, even though an

8433

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8434

"integerValue": "A String", # integer

8435

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8436

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8437

# types are google.type.Date and `google.protobuf.Timestamp`.

8438

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8439

# allow the value 60 if it allows leap-seconds.

8440

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8441

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8442

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8443

# to allow the value "24:00:00" for scenarios like business closing time.

8444

},

8445

"dayOfWeekValue": "A String", # day of week

8446

"floatValue": 3.14, # float

8447

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8448

"timestampValue": "A String", # timestamp

8449

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8450

# and time zone are either specified elsewhere or are not significant. The date

8451

# is relative to the Proleptic Gregorian Calendar. This can represent:

8452

#

8453

# * A full date, with non-zero year, month and day values

8454

# * A month and day value, with a zero year, e.g. an anniversary

8455

# * A year on its own, with zero month and day values

8456

# * A year and month value, with a zero day, e.g. a credit card expiration date

8457

#

8458

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8459

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8460

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8461

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8462

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8463

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8464

# if specifying a year by itself or a year and month where the day is not

8465

# significant.

8466

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8467

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8468

},

8469

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8470

},

8471

],

8472

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8473

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

8474

# only supported value is `AND`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8475

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8476

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8477

"fields": [ # Required. Input field(s) to apply the transformation to.

8478

{ # General identifier of a data field in a storage service.

8479

"name": "A String", # Name describing the field.

8480

},

8481

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8486

"createTime": "A String", # Output only. The creation timestamp of an inspectTemplate.

8487

"updateTime": "A String", # Output only. The last update timestamp of an inspectTemplate.

8488

"description": "A String", # Short description (max 256 chars).

8489

"displayName": "A String", # Display name (max 256 chars).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

}</pre>

</div>

<code class="details" id="list_next">list_next(previous_request, previous_response)</code>

8497

<pre>Retrieves the next page of results.

8498

8499

Args:

8500

previous_request: The request for the previous page. (required)

8501

previous_response: The response from the request for the previous page. (required)

8502

8503

Returns:

8504

A request object that you can call 'execute()' on to request the next

8505

page. Returns None if there are no more items in the collection.

</pre>

</div>

<code class="details" id="patch">patch(name, body=None, x__xgafv=None)</code>

8511

<pre>Updates the DeidentifyTemplate.

8512

See https://cloud.google.com/dlp/docs/creating-templates-deid to learn

more.

Args:

name: string, Required. Resource name of organization and deidentify template to be updated, for

8517

example `organizations/433245324/deidentifyTemplates/432452342` or

8518

projects/project-id/deidentifyTemplates/432452342. (required)

8519

body: object, The request body.

8520

The object takes the form of:

8521

8522

{ # Request message for UpdateDeidentifyTemplate.

8523

"deidentifyTemplate": { # DeidentifyTemplates contains instructions on how to de-identify content. # New DeidentifyTemplate value.

8524

# See https://cloud.google.com/dlp/docs/concepts-templates to learn more.

8525

"name": "A String", # Output only. The template name.

8526

#

8527

# The template will have one of the following formats:

8528

# `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR

8529

# `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

8530

"deidentifyConfig": { # The configuration that controls how the data will change. # ///////////// // The core content of the template // ///////////////

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8531

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text

8532

# transformation everywhere.

8533

# apply various `PrimitiveTransformation`s to each finding, where the

8534

# transformation is applied to only values that were identified as a specific

8535

# info_type.

8536

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

8537

# for a given infoType.

8538

{ # A transformation to apply to text that is identified as a specific

8539

# info_type.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8540

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

8541

# this transformation to apply to all findings that correspond to

8542

# infoTypes that were requested in `InspectConfig`.

8543

{ # Type of information detected by the API.

8544

"name": "A String", # Name of the information type. Either a name of your choosing when

8545

# creating a CustomInfoType, or one of the names listed

8546

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

8547

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

8548

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8549

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8550

],

8551

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8552

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

8553

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

8554

# to learn more.

8555

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

8556

# If set, must also set cryptoKey. If set, shift will be consistent for the

8557

# given context.

8558

"name": "A String", # Name describing the field.

8559

},

8560

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

8561

# range (inclusive ends). Negative means shift to earlier in time. Must not

8562

# be more than 365250 days (1000 years) each direction.

8563

#

8564

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8565

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

8566

# results in the same shift for the same context and crypto_key. If

8567

# set, must also set context. Can only be applied to table items.

8568

# a key encryption key (KEK) stored by KMS).

8569

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8570

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8571

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8572

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8573

# It will be discarded after the request finishes.

8574

"name": "A String", # Required. Name of the key.

8575

# This is an arbitrary string used to differentiate different keys.

8576

# A unique key is generated per name: two separate `TransientCryptoKey`

8577

# protos share the same generated key if their names are the same.

8578

# When the data crypto key is generated, this name is not used in any way

8579

# (repeating the api call will result in a different key being generated).

8580

},

8581

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8582

# The wrapped key must be a 128/192/256 bit key.

8583

# Authorization requires the following IAM permissions when sending a request

8584

# to perform a crypto transformation using a kms-wrapped crypto key:

8585

# dlp.kms.encrypt

8586

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8587

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8588

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8589

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8590

# leaking the key. Choose another type of key if possible.

8591

"key": "A String", # Required. A 128/192/256 bit key.

8592

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8593

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8594

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

8595

},

8596

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

8597

# portion of the value.

8598

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8599

},

8600

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

8601

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8602

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

8603

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

8604

# Note that for the purposes of inspection or transformation, the number

8605

# of bytes considered to comprise a 'Value' is based on its representation

8606

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8607

# 123456789, the number of bytes would be counted as 9, even though an

8608

# int64 only holds up to 8 bytes of data.

8609

"integerValue": "A String", # integer

8610

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8611

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8612

# types are google.type.Date and `google.protobuf.Timestamp`.

8613

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8614

# allow the value 60 if it allows leap-seconds.

8615

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8616

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8617

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8618

# to allow the value "24:00:00" for scenarios like business closing time.

8619

},

8620

"dayOfWeekValue": "A String", # day of week

8621

"floatValue": 3.14, # float

8622

"stringValue": "A String", # string

8623

"timestampValue": "A String", # timestamp

8624

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8625

# and time zone are either specified elsewhere or are not significant. The date

8626

# is relative to the Proleptic Gregorian Calendar. This can represent:

8627

#

8628

# * A full date, with non-zero year, month and day values

8629

# * A month and day value, with a zero year, e.g. an anniversary

8630

# * A year on its own, with zero month and day values

8631

# * A year and month value, with a zero day, e.g. a credit card expiration date

8632

#

8633

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8634

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8635

# month and day.

8636

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8637

# a year.

8638

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8639

# if specifying a year by itself or a year and month where the day is not

8640

# significant.

8641

},

8642

"booleanValue": True or False, # boolean

8643

},

8644

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8645

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

8646

# Uses SHA-256.

8647

# The key size must be either 32 or 64 bytes.

8648

# Outputs a base64 encoded representation of the hashed output

8649

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

8650

# Currently, only string and integer values can be hashed.

8651

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

8652

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

8653

# a key encryption key (KEK) stored by KMS).

8654

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8655

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8656

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8657

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8658

# It will be discarded after the request finishes.

8659

"name": "A String", # Required. Name of the key.

8660

# This is an arbitrary string used to differentiate different keys.

8661

# A unique key is generated per name: two separate `TransientCryptoKey`

8662

# protos share the same generated key if their names are the same.

8663

# When the data crypto key is generated, this name is not used in any way

8664

# (repeating the api call will result in a different key being generated).

8665

},

8666

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8667

# The wrapped key must be a 128/192/256 bit key.

8668

# Authorization requires the following IAM permissions when sending a request

8669

# to perform a crypto transformation using a kms-wrapped crypto key:

8670

# dlp.kms.encrypt

8671

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8672

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8673

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8674

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8675

# leaking the key. Choose another type of key if possible.

8676

"key": "A String", # Required. A 128/192/256 bit key.

8677

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8678

},

8679

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8680

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

8681

# fixed character. Masking can start from the beginning or end of the string.

8682

# This can be used on data of any type (numbers, longs, and so on) and when

8683

# de-identifying structured data we'll attempt to preserve the original data's

8684

# type. (This allows you to take a long like 123 and modify it to a string like

8685

# **3.

8686

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

8687

# characters. For example, if the input string is `555-555-5555` and you

8688

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

8689

# returns `***-**5-5555`.

8690

{ # Characters to skip when doing deidentification of a value. These will be left

8691

# alone and skipped.

8692

"charactersToSkip": "A String", # Characters to not transform when masking.

8693

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

8698

# masked. Skipped characters do not count towards this tally.

8699

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

8700

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

8701

# code or credit card number. This string must have a length of 1. If not

8702

# supplied, this value defaults to `*` for strings, and `0` for digits.

8703

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

8704

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

8705

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

8706

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

8707

# is `true`, then the string `12345` is masked as `12***`.

8708

},

8709

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

8710

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

8711

# output would be 'My phone number is '.

8712

},

8713

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

8714

# Bucketing transformation can provide all of this functionality,

8715

# but requires more configuration. This message is provided as a convenience to

8716

# the user for simple bucketing strategies.

8717

#

8718

# The transformed value will be a hyphenated string of

8719

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

8720

# all values that are within this bucket will be replaced with "10-20".

8721

#

8722

# This can be used on data of type: double, long.

8723

#

8724

# If the bound Value type differs from the type of data

8725

# being transformed, we will first attempt converting the type of the data to

8726

# be transformed to match the type of the bound before comparing.

8727

#

8728

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

8729

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

8730

# grouped together into a single bucket; for example if `upper_bound` = 89,

8731

# then all values greater than 89 are replaced with the value "89+".

8732

# Note that for the purposes of inspection or transformation, the number

8733

# of bytes considered to comprise a 'Value' is based on its representation

8734

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8735

# 123456789, the number of bytes would be counted as 9, even though an

8736

# int64 only holds up to 8 bytes of data.

8737

"integerValue": "A String", # integer

8738

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8739

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8740

# types are google.type.Date and `google.protobuf.Timestamp`.

8741

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8742

# allow the value 60 if it allows leap-seconds.

8743

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8744

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8745

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8746

# to allow the value "24:00:00" for scenarios like business closing time.

8747

},

8748

"dayOfWeekValue": "A String", # day of week

8749

"floatValue": 3.14, # float

8750

"stringValue": "A String", # string

8751

"timestampValue": "A String", # timestamp

8752

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8753

# and time zone are either specified elsewhere or are not significant. The date

8754

# is relative to the Proleptic Gregorian Calendar. This can represent:

8755

#

8756

# * A full date, with non-zero year, month and day values

8757

# * A month and day value, with a zero year, e.g. an anniversary

8758

# * A year on its own, with zero month and day values

8759

# * A year and month value, with a zero day, e.g. a credit card expiration date

8760

#

8761

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8762

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8763

# month and day.

8764

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8765

# a year.

8766

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8767

# if specifying a year by itself or a year and month where the day is not

8768

# significant.

8769

},

8770

"booleanValue": True or False, # boolean

8771

},

8772

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

8773

# grouped together into a single bucket; for example if `lower_bound` = 10,

8774

# then all values less than 10 are replaced with the value "-10".

8775

# Note that for the purposes of inspection or transformation, the number

8776

# of bytes considered to comprise a 'Value' is based on its representation

8777

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

8778

# 123456789, the number of bytes would be counted as 9, even though an

8779

# int64 only holds up to 8 bytes of data.

8780

"integerValue": "A String", # integer

8781

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

8782

# or are specified elsewhere. An API may choose to allow leap seconds. Related

8783

# types are google.type.Date and `google.protobuf.Timestamp`.

8784

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

8785

# allow the value 60 if it allows leap-seconds.

8786

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

8787

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

8788

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

8789

# to allow the value "24:00:00" for scenarios like business closing time.

8790

},

8791

"dayOfWeekValue": "A String", # day of week

8792

"floatValue": 3.14, # float

8793

"stringValue": "A String", # string

8794

"timestampValue": "A String", # timestamp

8795

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

8796

# and time zone are either specified elsewhere or are not significant. The date

8797

# is relative to the Proleptic Gregorian Calendar. This can represent:

8798

#

8799

# * A full date, with non-zero year, month and day values

8800

# * A month and day value, with a zero year, e.g. an anniversary

8801

# * A year on its own, with zero month and day values

8802

# * A year and month value, with a zero day, e.g. a credit card expiration date

8803

#

8804

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

8805

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

8806

# month and day.

8807

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

8808

# a year.

8809

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

8810

# if specifying a year by itself or a year and month where the day is not

8811

# significant.

8812

},

8813

"booleanValue": True or False, # boolean

8814

},

8815

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

8816

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

8817

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

8818

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

8819

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8820

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

8821

# (FPE) with the FFX mode of operation; however when used in the

8822

# `ReidentifyContent` API method, it serves the opposite function by reversing

8823

# the surrogate back into the original identifier. The identifier must be

8824

# encoded as ASCII. For a given crypto key and context, the same identifier

8825

# will be replaced with the same surrogate. Identifiers must be at least two

8826

# characters long. In the case that the identifier is the empty string, it will

8827

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

8828

# more.

8829

#

8830

# Note: We recommend using CryptoDeterministicConfig for all use cases which

8831

# do not require preserving the input alphabet space and size, plus warrant

8832

# referential integrity.

8833

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

8834

# This annotation will be applied to the surrogate by prefixing it with

8835

# the name of the custom infoType followed by the number of

8836

# characters comprising the surrogate. The following scheme defines the

8837

# format: info_type_name(surrogate_character_count):surrogate

8838

#

8839

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

8840

# the surrogate is 'abc', the full replacement value

8841

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

8842

#

8843

# This annotation identifies the surrogate when inspecting content using the

8844

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8845

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8846

# This facilitates reversal of the surrogate when it occurs in free text.

8847

#

8848

# In order for inspection to work properly, the name of this infoType must

8849

# not occur naturally anywhere in your data; otherwise, inspection may

8850

# find a surrogate that does not correspond to an actual identifier.

8851

# Therefore, choose your custom infoType name carefully after considering

8852

# what your data looks like. One way to select a name that has a high chance

8853

# of yielding reliable detection is to include one or more unicode characters

8854

# that are highly improbable to exist in your data.

8855

# For example, assuming your data is entered from a regular ASCII keyboard,

8856

# the symbol with the hex code point 29DD might be used like so:

8857

# ⧝MY_TOKEN_TYPE

8858

"name": "A String", # Name of the information type. Either a name of your choosing when

8859

# creating a CustomInfoType, or one of the names listed

8860

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8861

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

8862

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8863

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8864

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8865

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

8866

# identifier in two different contexts won't be given the same surrogate. If

8867

# the context is not set, a default tweak will be used.

8868

#

8869

# If the context is set but:

8870

#

8871

# 1. there is no record present when transforming a given value or

8872

# 1. the field is not present when transforming a given value,

8873

#

8874

# a default tweak will be used.

8875

#

8876

# Note that case (1) is expected when an `InfoTypeTransformation` is

8877

# applied to both structured and non-structured `ContentItem`s.

8878

# Currently, the referenced field may be of value type integer or string.

8879

#

8880

# The tweak is constructed as a sequence of bytes in big endian byte order

8881

# such that:

8882

#

8883

# - a 64 bit integer is encoded followed by a single byte of value 1

8884

# - a string is encoded in UTF-8 format followed by a single byte of value 2

8885

"name": "A String", # Name describing the field.

8886

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8887

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

8888

# that the FFX mode natively supports. This happens before/after

8889

# encryption/decryption.

8890

# Each character listed must appear only once.

8891

# Number of characters must be in the range [2, 95].

8892

# This must be encoded as ASCII.

8893

# The order of characters does not matter.

8894

# The full list of allowed characters is:

8895

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

8896

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8897

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

8898

# a key encryption key (KEK) stored by KMS).

8899

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8900

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8901

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8902

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8903

# It will be discarded after the request finishes.

8904

"name": "A String", # Required. Name of the key.

8905

# This is an arbitrary string used to differentiate different keys.

8906

# A unique key is generated per name: two separate `TransientCryptoKey`

8907

# protos share the same generated key if their names are the same.

8908

# When the data crypto key is generated, this name is not used in any way

8909

# (repeating the api call will result in a different key being generated).

8910

},

8911

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

8912

# The wrapped key must be a 128/192/256 bit key.

8913

# Authorization requires the following IAM permissions when sending a request

8914

# to perform a crypto transformation using a kms-wrapped crypto key:

8915

# dlp.kms.encrypt

8916

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

8917

"wrappedKey": "A String", # Required. The wrapped data crypto key.

8918

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8919

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

8920

# leaking the key. Choose another type of key if possible.

8921

"key": "A String", # Required. A 128/192/256 bit key.

8922

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8923

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8924

"commonAlphabet": "A String", # Common alphabets.

8925

},

8926

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

8927

# input. Outputs a base64 encoded representation of the encrypted output.

8928

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8929

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

8930

# referential integrity such that the same identifier in two different

8931

# contexts will be given a distinct surrogate. The context is appended to

8932

# plaintext value being encrypted. On decryption the provided context is

8933

# validated against the value used during encryption. If a context was

8934

# provided during encryption, same context must be provided during decryption

8935

# as well.

8936

#

8937

# If the context is not set, plaintext would be used as is for encryption.

8938

# If the context is set but:

8939

#

8940

# 1. there is no record present when transforming a given value or

8941

# 2. the field is not present when transforming a given value,

8942

#

8943

# plaintext would be used as is for encryption.

8944

#

8945

# Note that case (1) is expected when an `InfoTypeTransformation` is

8946

# applied to both structured and non-structured `ContentItem`s.

8947

"name": "A String", # Name describing the field.

8948

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8949

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

8950

# This annotation will be applied to the surrogate by prefixing it with

8951

# the name of the custom info type followed by the number of

8952

# characters comprising the surrogate. The following scheme defines the

8953

# format: {info type name}({surrogate character count}):{surrogate}

8954

#

8955

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

8956

# the surrogate is 'abc', the full replacement value

8957

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

8958

#

8959

# This annotation identifies the surrogate when inspecting content using the

8960

# custom info type 'Surrogate'. This facilitates reversal of the

8961

# surrogate when it occurs in free text.

8962

#

8963

# Note: For record transformations where the entire cell in a table is being

8964

# transformed, surrogates are not mandatory. Surrogates are used to denote

8965

# the location of the token and are necessary for re-identification in free

8966

# form text.

8967

#

8968

# In order for inspection to work properly, the name of this info type must

8969

# not occur naturally anywhere in your data; otherwise, inspection may either

8970

#

8971

# - reverse a surrogate that does not correspond to an actual identifier

8972

# - be unable to parse the surrogate and result in an error

8973

#

8974

# Therefore, choose your custom info type name carefully after considering

8975

# what your data looks like. One way to select a name that has a high chance

8976

# of yielding reliable detection is to include one or more unicode characters

8977

# that are highly improbable to exist in your data.

8978

# For example, assuming your data is entered from a regular ASCII keyboard,

8979

# the symbol with the hex code point 29DD might be used like so:

8980

# ⧝MY_TOKEN_TYPE.

8981

"name": "A String", # Name of the information type. Either a name of your choosing when

8982

# creating a CustomInfoType, or one of the names listed

8983

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

8984

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

8985

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8986

},

8987

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

8988

# a key encryption key (KEK) stored by KMS).

8989

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

8990

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

8991

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

8992

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

8993

# It will be discarded after the request finishes.

8994

"name": "A String", # Required. Name of the key.

8995

# This is an arbitrary string used to differentiate different keys.

8996

# A unique key is generated per name: two separate `TransientCryptoKey`

8997

# protos share the same generated key if their names are the same.

8998

# When the data crypto key is generated, this name is not used in any way

8999

# (repeating the api call will result in a different key being generated).

9000

},

9001

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9002

# The wrapped key must be a 128/192/256 bit key.

9003

# Authorization requires the following IAM permissions when sending a request

9004

# to perform a crypto transformation using a kms-wrapped crypto key:

9005

# dlp.kms.encrypt

9006

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9007

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9008

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9009

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9010

# leaking the key. Choose another type of key if possible.

9011

"key": "A String", # Required. A 128/192/256 bit key.

9012

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9013

},

9014

},

9015

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

9016

# replacement values are dynamically provided by the user for custom behavior,

9017

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

9018

# This can be used on

9019

# data of type: number, long, string, timestamp.

9020

# If the bound `Value` type differs from the type of data being transformed, we

9021

# will first attempt converting the type of the data to be transformed to match

9022

# the type of the bound before comparing.

9023

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

9024

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

9025

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9026

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9027

# Note that for the purposes of inspection or transformation, the number

9028

# of bytes considered to comprise a 'Value' is based on its representation

9029

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9030

# 123456789, the number of bytes would be counted as 9, even though an

9031

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9032

"integerValue": "A String", # integer

9033

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9034

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9035

# types are google.type.Date and `google.protobuf.Timestamp`.

9036

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9037

# allow the value 60 if it allows leap-seconds.

9038

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9039

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9040

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9041

# to allow the value "24:00:00" for scenarios like business closing time.

9042

},

9043

"dayOfWeekValue": "A String", # day of week

9044

"floatValue": 3.14, # float

9045

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9046

"timestampValue": "A String", # timestamp

9047

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9048

# and time zone are either specified elsewhere or are not significant. The date

9049

# is relative to the Proleptic Gregorian Calendar. This can represent:

9050

#

9051

# * A full date, with non-zero year, month and day values

9052

# * A month and day value, with a zero year, e.g. an anniversary

9053

# * A year on its own, with zero month and day values

9054

# * A year and month value, with a zero day, e.g. a credit card expiration date

9055

#

9056

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9057

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9058

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9059

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9060

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9061

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9062

# if specifying a year by itself or a year and month where the day is not

9063

# significant.

9064

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9065

"booleanValue": True or False, # boolean

9066

},

9067

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

9068

# Note that for the purposes of inspection or transformation, the number

9069

# of bytes considered to comprise a 'Value' is based on its representation

9070

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9071

# 123456789, the number of bytes would be counted as 9, even though an

9072

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9073

"integerValue": "A String", # integer

9074

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9075

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9076

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9077

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9078

# allow the value 60 if it allows leap-seconds.

9079

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9080

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9081

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9082

# to allow the value "24:00:00" for scenarios like business closing time.

9083

},

9084

"dayOfWeekValue": "A String", # day of week

9085

"floatValue": 3.14, # float

9086

"stringValue": "A String", # string

9087

"timestampValue": "A String", # timestamp

9088

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9089

# and time zone are either specified elsewhere or are not significant. The date

9090

# is relative to the Proleptic Gregorian Calendar. This can represent:

9091

#

9092

# * A full date, with non-zero year, month and day values

9093

# * A month and day value, with a zero year, e.g. an anniversary

9094

# * A year on its own, with zero month and day values

9095

# * A year and month value, with a zero day, e.g. a credit card expiration date

9096

#

9097

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9098

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9099

# month and day.

9100

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9101

# a year.

9102

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9103

# if specifying a year by itself or a year and month where the day is not

9104

# significant.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9105

},

9106

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9107

},

9108

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

9109

# used.

9110

# Note that for the purposes of inspection or transformation, the number

9111

# of bytes considered to comprise a 'Value' is based on its representation

9112

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9113

# 123456789, the number of bytes would be counted as 9, even though an

9114

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9115

"integerValue": "A String", # integer

9116

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9117

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9118

# types are google.type.Date and `google.protobuf.Timestamp`.

9119

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9120

# allow the value 60 if it allows leap-seconds.

9121

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9122

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9123

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9124

# to allow the value "24:00:00" for scenarios like business closing time.

9125

},

9126

"dayOfWeekValue": "A String", # day of week

9127

"floatValue": 3.14, # float

9128

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9129

"timestampValue": "A String", # timestamp

9130

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9131

# and time zone are either specified elsewhere or are not significant. The date

9132

# is relative to the Proleptic Gregorian Calendar. This can represent:

9133

#

9134

# * A full date, with non-zero year, month and day values

9135

# * A month and day value, with a zero year, e.g. an anniversary

9136

# * A year on its own, with zero month and day values

9137

# * A year and month value, with a zero day, e.g. a credit card expiration date

9138

#

9139

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9140

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9141

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9142

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9143

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9144

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9145

# if specifying a year by itself or a year and month where the day is not

9146

# significant.

9147

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9148

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9153

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9154

},

9155

],

9156

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9157

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default

9158

# mode is `TransformationErrorHandling.ThrowError`.

9159

# transformation error occurs when the requested transformation is incompatible

9160

# with the data. For example, trying to de-identify an IP address using a

9161

# `DateShift` transformation would result in a transformation error, since date

9162

# info cannot be extracted from an IP address.

9163

# Information about any incompatible transformations, and how they were

9164

# handled, is returned in the response as part of the

9165

# `TransformationOverviews`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9166

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would # Ignore errors

9167

# cause an error. For example, if a `DateShift` transformation were applied

9168

# an an IP address, this mode would leave the IP address unchanged in the

9169

# response.

9170

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9171

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

9172

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9173

},

9174

"recordTransformations": { # A type of transformation that is applied over structured data such as a # Treat the dataset as structured. Transformations can be applied to

9175

# specific locations within structured datasets, such as transforming

9176

# a column within a table.

9177

# table.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9178

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that

9179

# match any suppression rule are omitted from the output.

9180

{ # Configuration to suppress records whose suppression conditions evaluate to

9181

# true.

9182

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

9183

# evaluated to be suppressed from the transformed content.

9184

# a field.

9185

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

9186

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

9187

"conditions": [ # A collection of conditions.

9188

{ # The field type of `value` and `field` do not need to match to be

9189

# considered equal, but not all comparisons are possible.

9190

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

9191

# but all other comparisons are invalid with incompatible types.

9192

# A `value` of type:

9193

#

9194

# - `string` can be compared against all other types

9195

# - `boolean` can only be compared against other booleans

9196

# - `integer` can be compared against doubles or a string if the string value

9197

# can be parsed as an integer.

9198

# - `double` can be compared against integers or a string if the string can

9199

# be parsed as a double.

9200

# - `Timestamp` can be compared against strings in RFC 3339 date string

9201

# format.

9202

# - `TimeOfDay` can be compared against timestamps and strings in the format

9203

# of 'HH:mm:ss'.

9204

#

9205

# If we fail to compare do to type mismatch, a warning will be given and

9206

# the condition will evaluate to false.

9207

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

9208

"name": "A String", # Name describing the field.

9209

},

9210

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

9211

# Note that for the purposes of inspection or transformation, the number

9212

# of bytes considered to comprise a 'Value' is based on its representation

9213

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9214

# 123456789, the number of bytes would be counted as 9, even though an

9215

# int64 only holds up to 8 bytes of data.

9216

"integerValue": "A String", # integer

9217

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9218

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9219

# types are google.type.Date and `google.protobuf.Timestamp`.

9220

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9221

# allow the value 60 if it allows leap-seconds.

9222

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9223

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9224

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9225

# to allow the value "24:00:00" for scenarios like business closing time.

9226

},

9227

"dayOfWeekValue": "A String", # day of week

9228

"floatValue": 3.14, # float

9229

"stringValue": "A String", # string

9230

"timestampValue": "A String", # timestamp

9231

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9232

# and time zone are either specified elsewhere or are not significant. The date

9233

# is relative to the Proleptic Gregorian Calendar. This can represent:

9234

#

9235

# * A full date, with non-zero year, month and day values

9236

# * A month and day value, with a zero year, e.g. an anniversary

9237

# * A year on its own, with zero month and day values

9238

# * A year and month value, with a zero day, e.g. a credit card expiration date

9239

#

9240

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9241

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9242

# month and day.

9243

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9244

# a year.

9245

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9246

# if specifying a year by itself or a year and month where the day is not

9247

# significant.

9248

},

9249

"booleanValue": True or False, # boolean

9250

},

9251

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

},

],

},

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

9256

# only supported value is `AND`.

},

},

},

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9261

"fieldTransformations": [ # Transform the record by applying various field transformations.

9262

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9263

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

9264

# transform content that matches an `InfoType`.

9265

# apply various `PrimitiveTransformation`s to each finding, where the

9266

# transformation is applied to only values that were identified as a specific

9267

# info_type.

9268

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

9269

# for a given infoType.

9270

{ # A transformation to apply to text that is identified as a specific

9271

# info_type.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9272

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

9273

# this transformation to apply to all findings that correspond to

9274

# infoTypes that were requested in `InspectConfig`.

9275

{ # Type of information detected by the API.

9276

"name": "A String", # Name of the information type. Either a name of your choosing when

9277

# creating a CustomInfoType, or one of the names listed

9278

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

9279

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

9280

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9281

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9282

],

9283

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9284

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

9285

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

9286

# to learn more.

9287

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

9288

# If set, must also set cryptoKey. If set, shift will be consistent for the

9289

# given context.

9290

"name": "A String", # Name describing the field.

9291

},

9292

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

9293

# range (inclusive ends). Negative means shift to earlier in time. Must not

9294

# be more than 365250 days (1000 years) each direction.

9295

#

9296

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9297

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

9298

# results in the same shift for the same context and crypto_key. If

9299

# set, must also set context. Can only be applied to table items.

9300

# a key encryption key (KEK) stored by KMS).

9301

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9302

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9303

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9304

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9305

# It will be discarded after the request finishes.

9306

"name": "A String", # Required. Name of the key.

9307

# This is an arbitrary string used to differentiate different keys.

9308

# A unique key is generated per name: two separate `TransientCryptoKey`

9309

# protos share the same generated key if their names are the same.

9310

# When the data crypto key is generated, this name is not used in any way

9311

# (repeating the api call will result in a different key being generated).

9312

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9313

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9314

# The wrapped key must be a 128/192/256 bit key.

9315

# Authorization requires the following IAM permissions when sending a request

9316

# to perform a crypto transformation using a kms-wrapped crypto key:

9317

# dlp.kms.encrypt

9318

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9319

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9320

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9321

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9322

# leaking the key. Choose another type of key if possible.

9323

"key": "A String", # Required. A 128/192/256 bit key.

9324

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9325

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9326

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

9327

},

9328

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

9329

# portion of the value.

9330

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9331

},

9332

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

9333

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9334

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

9335

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

9336

# Note that for the purposes of inspection or transformation, the number

9337

# of bytes considered to comprise a 'Value' is based on its representation

9338

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9339

# 123456789, the number of bytes would be counted as 9, even though an

9340

# int64 only holds up to 8 bytes of data.

9341

"integerValue": "A String", # integer

9342

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9343

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9344

# types are google.type.Date and `google.protobuf.Timestamp`.

9345

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9346

# allow the value 60 if it allows leap-seconds.

9347

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9348

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9349

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9350

# to allow the value "24:00:00" for scenarios like business closing time.

9351

},

9352

"dayOfWeekValue": "A String", # day of week

9353

"floatValue": 3.14, # float

9354

"stringValue": "A String", # string

9355

"timestampValue": "A String", # timestamp

9356

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9357

# and time zone are either specified elsewhere or are not significant. The date

9358

# is relative to the Proleptic Gregorian Calendar. This can represent:

9359

#

9360

# * A full date, with non-zero year, month and day values

9361

# * A month and day value, with a zero year, e.g. an anniversary

9362

# * A year on its own, with zero month and day values

9363

# * A year and month value, with a zero day, e.g. a credit card expiration date

9364

#

9365

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9366

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9367

# month and day.

9368

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9369

# a year.

9370

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9371

# if specifying a year by itself or a year and month where the day is not

9372

# significant.

9373

},

9374

"booleanValue": True or False, # boolean

9375

},

9376

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9377

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

9378

# Uses SHA-256.

9379

# The key size must be either 32 or 64 bytes.

9380

# Outputs a base64 encoded representation of the hashed output

9381

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

9382

# Currently, only string and integer values can be hashed.

9383

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

9384

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

9385

# a key encryption key (KEK) stored by KMS).

9386

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9387

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9388

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9389

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9390

# It will be discarded after the request finishes.

9391

"name": "A String", # Required. Name of the key.

9392

# This is an arbitrary string used to differentiate different keys.

9393

# A unique key is generated per name: two separate `TransientCryptoKey`

9394

# protos share the same generated key if their names are the same.

9395

# When the data crypto key is generated, this name is not used in any way

9396

# (repeating the api call will result in a different key being generated).

9397

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9398

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9399

# The wrapped key must be a 128/192/256 bit key.

9400

# Authorization requires the following IAM permissions when sending a request

9401

# to perform a crypto transformation using a kms-wrapped crypto key:

9402

# dlp.kms.encrypt

9403

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9404

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9405

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9406

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9407

# leaking the key. Choose another type of key if possible.

9408

"key": "A String", # Required. A 128/192/256 bit key.

9409

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9410

},

9411

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9412

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

9413

# fixed character. Masking can start from the beginning or end of the string.

9414

# This can be used on data of any type (numbers, longs, and so on) and when

9415

# de-identifying structured data we'll attempt to preserve the original data's

9416

# type. (This allows you to take a long like 123 and modify it to a string like

9417

# **3.

9418

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

9419

# characters. For example, if the input string is `555-555-5555` and you

9420

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

9421

# returns `***-**5-5555`.

9422

{ # Characters to skip when doing deidentification of a value. These will be left

9423

# alone and skipped.

9424

"charactersToSkip": "A String", # Characters to not transform when masking.

9425

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

9430

# masked. Skipped characters do not count towards this tally.

9431

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

9432

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

9433

# code or credit card number. This string must have a length of 1. If not

9434

# supplied, this value defaults to `*` for strings, and `0` for digits.

9435

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

9436

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

9437

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

9438

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

9439

# is `true`, then the string `12345` is masked as `12***`.

9440

},

9441

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

9442

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

9443

# output would be 'My phone number is '.

9444

},

9445

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

9446

# Bucketing transformation can provide all of this functionality,

9447

# but requires more configuration. This message is provided as a convenience to

9448

# the user for simple bucketing strategies.

9449

#

9450

# The transformed value will be a hyphenated string of

9451

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

9452

# all values that are within this bucket will be replaced with "10-20".

9453

#

9454

# This can be used on data of type: double, long.

9455

#

9456

# If the bound Value type differs from the type of data

9457

# being transformed, we will first attempt converting the type of the data to

9458

# be transformed to match the type of the bound before comparing.

9459

#

9460

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

9461

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

9462

# grouped together into a single bucket; for example if `upper_bound` = 89,

9463

# then all values greater than 89 are replaced with the value "89+".

9464

# Note that for the purposes of inspection or transformation, the number

9465

# of bytes considered to comprise a 'Value' is based on its representation

9466

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9467

# 123456789, the number of bytes would be counted as 9, even though an

9468

# int64 only holds up to 8 bytes of data.

9469

"integerValue": "A String", # integer

9470

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9471

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9472

# types are google.type.Date and `google.protobuf.Timestamp`.

9473

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9474

# allow the value 60 if it allows leap-seconds.

9475

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9476

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9477

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9478

# to allow the value "24:00:00" for scenarios like business closing time.

9479

},

9480

"dayOfWeekValue": "A String", # day of week

9481

"floatValue": 3.14, # float

9482

"stringValue": "A String", # string

9483

"timestampValue": "A String", # timestamp

9484

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9485

# and time zone are either specified elsewhere or are not significant. The date

9486

# is relative to the Proleptic Gregorian Calendar. This can represent:

9487

#

9488

# * A full date, with non-zero year, month and day values

9489

# * A month and day value, with a zero year, e.g. an anniversary

9490

# * A year on its own, with zero month and day values

9491

# * A year and month value, with a zero day, e.g. a credit card expiration date

9492

#

9493

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9494

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9495

# month and day.

9496

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9497

# a year.

9498

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9499

# if specifying a year by itself or a year and month where the day is not

9500

# significant.

9501

},

9502

"booleanValue": True or False, # boolean

9503

},

9504

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

9505

# grouped together into a single bucket; for example if `lower_bound` = 10,

9506

# then all values less than 10 are replaced with the value "-10".

9507

# Note that for the purposes of inspection or transformation, the number

9508

# of bytes considered to comprise a 'Value' is based on its representation

9509

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9510

# 123456789, the number of bytes would be counted as 9, even though an

9511

# int64 only holds up to 8 bytes of data.

9512

"integerValue": "A String", # integer

9513

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9514

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9515

# types are google.type.Date and `google.protobuf.Timestamp`.

9516

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9517

# allow the value 60 if it allows leap-seconds.

9518

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9519

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9520

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9521

# to allow the value "24:00:00" for scenarios like business closing time.

9522

},

9523

"dayOfWeekValue": "A String", # day of week

9524

"floatValue": 3.14, # float

9525

"stringValue": "A String", # string

9526

"timestampValue": "A String", # timestamp

9527

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9528

# and time zone are either specified elsewhere or are not significant. The date

9529

# is relative to the Proleptic Gregorian Calendar. This can represent:

9530

#

9531

# * A full date, with non-zero year, month and day values

9532

# * A month and day value, with a zero year, e.g. an anniversary

9533

# * A year on its own, with zero month and day values

9534

# * A year and month value, with a zero day, e.g. a credit card expiration date

9535

#

9536

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9537

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9538

# month and day.

9539

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9540

# a year.

9541

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9542

# if specifying a year by itself or a year and month where the day is not

9543

# significant.

9544

},

9545

"booleanValue": True or False, # boolean

9546

},

9547

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

9548

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

9549

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

9550

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

9551

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9552

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

9553

# (FPE) with the FFX mode of operation; however when used in the

9554

# `ReidentifyContent` API method, it serves the opposite function by reversing

9555

# the surrogate back into the original identifier. The identifier must be

9556

# encoded as ASCII. For a given crypto key and context, the same identifier

9557

# will be replaced with the same surrogate. Identifiers must be at least two

9558

# characters long. In the case that the identifier is the empty string, it will

9559

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

9560

# more.

9561

#

9562

# Note: We recommend using CryptoDeterministicConfig for all use cases which

9563

# do not require preserving the input alphabet space and size, plus warrant

9564

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9565

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

9566

# This annotation will be applied to the surrogate by prefixing it with

9567

# the name of the custom infoType followed by the number of

9568

# characters comprising the surrogate. The following scheme defines the

9569

# format: info_type_name(surrogate_character_count):surrogate

9570

#

9571

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

9572

# the surrogate is 'abc', the full replacement value

9573

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

9574

#

9575

# This annotation identifies the surrogate when inspecting content using the

9576

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9577

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9578

# This facilitates reversal of the surrogate when it occurs in free text.

9579

#

9580

# In order for inspection to work properly, the name of this infoType must

9581

# not occur naturally anywhere in your data; otherwise, inspection may

9582

# find a surrogate that does not correspond to an actual identifier.

9583

# Therefore, choose your custom infoType name carefully after considering

9584

# what your data looks like. One way to select a name that has a high chance

9585

# of yielding reliable detection is to include one or more unicode characters

9586

# that are highly improbable to exist in your data.

9587

# For example, assuming your data is entered from a regular ASCII keyboard,

9588

# the symbol with the hex code point 29DD might be used like so:

9589

# ⧝MY_TOKEN_TYPE

9590

"name": "A String", # Name of the information type. Either a name of your choosing when

9591

# creating a CustomInfoType, or one of the names listed

9592

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9593

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

9594

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9595

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9596

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9597

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

9598

# identifier in two different contexts won't be given the same surrogate. If

9599

# the context is not set, a default tweak will be used.

9600

#

9601

# If the context is set but:

9602

#

9603

# 1. there is no record present when transforming a given value or

9604

# 1. the field is not present when transforming a given value,

9605

#

9606

# a default tweak will be used.

9607

#

9608

# Note that case (1) is expected when an `InfoTypeTransformation` is

9609

# applied to both structured and non-structured `ContentItem`s.

9610

# Currently, the referenced field may be of value type integer or string.

9611

#

9612

# The tweak is constructed as a sequence of bytes in big endian byte order

9613

# such that:

9614

#

9615

# - a 64 bit integer is encoded followed by a single byte of value 1

9616

# - a string is encoded in UTF-8 format followed by a single byte of value 2

9617

"name": "A String", # Name describing the field.

9618

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9619

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

9620

# that the FFX mode natively supports. This happens before/after

9621

# encryption/decryption.

9622

# Each character listed must appear only once.

9623

# Number of characters must be in the range [2, 95].

9624

# This must be encoded as ASCII.

9625

# The order of characters does not matter.

9626

# The full list of allowed characters is:

9627

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

9628

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9629

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

9630

# a key encryption key (KEK) stored by KMS).

9631

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9632

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9633

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9634

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9635

# It will be discarded after the request finishes.

9636

"name": "A String", # Required. Name of the key.

9637

# This is an arbitrary string used to differentiate different keys.

9638

# A unique key is generated per name: two separate `TransientCryptoKey`

9639

# protos share the same generated key if their names are the same.

9640

# When the data crypto key is generated, this name is not used in any way

9641

# (repeating the api call will result in a different key being generated).

9642

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9643

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9644

# The wrapped key must be a 128/192/256 bit key.

9645

# Authorization requires the following IAM permissions when sending a request

9646

# to perform a crypto transformation using a kms-wrapped crypto key:

9647

# dlp.kms.encrypt

9648

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9649

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9650

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9651

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9652

# leaking the key. Choose another type of key if possible.

9653

"key": "A String", # Required. A 128/192/256 bit key.

9654

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9655

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9656

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9657

},

9658

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

9659

# input. Outputs a base64 encoded representation of the encrypted output.

9660

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9661

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

9662

# referential integrity such that the same identifier in two different

9663

# contexts will be given a distinct surrogate. The context is appended to

9664

# plaintext value being encrypted. On decryption the provided context is

9665

# validated against the value used during encryption. If a context was

9666

# provided during encryption, same context must be provided during decryption

9667

# as well.

9668

#

9669

# If the context is not set, plaintext would be used as is for encryption.

9670

# If the context is set but:

9671

#

9672

# 1. there is no record present when transforming a given value or

9673

# 2. the field is not present when transforming a given value,

9674

#

9675

# plaintext would be used as is for encryption.

9676

#

9677

# Note that case (1) is expected when an `InfoTypeTransformation` is

9678

# applied to both structured and non-structured `ContentItem`s.

9679

"name": "A String", # Name describing the field.

9680

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9681

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

9682

# This annotation will be applied to the surrogate by prefixing it with

9683

# the name of the custom info type followed by the number of

9684

# characters comprising the surrogate. The following scheme defines the

9685

# format: {info type name}({surrogate character count}):{surrogate}

9686

#

9687

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

9688

# the surrogate is 'abc', the full replacement value

9689

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

9690

#

9691

# This annotation identifies the surrogate when inspecting content using the

9692

# custom info type 'Surrogate'. This facilitates reversal of the

9693

# surrogate when it occurs in free text.

9694

#

9695

# Note: For record transformations where the entire cell in a table is being

9696

# transformed, surrogates are not mandatory. Surrogates are used to denote

9697

# the location of the token and are necessary for re-identification in free

9698

# form text.

9699

#

9700

# In order for inspection to work properly, the name of this info type must

9701

# not occur naturally anywhere in your data; otherwise, inspection may either

9702

#

9703

# - reverse a surrogate that does not correspond to an actual identifier

9704

# - be unable to parse the surrogate and result in an error

9705

#

9706

# Therefore, choose your custom info type name carefully after considering

9707

# what your data looks like. One way to select a name that has a high chance

9708

# of yielding reliable detection is to include one or more unicode characters

9709

# that are highly improbable to exist in your data.

9710

# For example, assuming your data is entered from a regular ASCII keyboard,

9711

# the symbol with the hex code point 29DD might be used like so:

9712

# ⧝MY_TOKEN_TYPE.

9713

"name": "A String", # Name of the information type. Either a name of your choosing when

9714

# creating a CustomInfoType, or one of the names listed

9715

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9716

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

9717

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9718

},

9719

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

9720

# a key encryption key (KEK) stored by KMS).

9721

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9722

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9723

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9724

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9725

# It will be discarded after the request finishes.

9726

"name": "A String", # Required. Name of the key.

9727

# This is an arbitrary string used to differentiate different keys.

9728

# A unique key is generated per name: two separate `TransientCryptoKey`

9729

# protos share the same generated key if their names are the same.

9730

# When the data crypto key is generated, this name is not used in any way

9731

# (repeating the api call will result in a different key being generated).

9732

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9733

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9734

# The wrapped key must be a 128/192/256 bit key.

9735

# Authorization requires the following IAM permissions when sending a request

9736

# to perform a crypto transformation using a kms-wrapped crypto key:

9737

# dlp.kms.encrypt

9738

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9739

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9740

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9741

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9742

# leaking the key. Choose another type of key if possible.

9743

"key": "A String", # Required. A 128/192/256 bit key.

9744

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9745

},

9746

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9747

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

9748

# replacement values are dynamically provided by the user for custom behavior,

9749

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

9750

# This can be used on

9751

# data of type: number, long, string, timestamp.

9752

# If the bound `Value` type differs from the type of data being transformed, we

9753

# will first attempt converting the type of the data to be transformed to match

9754

# the type of the bound before comparing.

9755

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

9756

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

9757

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9758

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9759

# Note that for the purposes of inspection or transformation, the number

9760

# of bytes considered to comprise a 'Value' is based on its representation

9761

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9762

# 123456789, the number of bytes would be counted as 9, even though an

9763

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9764

"integerValue": "A String", # integer

9765

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9766

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9767

# types are google.type.Date and `google.protobuf.Timestamp`.

9768

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9769

# allow the value 60 if it allows leap-seconds.

9770

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9771

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9772

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9773

# to allow the value "24:00:00" for scenarios like business closing time.

9774

},

9775

"dayOfWeekValue": "A String", # day of week

9776

"floatValue": 3.14, # float

9777

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9778

"timestampValue": "A String", # timestamp

9779

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9780

# and time zone are either specified elsewhere or are not significant. The date

9781

# is relative to the Proleptic Gregorian Calendar. This can represent:

9782

#

9783

# * A full date, with non-zero year, month and day values

9784

# * A month and day value, with a zero year, e.g. an anniversary

9785

# * A year on its own, with zero month and day values

9786

# * A year and month value, with a zero day, e.g. a credit card expiration date

9787

#

9788

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9789

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9790

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9791

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9792

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9793

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9794

# if specifying a year by itself or a year and month where the day is not

9795

# significant.

9796

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9797

"booleanValue": True or False, # boolean

9798

},

9799

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

9800

# Note that for the purposes of inspection or transformation, the number

9801

# of bytes considered to comprise a 'Value' is based on its representation

9802

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9803

# 123456789, the number of bytes would be counted as 9, even though an

9804

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9805

"integerValue": "A String", # integer

9806

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9807

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9808

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9809

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9810

# allow the value 60 if it allows leap-seconds.

9811

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9812

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9813

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9814

# to allow the value "24:00:00" for scenarios like business closing time.

9815

},

9816

"dayOfWeekValue": "A String", # day of week

9817

"floatValue": 3.14, # float

9818

"stringValue": "A String", # string

9819

"timestampValue": "A String", # timestamp

9820

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9821

# and time zone are either specified elsewhere or are not significant. The date

9822

# is relative to the Proleptic Gregorian Calendar. This can represent:

9823

#

9824

# * A full date, with non-zero year, month and day values

9825

# * A month and day value, with a zero year, e.g. an anniversary

9826

# * A year on its own, with zero month and day values

9827

# * A year and month value, with a zero day, e.g. a credit card expiration date

9828

#

9829

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9830

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9831

# month and day.

9832

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9833

# a year.

9834

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9835

# if specifying a year by itself or a year and month where the day is not

9836

# significant.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9837

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9838

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9839

},

9840

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

9841

# used.

9842

# Note that for the purposes of inspection or transformation, the number

9843

# of bytes considered to comprise a 'Value' is based on its representation

9844

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9845

# 123456789, the number of bytes would be counted as 9, even though an

9846

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9847

"integerValue": "A String", # integer

9848

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9849

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9850

# types are google.type.Date and `google.protobuf.Timestamp`.

9851

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9852

# allow the value 60 if it allows leap-seconds.

9853

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9854

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9855

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9856

# to allow the value "24:00:00" for scenarios like business closing time.

9857

},

9858

"dayOfWeekValue": "A String", # day of week

9859

"floatValue": 3.14, # float

9860

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9861

"timestampValue": "A String", # timestamp

9862

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9863

# and time zone are either specified elsewhere or are not significant. The date

9864

# is relative to the Proleptic Gregorian Calendar. This can represent:

9865

#

9866

# * A full date, with non-zero year, month and day values

9867

# * A month and day value, with a zero year, e.g. an anniversary

9868

# * A year on its own, with zero month and day values

9869

# * A year and month value, with a zero day, e.g. a credit card expiration date

9870

#

9871

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9872

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9873

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9874

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9875

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9876

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9877

# if specifying a year by itself or a year and month where the day is not

9878

# significant.

9879

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9880

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9890

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

9891

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

9892

# to learn more.

9893

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

9894

# If set, must also set cryptoKey. If set, shift will be consistent for the

9895

# given context.

9896

"name": "A String", # Name describing the field.

9897

},

9898

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

9899

# range (inclusive ends). Negative means shift to earlier in time. Must not

9900

# be more than 365250 days (1000 years) each direction.

9901

#

9902

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9903

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

9904

# results in the same shift for the same context and crypto_key. If

9905

# set, must also set context. Can only be applied to table items.

9906

# a key encryption key (KEK) stored by KMS).

9907

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9908

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9909

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9910

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9911

# It will be discarded after the request finishes.

9912

"name": "A String", # Required. Name of the key.

9913

# This is an arbitrary string used to differentiate different keys.

9914

# A unique key is generated per name: two separate `TransientCryptoKey`

9915

# protos share the same generated key if their names are the same.

9916

# When the data crypto key is generated, this name is not used in any way

9917

# (repeating the api call will result in a different key being generated).

9918

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

9919

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

9920

# The wrapped key must be a 128/192/256 bit key.

9921

# Authorization requires the following IAM permissions when sending a request

9922

# to perform a crypto transformation using a kms-wrapped crypto key:

9923

# dlp.kms.encrypt

9924

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

9925

"wrappedKey": "A String", # Required. The wrapped data crypto key.

9926

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9927

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

9928

# leaking the key. Choose another type of key if possible.

9929

"key": "A String", # Required. A 128/192/256 bit key.

9930

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9931

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9932

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

9933

},

9934

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

9935

# portion of the value.

9936

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9937

},

9938

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

9939

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

9940

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

9941

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

9942

# Note that for the purposes of inspection or transformation, the number

9943

# of bytes considered to comprise a 'Value' is based on its representation

9944

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

9945

# 123456789, the number of bytes would be counted as 9, even though an

9946

# int64 only holds up to 8 bytes of data.

9947

"integerValue": "A String", # integer

9948

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

9949

# or are specified elsewhere. An API may choose to allow leap seconds. Related

9950

# types are google.type.Date and `google.protobuf.Timestamp`.

9951

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

9952

# allow the value 60 if it allows leap-seconds.

9953

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

9954

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

9955

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

9956

# to allow the value "24:00:00" for scenarios like business closing time.

9957

},

9958

"dayOfWeekValue": "A String", # day of week

9959

"floatValue": 3.14, # float

9960

"stringValue": "A String", # string

9961

"timestampValue": "A String", # timestamp

9962

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

9963

# and time zone are either specified elsewhere or are not significant. The date

9964

# is relative to the Proleptic Gregorian Calendar. This can represent:

9965

#

9966

# * A full date, with non-zero year, month and day values

9967

# * A month and day value, with a zero year, e.g. an anniversary

9968

# * A year on its own, with zero month and day values

9969

# * A year and month value, with a zero day, e.g. a credit card expiration date

9970

#

9971

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

9972

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

9973

# month and day.

9974

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

9975

# a year.

9976

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

9977

# if specifying a year by itself or a year and month where the day is not

9978

# significant.

9979

},

9980

"booleanValue": True or False, # boolean

9981

},

9982

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9983

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

9984

# Uses SHA-256.

9985

# The key size must be either 32 or 64 bytes.

9986

# Outputs a base64 encoded representation of the hashed output

9987

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

9988

# Currently, only string and integer values can be hashed.

9989

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

9990

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

9991

# a key encryption key (KEK) stored by KMS).

9992

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

9993

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

9994

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

9995

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

9996

# It will be discarded after the request finishes.

9997

"name": "A String", # Required. Name of the key.

9998

# This is an arbitrary string used to differentiate different keys.

9999

# A unique key is generated per name: two separate `TransientCryptoKey`

10000

# protos share the same generated key if their names are the same.

10001

# When the data crypto key is generated, this name is not used in any way

10002

# (repeating the api call will result in a different key being generated).

10003

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10004

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

10005

# The wrapped key must be a 128/192/256 bit key.

10006

# Authorization requires the following IAM permissions when sending a request

10007

# to perform a crypto transformation using a kms-wrapped crypto key:

10008

# dlp.kms.encrypt

10009

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

10010

"wrappedKey": "A String", # Required. The wrapped data crypto key.

10011

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10012

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

10013

# leaking the key. Choose another type of key if possible.

10014

"key": "A String", # Required. A 128/192/256 bit key.

10015

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10016

},

10017

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10018

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

10019

# fixed character. Masking can start from the beginning or end of the string.

10020

# This can be used on data of any type (numbers, longs, and so on) and when

10021

# de-identifying structured data we'll attempt to preserve the original data's

10022

# type. (This allows you to take a long like 123 and modify it to a string like

10023

# **3.

10024

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

10025

# characters. For example, if the input string is `555-555-5555` and you

10026

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

10027

# returns `***-**5-5555`.

10028

{ # Characters to skip when doing deidentification of a value. These will be left

10029

# alone and skipped.

10030

"charactersToSkip": "A String", # Characters to not transform when masking.

10031

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

10036

# masked. Skipped characters do not count towards this tally.

10037

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

10038

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

10039

# code or credit card number. This string must have a length of 1. If not

10040

# supplied, this value defaults to `*` for strings, and `0` for digits.

10041

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

10042

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

10043

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

10044

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

10045

# is `true`, then the string `12345` is masked as `12***`.

10046

},

10047

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

10048

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

10049

# output would be 'My phone number is '.

10050

},

10051

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

10052

# Bucketing transformation can provide all of this functionality,

10053

# but requires more configuration. This message is provided as a convenience to

10054

# the user for simple bucketing strategies.

10055

#

10056

# The transformed value will be a hyphenated string of

10057

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

10058

# all values that are within this bucket will be replaced with "10-20".

10059

#

10060

# This can be used on data of type: double, long.

10061

#

10062

# If the bound Value type differs from the type of data

10063

# being transformed, we will first attempt converting the type of the data to

10064

# be transformed to match the type of the bound before comparing.

10065

#

10066

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

10067

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

10068

# grouped together into a single bucket; for example if `upper_bound` = 89,

10069

# then all values greater than 89 are replaced with the value "89+".

10070

# Note that for the purposes of inspection or transformation, the number

10071

# of bytes considered to comprise a 'Value' is based on its representation

10072

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

10073

# 123456789, the number of bytes would be counted as 9, even though an

10074

# int64 only holds up to 8 bytes of data.

10075

"integerValue": "A String", # integer

10076

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

10077

# or are specified elsewhere. An API may choose to allow leap seconds. Related

10078

# types are google.type.Date and `google.protobuf.Timestamp`.

10079

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

10080

# allow the value 60 if it allows leap-seconds.

10081

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

10082

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

10083

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

10084

# to allow the value "24:00:00" for scenarios like business closing time.

10085

},

10086

"dayOfWeekValue": "A String", # day of week

10087

"floatValue": 3.14, # float

10088

"stringValue": "A String", # string

10089

"timestampValue": "A String", # timestamp

10090

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

10091

# and time zone are either specified elsewhere or are not significant. The date

10092

# is relative to the Proleptic Gregorian Calendar. This can represent:

10093

#

10094

# * A full date, with non-zero year, month and day values

10095

# * A month and day value, with a zero year, e.g. an anniversary

10096

# * A year on its own, with zero month and day values

10097

# * A year and month value, with a zero day, e.g. a credit card expiration date

10098

#

10099

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

10100

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

10101

# month and day.

10102

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

10103

# a year.

10104

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

10105

# if specifying a year by itself or a year and month where the day is not

10106

# significant.

10107

},

10108

"booleanValue": True or False, # boolean

10109

},

10110

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

10111

# grouped together into a single bucket; for example if `lower_bound` = 10,

10112

# then all values less than 10 are replaced with the value "-10".

10113

# Note that for the purposes of inspection or transformation, the number

10114

# of bytes considered to comprise a 'Value' is based on its representation

10115

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

10116

# 123456789, the number of bytes would be counted as 9, even though an

10117

# int64 only holds up to 8 bytes of data.

10118

"integerValue": "A String", # integer

10119

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

10120

# or are specified elsewhere. An API may choose to allow leap seconds. Related

10121

# types are google.type.Date and `google.protobuf.Timestamp`.

10122

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

10123

# allow the value 60 if it allows leap-seconds.

10124

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

10125

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

10126

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

10127

# to allow the value "24:00:00" for scenarios like business closing time.

10128

},

10129

"dayOfWeekValue": "A String", # day of week

10130

"floatValue": 3.14, # float

10131

"stringValue": "A String", # string

10132

"timestampValue": "A String", # timestamp

10133

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

10134

# and time zone are either specified elsewhere or are not significant. The date

10135

# is relative to the Proleptic Gregorian Calendar. This can represent:

10136

#

10137

# * A full date, with non-zero year, month and day values

10138

# * A month and day value, with a zero year, e.g. an anniversary

10139

# * A year on its own, with zero month and day values

10140

# * A year and month value, with a zero day, e.g. a credit card expiration date

10141

#

10142

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

10143

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

10144

# month and day.

10145

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

10146

# a year.

10147

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

10148

# if specifying a year by itself or a year and month where the day is not

10149

# significant.

10150

},

10151

"booleanValue": True or False, # boolean

10152

},

10153

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

10154

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

10155

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

10156

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

10157

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10158

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

10159

# (FPE) with the FFX mode of operation; however when used in the

10160

# `ReidentifyContent` API method, it serves the opposite function by reversing

10161

# the surrogate back into the original identifier. The identifier must be

10162

# encoded as ASCII. For a given crypto key and context, the same identifier

10163

# will be replaced with the same surrogate. Identifiers must be at least two

10164

# characters long. In the case that the identifier is the empty string, it will

10165

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

10166

# more.

10167

#

10168

# Note: We recommend using CryptoDeterministicConfig for all use cases which

10169

# do not require preserving the input alphabet space and size, plus warrant

10170

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10171

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

10172

# This annotation will be applied to the surrogate by prefixing it with

10173

# the name of the custom infoType followed by the number of

10174

# characters comprising the surrogate. The following scheme defines the

10175

# format: info_type_name(surrogate_character_count):surrogate

10176

#

10177

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

10178

# the surrogate is 'abc', the full replacement value

10179

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

10180

#

10181

# This annotation identifies the surrogate when inspecting content using the

10182

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10183

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10184

# This facilitates reversal of the surrogate when it occurs in free text.

10185

#

10186

# In order for inspection to work properly, the name of this infoType must

10187

# not occur naturally anywhere in your data; otherwise, inspection may

10188

# find a surrogate that does not correspond to an actual identifier.

10189

# Therefore, choose your custom infoType name carefully after considering

10190

# what your data looks like. One way to select a name that has a high chance

10191

# of yielding reliable detection is to include one or more unicode characters

10192

# that are highly improbable to exist in your data.

10193

# For example, assuming your data is entered from a regular ASCII keyboard,

10194

# the symbol with the hex code point 29DD might be used like so:

10195

# ⧝MY_TOKEN_TYPE

10196

"name": "A String", # Name of the information type. Either a name of your choosing when

10197

# creating a CustomInfoType, or one of the names listed

10198

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10199

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

10200

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10201

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10202

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10203

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

10204

# identifier in two different contexts won't be given the same surrogate. If

10205

# the context is not set, a default tweak will be used.

10206

#

10207

# If the context is set but:

10208

#

10209

# 1. there is no record present when transforming a given value or

10210

# 1. the field is not present when transforming a given value,

10211

#

10212

# a default tweak will be used.

10213

#

10214

# Note that case (1) is expected when an `InfoTypeTransformation` is

10215

# applied to both structured and non-structured `ContentItem`s.

10216

# Currently, the referenced field may be of value type integer or string.

10217

#

10218

# The tweak is constructed as a sequence of bytes in big endian byte order

10219

# such that:

10220

#

10221

# - a 64 bit integer is encoded followed by a single byte of value 1

10222

# - a string is encoded in UTF-8 format followed by a single byte of value 2

10223

"name": "A String", # Name describing the field.

10224

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10225

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

10226

# that the FFX mode natively supports. This happens before/after

10227

# encryption/decryption.

10228

# Each character listed must appear only once.

10229

# Number of characters must be in the range [2, 95].

10230

# This must be encoded as ASCII.

10231

# The order of characters does not matter.

10232

# The full list of allowed characters is:

10233

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

10234

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10235

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

10236

# a key encryption key (KEK) stored by KMS).

10237

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

10238

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

10239

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10240

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

10241

# It will be discarded after the request finishes.

10242

"name": "A String", # Required. Name of the key.

10243

# This is an arbitrary string used to differentiate different keys.

10244

# A unique key is generated per name: two separate `TransientCryptoKey`

10245

# protos share the same generated key if their names are the same.

10246

# When the data crypto key is generated, this name is not used in any way

10247

# (repeating the api call will result in a different key being generated).

10248

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10249

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

10250

# The wrapped key must be a 128/192/256 bit key.

10251

# Authorization requires the following IAM permissions when sending a request

10252

# to perform a crypto transformation using a kms-wrapped crypto key:

10253

# dlp.kms.encrypt

10254

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

10255

"wrappedKey": "A String", # Required. The wrapped data crypto key.

10256

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10257

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

10258

# leaking the key. Choose another type of key if possible.

10259

"key": "A String", # Required. A 128/192/256 bit key.

10260

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10261

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10262

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10263

},

10264

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

10265

# input. Outputs a base64 encoded representation of the encrypted output.

10266

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10267

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

10268

# referential integrity such that the same identifier in two different

10269

# contexts will be given a distinct surrogate. The context is appended to

10270

# plaintext value being encrypted. On decryption the provided context is

10271

# validated against the value used during encryption. If a context was

10272

# provided during encryption, same context must be provided during decryption

10273

# as well.

10274

#

10275

# If the context is not set, plaintext would be used as is for encryption.

10276

# If the context is set but:

10277

#

10278

# 1. there is no record present when transforming a given value or

10279

# 2. the field is not present when transforming a given value,

10280

#

10281

# plaintext would be used as is for encryption.

10282

#

10283

# Note that case (1) is expected when an `InfoTypeTransformation` is

10284

# applied to both structured and non-structured `ContentItem`s.

10285

"name": "A String", # Name describing the field.

10286

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10287

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

10288

# This annotation will be applied to the surrogate by prefixing it with

10289

# the name of the custom info type followed by the number of

10290

# characters comprising the surrogate. The following scheme defines the

10291

# format: {info type name}({surrogate character count}):{surrogate}

10292

#

10293

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

10294

# the surrogate is 'abc', the full replacement value

10295

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

10296

#

10297

# This annotation identifies the surrogate when inspecting content using the

10298

# custom info type 'Surrogate'. This facilitates reversal of the

10299

# surrogate when it occurs in free text.

10300

#

10301

# Note: For record transformations where the entire cell in a table is being

10302

# transformed, surrogates are not mandatory. Surrogates are used to denote

10303

# the location of the token and are necessary for re-identification in free

10304

# form text.

10305

#

10306

# In order for inspection to work properly, the name of this info type must

10307

# not occur naturally anywhere in your data; otherwise, inspection may either

10308

#

10309

# - reverse a surrogate that does not correspond to an actual identifier

10310

# - be unable to parse the surrogate and result in an error

10311

#

10312

# Therefore, choose your custom info type name carefully after considering

10313

# what your data looks like. One way to select a name that has a high chance

10314

# of yielding reliable detection is to include one or more unicode characters

10315

# that are highly improbable to exist in your data.

10316

# For example, assuming your data is entered from a regular ASCII keyboard,

10317

# the symbol with the hex code point 29DD might be used like so:

10318

# ⧝MY_TOKEN_TYPE.

10319

"name": "A String", # Name of the information type. Either a name of your choosing when

10320

# creating a CustomInfoType, or one of the names listed

10321

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10322

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

10323

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10324

},

10325

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

10326

# a key encryption key (KEK) stored by KMS).

10327

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

10328

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

10329

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10330

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

10331

# It will be discarded after the request finishes.

10332

"name": "A String", # Required. Name of the key.

10333

# This is an arbitrary string used to differentiate different keys.

10334

# A unique key is generated per name: two separate `TransientCryptoKey`

10335

# protos share the same generated key if their names are the same.

10336

# When the data crypto key is generated, this name is not used in any way

10337

# (repeating the api call will result in a different key being generated).

10338

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10339

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

10340

# The wrapped key must be a 128/192/256 bit key.

10341

# Authorization requires the following IAM permissions when sending a request

10342

# to perform a crypto transformation using a kms-wrapped crypto key:

10343

# dlp.kms.encrypt

10344

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

10345

"wrappedKey": "A String", # Required. The wrapped data crypto key.

10346

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10347

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

10348

# leaking the key. Choose another type of key if possible.

10349

"key": "A String", # Required. A 128/192/256 bit key.

10350

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10351

},

10352

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10353

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

10354

# replacement values are dynamically provided by the user for custom behavior,

10355

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

10356

# This can be used on

10357

# data of type: number, long, string, timestamp.

10358

# If the bound `Value` type differs from the type of data being transformed, we

10359

# will first attempt converting the type of the data to be transformed to match

10360

# the type of the bound before comparing.

10361

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

10362

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

10363

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10364

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10365

# Note that for the purposes of inspection or transformation, the number

10366

# of bytes considered to comprise a 'Value' is based on its representation

10367

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

10368

# 123456789, the number of bytes would be counted as 9, even though an

10369

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10370

"integerValue": "A String", # integer

10371

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

10372

# or are specified elsewhere. An API may choose to allow leap seconds. Related

10373

# types are google.type.Date and `google.protobuf.Timestamp`.

10374

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

10375

# allow the value 60 if it allows leap-seconds.

10376

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

10377

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

10378

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

10379

# to allow the value "24:00:00" for scenarios like business closing time.

10380

},

10381

"dayOfWeekValue": "A String", # day of week

10382

"floatValue": 3.14, # float

10383

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10384

"timestampValue": "A String", # timestamp

10385

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

10386

# and time zone are either specified elsewhere or are not significant. The date

10387

# is relative to the Proleptic Gregorian Calendar. This can represent:

10388

#

10389

# * A full date, with non-zero year, month and day values

10390

# * A month and day value, with a zero year, e.g. an anniversary

10391

# * A year on its own, with zero month and day values

10392

# * A year and month value, with a zero day, e.g. a credit card expiration date

10393

#

10394

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10395

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

10396

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10397

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

10398

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10399

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

10400

# if specifying a year by itself or a year and month where the day is not

10401

# significant.

10402

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10403

"booleanValue": True or False, # boolean

10404

},

10405

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

10406

# Note that for the purposes of inspection or transformation, the number

10407

# of bytes considered to comprise a 'Value' is based on its representation

10408

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

10409

# 123456789, the number of bytes would be counted as 9, even though an

10410

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10411

"integerValue": "A String", # integer

10412

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

10413

# or are specified elsewhere. An API may choose to allow leap seconds. Related

10414

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10415

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

10416

# allow the value 60 if it allows leap-seconds.

10417

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10418

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

10419

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

10420

# to allow the value "24:00:00" for scenarios like business closing time.

10421

},

10422

"dayOfWeekValue": "A String", # day of week

10423

"floatValue": 3.14, # float

10424

"stringValue": "A String", # string

10425

"timestampValue": "A String", # timestamp

10426

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

10427

# and time zone are either specified elsewhere or are not significant. The date

10428

# is relative to the Proleptic Gregorian Calendar. This can represent:

10429

#

10430

# * A full date, with non-zero year, month and day values

10431

# * A month and day value, with a zero year, e.g. an anniversary

10432

# * A year on its own, with zero month and day values

10433

# * A year and month value, with a zero day, e.g. a credit card expiration date

10434

#

10435

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

10436

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

10437

# month and day.

10438

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

10439

# a year.

10440

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

10441

# if specifying a year by itself or a year and month where the day is not

10442

# significant.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10443

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10444

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10445

},

10446

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

10447

# used.

10448

# Note that for the purposes of inspection or transformation, the number

10449

# of bytes considered to comprise a 'Value' is based on its representation

10450

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

10451

# 123456789, the number of bytes would be counted as 9, even though an

10452

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10453

"integerValue": "A String", # integer

10454

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

10455

# or are specified elsewhere. An API may choose to allow leap seconds. Related

10456

# types are google.type.Date and `google.protobuf.Timestamp`.

10457

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

10458

# allow the value 60 if it allows leap-seconds.

10459

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

10460

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

10461

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

10462

# to allow the value "24:00:00" for scenarios like business closing time.

10463

},

10464

"dayOfWeekValue": "A String", # day of week

10465

"floatValue": 3.14, # float

10466

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10467

"timestampValue": "A String", # timestamp

10468

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

10469

# and time zone are either specified elsewhere or are not significant. The date

10470

# is relative to the Proleptic Gregorian Calendar. This can represent:

10471

#

10472

# * A full date, with non-zero year, month and day values

10473

# * A month and day value, with a zero year, e.g. an anniversary

10474

# * A year on its own, with zero month and day values

10475

# * A year and month value, with a zero day, e.g. a credit card expiration date

10476

#

10477

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10478

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

10479

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10480

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

10481

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10482

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

10483

# if specifying a year by itself or a year and month where the day is not

10484

# significant.

10485

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10486

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10491

},

10492

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

10493

# given `RecordCondition`. The conditions are allowed to reference fields

10494

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

10499

# column for the same record is within a specific range.

10500

# - Redact a field if the date of birth field is greater than 85.

10501

# a field.

10502

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10503

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

10504

"conditions": [ # A collection of conditions.

10505

{ # The field type of `value` and `field` do not need to match to be

10506

# considered equal, but not all comparisons are possible.

10507

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

10508

# but all other comparisons are invalid with incompatible types.

10509

# A `value` of type:

10510

#

10511

# - `string` can be compared against all other types

10512

# - `boolean` can only be compared against other booleans

10513

# - `integer` can be compared against doubles or a string if the string value

10514

# can be parsed as an integer.

10515

# - `double` can be compared against integers or a string if the string can

10516

# be parsed as a double.

10517

# - `Timestamp` can be compared against strings in RFC 3339 date string

10518

# format.

10519

# - `TimeOfDay` can be compared against timestamps and strings in the format

10520

# of 'HH:mm:ss'.

10521

#

10522

# If we fail to compare do to type mismatch, a warning will be given and

10523

# the condition will evaluate to false.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10524

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

10525

"name": "A String", # Name describing the field.

10526

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10527

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

10528

# Note that for the purposes of inspection or transformation, the number

10529

# of bytes considered to comprise a 'Value' is based on its representation

10530

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

10531

# 123456789, the number of bytes would be counted as 9, even though an

10532

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10533

"integerValue": "A String", # integer

10534

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

10535

# or are specified elsewhere. An API may choose to allow leap seconds. Related

10536

# types are google.type.Date and `google.protobuf.Timestamp`.

10537

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

10538

# allow the value 60 if it allows leap-seconds.

10539

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

10540

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

10541

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

10542

# to allow the value "24:00:00" for scenarios like business closing time.

10543

},

10544

"dayOfWeekValue": "A String", # day of week

10545

"floatValue": 3.14, # float

10546

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10547

"timestampValue": "A String", # timestamp

10548

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

10549

# and time zone are either specified elsewhere or are not significant. The date

10550

# is relative to the Proleptic Gregorian Calendar. This can represent:

10551

#

10552

# * A full date, with non-zero year, month and day values

10553

# * A month and day value, with a zero year, e.g. an anniversary

10554

# * A year on its own, with zero month and day values

10555

# * A year and month value, with a zero day, e.g. a credit card expiration date

10556

#

10557

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10558

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

10559

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10560

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

10561

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10562

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

10563

# if specifying a year by itself or a year and month where the day is not

10564

# significant.

10565

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10566

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10567

},

10568

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10569

},

10570

],

10571

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10572

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

10573

# only supported value is `AND`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10574

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10575

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10576

"fields": [ # Required. Input field(s) to apply the transformation to.

10577

{ # General identifier of a data field in a storage service.

10578

"name": "A String", # Name describing the field.

10579

},

10580

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10585

"createTime": "A String", # Output only. The creation timestamp of an inspectTemplate.

10586

"updateTime": "A String", # Output only. The last update timestamp of an inspectTemplate.

10587

"description": "A String", # Short description (max 256 chars).

10588

"displayName": "A String", # Display name (max 256 chars).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10589

},

10590

"updateMask": "A String", # Mask to control which fields get updated.

10591

}

10592

10593

x__xgafv: string, V1 error format.

Allowed values

1 - v1 error format

2 - v2 error format

Returns:

An object of the form:

10600

10601

{ # DeidentifyTemplates contains instructions on how to de-identify content.

10602

# See https://cloud.google.com/dlp/docs/concepts-templates to learn more.

10603

"name": "A String", # Output only. The template name.

10604

#

10605

# The template will have one of the following formats:

10606

# `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR

10607

# `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

10608

"deidentifyConfig": { # The configuration that controls how the data will change. # ///////////// // The core content of the template // ///////////////

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10609

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the dataset as free-form text and apply the same free text

10610

# transformation everywhere.

10611

# apply various `PrimitiveTransformation`s to each finding, where the

10612

# transformation is applied to only values that were identified as a specific

10613

# info_type.

10614

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

10615

# for a given infoType.

10616

{ # A transformation to apply to text that is identified as a specific

10617

# info_type.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10618

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

10619

# this transformation to apply to all findings that correspond to

10620

# infoTypes that were requested in `InspectConfig`.

10621

{ # Type of information detected by the API.

10622

"name": "A String", # Name of the information type. Either a name of your choosing when

10623

# creating a CustomInfoType, or one of the names listed

10624

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

10625

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

10626

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10627

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10628

],

10629

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10630

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

10631

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

10632

# to learn more.

10633

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

10634

# If set, must also set cryptoKey. If set, shift will be consistent for the

10635

# given context.

10636

"name": "A String", # Name describing the field.

10637

},

10638

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

10639

# range (inclusive ends). Negative means shift to earlier in time. Must not

10640

# be more than 365250 days (1000 years) each direction.

10641

#

10642

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10643

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

10644

# results in the same shift for the same context and crypto_key. If

10645

# set, must also set context. Can only be applied to table items.

10646

# a key encryption key (KEK) stored by KMS).

10647

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

10648

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

10649

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10650

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

10651

# It will be discarded after the request finishes.

10652

"name": "A String", # Required. Name of the key.

10653

# This is an arbitrary string used to differentiate different keys.

10654

# A unique key is generated per name: two separate `TransientCryptoKey`

10655

# protos share the same generated key if their names are the same.

10656

# When the data crypto key is generated, this name is not used in any way

10657

# (repeating the api call will result in a different key being generated).

10658

},

10659

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

10660

# The wrapped key must be a 128/192/256 bit key.

10661

# Authorization requires the following IAM permissions when sending a request

10662

# to perform a crypto transformation using a kms-wrapped crypto key:

10663

# dlp.kms.encrypt

10664

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

10665

"wrappedKey": "A String", # Required. The wrapped data crypto key.

10666

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10667

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

10668

# leaking the key. Choose another type of key if possible.

10669

"key": "A String", # Required. A 128/192/256 bit key.

10670

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10671

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10672

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

10673

},

10674

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

10675

# portion of the value.

10676

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10677

},

10678

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

10679

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10680

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

10681

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

10682

# Note that for the purposes of inspection or transformation, the number

10683

# of bytes considered to comprise a 'Value' is based on its representation

10684

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

10685

# 123456789, the number of bytes would be counted as 9, even though an

10686

# int64 only holds up to 8 bytes of data.

10687

"integerValue": "A String", # integer

10688

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

10689

# or are specified elsewhere. An API may choose to allow leap seconds. Related

10690

# types are google.type.Date and `google.protobuf.Timestamp`.

10691

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

10692

# allow the value 60 if it allows leap-seconds.

10693

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

10694

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

10695

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

10696

# to allow the value "24:00:00" for scenarios like business closing time.

10697

},

10698

"dayOfWeekValue": "A String", # day of week

10699

"floatValue": 3.14, # float

10700

"stringValue": "A String", # string

10701

"timestampValue": "A String", # timestamp

10702

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

10703

# and time zone are either specified elsewhere or are not significant. The date

10704

# is relative to the Proleptic Gregorian Calendar. This can represent:

10705

#

10706

# * A full date, with non-zero year, month and day values

10707

# * A month and day value, with a zero year, e.g. an anniversary

10708

# * A year on its own, with zero month and day values

10709

# * A year and month value, with a zero day, e.g. a credit card expiration date

10710

#

10711

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

10712

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

10713

# month and day.

10714

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

10715

# a year.

10716

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

10717

# if specifying a year by itself or a year and month where the day is not

10718

# significant.

10719

},

10720

"booleanValue": True or False, # boolean

10721

},

10722

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10723

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

10724

# Uses SHA-256.

10725

# The key size must be either 32 or 64 bytes.

10726

# Outputs a base64 encoded representation of the hashed output

10727

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

10728

# Currently, only string and integer values can be hashed.

10729

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

10730

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

10731

# a key encryption key (KEK) stored by KMS).

10732

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

10733

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

10734

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10735

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

10736

# It will be discarded after the request finishes.

10737

"name": "A String", # Required. Name of the key.

10738

# This is an arbitrary string used to differentiate different keys.

10739

# A unique key is generated per name: two separate `TransientCryptoKey`

10740

# protos share the same generated key if their names are the same.

10741

# When the data crypto key is generated, this name is not used in any way

10742

# (repeating the api call will result in a different key being generated).

10743

},

10744

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

10745

# The wrapped key must be a 128/192/256 bit key.

10746

# Authorization requires the following IAM permissions when sending a request

10747

# to perform a crypto transformation using a kms-wrapped crypto key:

10748

# dlp.kms.encrypt

10749

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

10750

"wrappedKey": "A String", # Required. The wrapped data crypto key.

10751

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10752

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

10753

# leaking the key. Choose another type of key if possible.

10754

"key": "A String", # Required. A 128/192/256 bit key.

10755

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10756

},

10757

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10758

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

10759

# fixed character. Masking can start from the beginning or end of the string.

10760

# This can be used on data of any type (numbers, longs, and so on) and when

10761

# de-identifying structured data we'll attempt to preserve the original data's

10762

# type. (This allows you to take a long like 123 and modify it to a string like

10763

# **3.

10764

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

10765

# characters. For example, if the input string is `555-555-5555` and you

10766

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

10767

# returns `***-**5-5555`.

10768

{ # Characters to skip when doing deidentification of a value. These will be left

10769

# alone and skipped.

10770

"charactersToSkip": "A String", # Characters to not transform when masking.

10771

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

10776

# masked. Skipped characters do not count towards this tally.

10777

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

10778

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

10779

# code or credit card number. This string must have a length of 1. If not

10780

# supplied, this value defaults to `*` for strings, and `0` for digits.

10781

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

10782

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

10783

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

10784

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

10785

# is `true`, then the string `12345` is masked as `12***`.

10786

},

10787

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

10788

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

10789

# output would be 'My phone number is '.

10790

},

10791

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

10792

# Bucketing transformation can provide all of this functionality,

10793

# but requires more configuration. This message is provided as a convenience to

10794

# the user for simple bucketing strategies.

10795

#

10796

# The transformed value will be a hyphenated string of

10797

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

10798

# all values that are within this bucket will be replaced with "10-20".

10799

#

10800

# This can be used on data of type: double, long.

10801

#

10802

# If the bound Value type differs from the type of data

10803

# being transformed, we will first attempt converting the type of the data to

10804

# be transformed to match the type of the bound before comparing.

10805

#

10806

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

10807

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

10808

# grouped together into a single bucket; for example if `upper_bound` = 89,

10809

# then all values greater than 89 are replaced with the value "89+".

10810

# Note that for the purposes of inspection or transformation, the number

10811

# of bytes considered to comprise a 'Value' is based on its representation

10812

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

10813

# 123456789, the number of bytes would be counted as 9, even though an

10814

# int64 only holds up to 8 bytes of data.

10815

"integerValue": "A String", # integer

10816

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

10817

# or are specified elsewhere. An API may choose to allow leap seconds. Related

10818

# types are google.type.Date and `google.protobuf.Timestamp`.

10819

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

10820

# allow the value 60 if it allows leap-seconds.

10821

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

10822

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

10823

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

10824

# to allow the value "24:00:00" for scenarios like business closing time.

10825

},

10826

"dayOfWeekValue": "A String", # day of week

10827

"floatValue": 3.14, # float

10828

"stringValue": "A String", # string

10829

"timestampValue": "A String", # timestamp

10830

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

10831

# and time zone are either specified elsewhere or are not significant. The date

10832

# is relative to the Proleptic Gregorian Calendar. This can represent:

10833

#

10834

# * A full date, with non-zero year, month and day values

10835

# * A month and day value, with a zero year, e.g. an anniversary

10836

# * A year on its own, with zero month and day values

10837

# * A year and month value, with a zero day, e.g. a credit card expiration date

10838

#

10839

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

10840

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

10841

# month and day.

10842

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

10843

# a year.

10844

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

10845

# if specifying a year by itself or a year and month where the day is not

10846

# significant.

10847

},

10848

"booleanValue": True or False, # boolean

10849

},

10850

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

10851

# grouped together into a single bucket; for example if `lower_bound` = 10,

10852

# then all values less than 10 are replaced with the value "-10".

10853

# Note that for the purposes of inspection or transformation, the number

10854

# of bytes considered to comprise a 'Value' is based on its representation

10855

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

10856

# 123456789, the number of bytes would be counted as 9, even though an

10857

# int64 only holds up to 8 bytes of data.

10858

"integerValue": "A String", # integer

10859

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

10860

# or are specified elsewhere. An API may choose to allow leap seconds. Related

10861

# types are google.type.Date and `google.protobuf.Timestamp`.

10862

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

10863

# allow the value 60 if it allows leap-seconds.

10864

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

10865

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

10866

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

10867

# to allow the value "24:00:00" for scenarios like business closing time.

10868

},

10869

"dayOfWeekValue": "A String", # day of week

10870

"floatValue": 3.14, # float

10871

"stringValue": "A String", # string

10872

"timestampValue": "A String", # timestamp

10873

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

10874

# and time zone are either specified elsewhere or are not significant. The date

10875

# is relative to the Proleptic Gregorian Calendar. This can represent:

10876

#

10877

# * A full date, with non-zero year, month and day values

10878

# * A month and day value, with a zero year, e.g. an anniversary

10879

# * A year on its own, with zero month and day values

10880

# * A year and month value, with a zero day, e.g. a credit card expiration date

10881

#

10882

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

10883

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

10884

# month and day.

10885

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

10886

# a year.

10887

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

10888

# if specifying a year by itself or a year and month where the day is not

10889

# significant.

10890

},

10891

"booleanValue": True or False, # boolean

10892

},

10893

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

10894

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

10895

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

10896

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

10897

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10898

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

10899

# (FPE) with the FFX mode of operation; however when used in the

10900

# `ReidentifyContent` API method, it serves the opposite function by reversing

10901

# the surrogate back into the original identifier. The identifier must be

10902

# encoded as ASCII. For a given crypto key and context, the same identifier

10903

# will be replaced with the same surrogate. Identifiers must be at least two

10904

# characters long. In the case that the identifier is the empty string, it will

10905

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

10906

# more.

10907

#

10908

# Note: We recommend using CryptoDeterministicConfig for all use cases which

10909

# do not require preserving the input alphabet space and size, plus warrant

10910

# referential integrity.

10911

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

10912

# This annotation will be applied to the surrogate by prefixing it with

10913

# the name of the custom infoType followed by the number of

10914

# characters comprising the surrogate. The following scheme defines the

10915

# format: info_type_name(surrogate_character_count):surrogate

10916

#

10917

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

10918

# the surrogate is 'abc', the full replacement value

10919

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

10920

#

10921

# This annotation identifies the surrogate when inspecting content using the

10922

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10923

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10924

# This facilitates reversal of the surrogate when it occurs in free text.

10925

#

10926

# In order for inspection to work properly, the name of this infoType must

10927

# not occur naturally anywhere in your data; otherwise, inspection may

10928

# find a surrogate that does not correspond to an actual identifier.

10929

# Therefore, choose your custom infoType name carefully after considering

10930

# what your data looks like. One way to select a name that has a high chance

10931

# of yielding reliable detection is to include one or more unicode characters

10932

# that are highly improbable to exist in your data.

10933

# For example, assuming your data is entered from a regular ASCII keyboard,

10934

# the symbol with the hex code point 29DD might be used like so:

10935

# ⧝MY_TOKEN_TYPE

10936

"name": "A String", # Name of the information type. Either a name of your choosing when

10937

# creating a CustomInfoType, or one of the names listed

10938

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10939

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

10940

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10941

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10942

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10943

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

10944

# identifier in two different contexts won't be given the same surrogate. If

10945

# the context is not set, a default tweak will be used.

10946

#

10947

# If the context is set but:

10948

#

10949

# 1. there is no record present when transforming a given value or

10950

# 1. the field is not present when transforming a given value,

10951

#

10952

# a default tweak will be used.

10953

#

10954

# Note that case (1) is expected when an `InfoTypeTransformation` is

10955

# applied to both structured and non-structured `ContentItem`s.

10956

# Currently, the referenced field may be of value type integer or string.

10957

#

10958

# The tweak is constructed as a sequence of bytes in big endian byte order

10959

# such that:

10960

#

10961

# - a 64 bit integer is encoded followed by a single byte of value 1

10962

# - a string is encoded in UTF-8 format followed by a single byte of value 2

10963

"name": "A String", # Name describing the field.

10964

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10965

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

10966

# that the FFX mode natively supports. This happens before/after

10967

# encryption/decryption.

10968

# Each character listed must appear only once.

10969

# Number of characters must be in the range [2, 95].

10970

# This must be encoded as ASCII.

10971

# The order of characters does not matter.

10972

# The full list of allowed characters is:

10973

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

10974

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10975

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

10976

# a key encryption key (KEK) stored by KMS).

10977

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

10978

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

10979

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

10980

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

10981

# It will be discarded after the request finishes.

10982

"name": "A String", # Required. Name of the key.

10983

# This is an arbitrary string used to differentiate different keys.

10984

# A unique key is generated per name: two separate `TransientCryptoKey`

10985

# protos share the same generated key if their names are the same.

10986

# When the data crypto key is generated, this name is not used in any way

10987

# (repeating the api call will result in a different key being generated).

10988

},

10989

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

10990

# The wrapped key must be a 128/192/256 bit key.

10991

# Authorization requires the following IAM permissions when sending a request

10992

# to perform a crypto transformation using a kms-wrapped crypto key:

10993

# dlp.kms.encrypt

10994

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

10995

"wrappedKey": "A String", # Required. The wrapped data crypto key.

10996

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

10997

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

10998

# leaking the key. Choose another type of key if possible.

10999

"key": "A String", # Required. A 128/192/256 bit key.

11000

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11001

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11002

"commonAlphabet": "A String", # Common alphabets.

11003

},

11004

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

11005

# input. Outputs a base64 encoded representation of the encrypted output.

11006

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11007

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

11008

# referential integrity such that the same identifier in two different

11009

# contexts will be given a distinct surrogate. The context is appended to

11010

# plaintext value being encrypted. On decryption the provided context is

11011

# validated against the value used during encryption. If a context was

11012

# provided during encryption, same context must be provided during decryption

11013

# as well.

11014

#

11015

# If the context is not set, plaintext would be used as is for encryption.

11016

# If the context is set but:

11017

#

11018

# 1. there is no record present when transforming a given value or

11019

# 2. the field is not present when transforming a given value,

11020

#

11021

# plaintext would be used as is for encryption.

11022

#

11023

# Note that case (1) is expected when an `InfoTypeTransformation` is

11024

# applied to both structured and non-structured `ContentItem`s.

11025

"name": "A String", # Name describing the field.

11026

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11027

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

11028

# This annotation will be applied to the surrogate by prefixing it with

11029

# the name of the custom info type followed by the number of

11030

# characters comprising the surrogate. The following scheme defines the

11031

# format: {info type name}({surrogate character count}):{surrogate}

11032

#

11033

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

11034

# the surrogate is 'abc', the full replacement value

11035

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

11036

#

11037

# This annotation identifies the surrogate when inspecting content using the

11038

# custom info type 'Surrogate'. This facilitates reversal of the

11039

# surrogate when it occurs in free text.

11040

#

11041

# Note: For record transformations where the entire cell in a table is being

11042

# transformed, surrogates are not mandatory. Surrogates are used to denote

11043

# the location of the token and are necessary for re-identification in free

11044

# form text.

11045

#

11046

# In order for inspection to work properly, the name of this info type must

11047

# not occur naturally anywhere in your data; otherwise, inspection may either

11048

#

11049

# - reverse a surrogate that does not correspond to an actual identifier

11050

# - be unable to parse the surrogate and result in an error

11051

#

11052

# Therefore, choose your custom info type name carefully after considering

11053

# what your data looks like. One way to select a name that has a high chance

11054

# of yielding reliable detection is to include one or more unicode characters

11055

# that are highly improbable to exist in your data.

11056

# For example, assuming your data is entered from a regular ASCII keyboard,

11057

# the symbol with the hex code point 29DD might be used like so:

11058

# ⧝MY_TOKEN_TYPE.

11059

"name": "A String", # Name of the information type. Either a name of your choosing when

11060

# creating a CustomInfoType, or one of the names listed

11061

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11062

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

11063

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11064

},

11065

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

11066

# a key encryption key (KEK) stored by KMS).

11067

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

11068

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

11069

# unwrap the data crypto key.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11070

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

11071

# It will be discarded after the request finishes.

11072

"name": "A String", # Required. Name of the key.

11073

# This is an arbitrary string used to differentiate different keys.

11074

# A unique key is generated per name: two separate `TransientCryptoKey`

11075

# protos share the same generated key if their names are the same.

11076

# When the data crypto key is generated, this name is not used in any way

11077

# (repeating the api call will result in a different key being generated).

11078

},

11079

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

11080

# The wrapped key must be a 128/192/256 bit key.

11081

# Authorization requires the following IAM permissions when sending a request

11082

# to perform a crypto transformation using a kms-wrapped crypto key:

11083

# dlp.kms.encrypt

11084

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

11085

"wrappedKey": "A String", # Required. The wrapped data crypto key.

11086

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11087

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

11088

# leaking the key. Choose another type of key if possible.

11089

"key": "A String", # Required. A 128/192/256 bit key.

11090

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11091

},

11092

},

11093

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

11094

# replacement values are dynamically provided by the user for custom behavior,

11095

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

11096

# This can be used on

11097

# data of type: number, long, string, timestamp.

11098

# If the bound `Value` type differs from the type of data being transformed, we

11099

# will first attempt converting the type of the data to be transformed to match

11100

# the type of the bound before comparing.

11101

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

11102

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

11103

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11104

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11105

# Note that for the purposes of inspection or transformation, the number

11106

# of bytes considered to comprise a 'Value' is based on its representation

11107

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

11108

# 123456789, the number of bytes would be counted as 9, even though an

11109

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11110

"integerValue": "A String", # integer

11111

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

11112

# or are specified elsewhere. An API may choose to allow leap seconds. Related

11113

# types are google.type.Date and `google.protobuf.Timestamp`.

11114

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

11115

# allow the value 60 if it allows leap-seconds.

11116

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

11117

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

11118

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

11119

# to allow the value "24:00:00" for scenarios like business closing time.

11120

},

11121

"dayOfWeekValue": "A String", # day of week

11122

"floatValue": 3.14, # float

11123

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11124

"timestampValue": "A String", # timestamp

11125

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

11126

# and time zone are either specified elsewhere or are not significant. The date

11127

# is relative to the Proleptic Gregorian Calendar. This can represent:

11128

#

11129

# * A full date, with non-zero year, month and day values

11130

# * A month and day value, with a zero year, e.g. an anniversary

11131

# * A year on its own, with zero month and day values

11132

# * A year and month value, with a zero day, e.g. a credit card expiration date

11133

#

11134

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11135

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

11136

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11137

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

11138

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11139

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

11140

# if specifying a year by itself or a year and month where the day is not

11141

# significant.

11142

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11143

"booleanValue": True or False, # boolean

11144

},

11145

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

11146

# Note that for the purposes of inspection or transformation, the number

11147

# of bytes considered to comprise a 'Value' is based on its representation

11148

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

11149

# 123456789, the number of bytes would be counted as 9, even though an

11150

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11151

"integerValue": "A String", # integer

11152

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

11153

# or are specified elsewhere. An API may choose to allow leap seconds. Related

11154

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11155

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

11156

# allow the value 60 if it allows leap-seconds.

11157

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11158

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

11159

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

11160

# to allow the value "24:00:00" for scenarios like business closing time.

11161

},

11162

"dayOfWeekValue": "A String", # day of week

11163

"floatValue": 3.14, # float

11164

"stringValue": "A String", # string

11165

"timestampValue": "A String", # timestamp

11166

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

11167

# and time zone are either specified elsewhere or are not significant. The date

11168

# is relative to the Proleptic Gregorian Calendar. This can represent:

11169

#

11170

# * A full date, with non-zero year, month and day values

11171

# * A month and day value, with a zero year, e.g. an anniversary

11172

# * A year on its own, with zero month and day values

11173

# * A year and month value, with a zero day, e.g. a credit card expiration date

11174

#

11175

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

11176

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

11177

# month and day.

11178

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

11179

# a year.

11180

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

11181

# if specifying a year by itself or a year and month where the day is not

11182

# significant.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11183

},

11184

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11185

},

11186

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

11187

# used.

11188

# Note that for the purposes of inspection or transformation, the number

11189

# of bytes considered to comprise a 'Value' is based on its representation

11190

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

11191

# 123456789, the number of bytes would be counted as 9, even though an

11192

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11193

"integerValue": "A String", # integer

11194

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

11195

# or are specified elsewhere. An API may choose to allow leap seconds. Related

11196

# types are google.type.Date and `google.protobuf.Timestamp`.

11197

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

11198

# allow the value 60 if it allows leap-seconds.

11199

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

11200

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

11201

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

11202

# to allow the value "24:00:00" for scenarios like business closing time.

11203

},

11204

"dayOfWeekValue": "A String", # day of week

11205

"floatValue": 3.14, # float

11206

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11207

"timestampValue": "A String", # timestamp

11208

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

11209

# and time zone are either specified elsewhere or are not significant. The date

11210

# is relative to the Proleptic Gregorian Calendar. This can represent:

11211

#

11212

# * A full date, with non-zero year, month and day values

11213

# * A month and day value, with a zero year, e.g. an anniversary

11214

# * A year on its own, with zero month and day values

11215

# * A year and month value, with a zero day, e.g. a credit card expiration date

11216

#

11217

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11218

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

11219

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11220

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

11221

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11222

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

11223

# if specifying a year by itself or a year and month where the day is not

11224

# significant.

11225

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11226

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11231

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11232

},

11233

],

11234

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11235

"transformationErrorHandling": { # How to handle transformation errors during de-identification. A # Mode for handling transformation errors. If left unspecified, the default

11236

# mode is `TransformationErrorHandling.ThrowError`.

11237

# transformation error occurs when the requested transformation is incompatible

11238

# with the data. For example, trying to de-identify an IP address using a

11239

# `DateShift` transformation would result in a transformation error, since date

11240

# info cannot be extracted from an IP address.

11241

# Information about any incompatible transformations, and how they were

11242

# handled, is returned in the response as part of the

11243

# `TransformationOverviews`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11244

"leaveUntransformed": { # Skips the data without modifying it if the requested transformation would # Ignore errors

11245

# cause an error. For example, if a `DateShift` transformation were applied

11246

# an an IP address, this mode would leave the IP address unchanged in the

11247

# response.

11248

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11249

"throwError": { # Throw an error and fail the request when a transformation error occurs. # Throw an error

11250

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11251

},

11252

"recordTransformations": { # A type of transformation that is applied over structured data such as a # Treat the dataset as structured. Transformations can be applied to

11253

# specific locations within structured datasets, such as transforming

11254

# a column within a table.

11255

# table.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11256

"recordSuppressions": [ # Configuration defining which records get suppressed entirely. Records that

11257

# match any suppression rule are omitted from the output.

11258

{ # Configuration to suppress records whose suppression conditions evaluate to

11259

# true.

11260

"condition": { # A condition for determining whether a transformation should be applied to # A condition that when it evaluates to true will result in the record being

11261

# evaluated to be suppressed from the transformed content.

11262

# a field.

11263

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

11264

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

11265

"conditions": [ # A collection of conditions.

11266

{ # The field type of `value` and `field` do not need to match to be

11267

# considered equal, but not all comparisons are possible.

11268

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

11269

# but all other comparisons are invalid with incompatible types.

11270

# A `value` of type:

11271

#

11272

# - `string` can be compared against all other types

11273

# - `boolean` can only be compared against other booleans

11274

# - `integer` can be compared against doubles or a string if the string value

11275

# can be parsed as an integer.

11276

# - `double` can be compared against integers or a string if the string can

11277

# be parsed as a double.

11278

# - `Timestamp` can be compared against strings in RFC 3339 date string

11279

# format.

11280

# - `TimeOfDay` can be compared against timestamps and strings in the format

11281

# of 'HH:mm:ss'.

11282

#

11283

# If we fail to compare do to type mismatch, a warning will be given and

11284

# the condition will evaluate to false.

11285

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

11286

"name": "A String", # Name describing the field.

11287

},

11288

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

11289

# Note that for the purposes of inspection or transformation, the number

11290

# of bytes considered to comprise a 'Value' is based on its representation

11291

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

11292

# 123456789, the number of bytes would be counted as 9, even though an

11293

# int64 only holds up to 8 bytes of data.

11294

"integerValue": "A String", # integer

11295

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

11296

# or are specified elsewhere. An API may choose to allow leap seconds. Related

11297

# types are google.type.Date and `google.protobuf.Timestamp`.

11298

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

11299

# allow the value 60 if it allows leap-seconds.

11300

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

11301

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

11302

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

11303

# to allow the value "24:00:00" for scenarios like business closing time.

11304

},

11305

"dayOfWeekValue": "A String", # day of week

11306

"floatValue": 3.14, # float

11307

"stringValue": "A String", # string

11308

"timestampValue": "A String", # timestamp

11309

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

11310

# and time zone are either specified elsewhere or are not significant. The date

11311

# is relative to the Proleptic Gregorian Calendar. This can represent:

11312

#

11313

# * A full date, with non-zero year, month and day values

11314

# * A month and day value, with a zero year, e.g. an anniversary

11315

# * A year on its own, with zero month and day values

11316

# * A year and month value, with a zero day, e.g. a credit card expiration date

11317

#

11318

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

11319

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

11320

# month and day.

11321

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

11322

# a year.

11323

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

11324

# if specifying a year by itself or a year and month where the day is not

11325

# significant.

11326

},

11327

"booleanValue": True or False, # boolean

11328

},

11329

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

},

],

},

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

11334

# only supported value is `AND`.

},

},

},

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11339

"fieldTransformations": [ # Transform the record by applying various field transformations.

11340

{ # The transformation to apply to the field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11341

"infoTypeTransformations": { # A type of transformation that will scan unstructured text and # Treat the contents of the field as free text, and selectively

11342

# transform content that matches an `InfoType`.

11343

# apply various `PrimitiveTransformation`s to each finding, where the

11344

# transformation is applied to only values that were identified as a specific

11345

# info_type.

11346

"transformations": [ # Required. Transformation for each infoType. Cannot specify more than one

11347

# for a given infoType.

11348

{ # A transformation to apply to text that is identified as a specific

11349

# info_type.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11350

"infoTypes": [ # InfoTypes to apply the transformation to. An empty list will cause

11351

# this transformation to apply to all findings that correspond to

11352

# infoTypes that were requested in `InspectConfig`.

11353

{ # Type of information detected by the API.

11354

"name": "A String", # Name of the information type. Either a name of your choosing when

11355

# creating a CustomInfoType, or one of the names listed

11356

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

11357

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

11358

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11359

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11360

],

11361

"primitiveTransformation": { # A rule for transforming a value. # Required. Primitive transformation to apply to the infoType.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11362

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

11363

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

11364

# to learn more.

11365

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

11366

# If set, must also set cryptoKey. If set, shift will be consistent for the

11367

# given context.

11368

"name": "A String", # Name describing the field.

11369

},

11370

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

11371

# range (inclusive ends). Negative means shift to earlier in time. Must not

11372

# be more than 365250 days (1000 years) each direction.

11373

#

11374

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11375

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

11376

# results in the same shift for the same context and crypto_key. If

11377

# set, must also set context. Can only be applied to table items.

11378

# a key encryption key (KEK) stored by KMS).

11379

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

11380

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

11381

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11382

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

11383

# It will be discarded after the request finishes.

11384

"name": "A String", # Required. Name of the key.

11385

# This is an arbitrary string used to differentiate different keys.

11386

# A unique key is generated per name: two separate `TransientCryptoKey`

11387

# protos share the same generated key if their names are the same.

11388

# When the data crypto key is generated, this name is not used in any way

11389

# (repeating the api call will result in a different key being generated).

11390

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11391

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

11392

# The wrapped key must be a 128/192/256 bit key.

11393

# Authorization requires the following IAM permissions when sending a request

11394

# to perform a crypto transformation using a kms-wrapped crypto key:

11395

# dlp.kms.encrypt

11396

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

11397

"wrappedKey": "A String", # Required. The wrapped data crypto key.

11398

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11399

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

11400

# leaking the key. Choose another type of key if possible.

11401

"key": "A String", # Required. A 128/192/256 bit key.

11402

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11403

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11404

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

11405

},

11406

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

11407

# portion of the value.

11408

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11409

},

11410

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

11411

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11412

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

11413

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

11414

# Note that for the purposes of inspection or transformation, the number

11415

# of bytes considered to comprise a 'Value' is based on its representation

11416

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

11417

# 123456789, the number of bytes would be counted as 9, even though an

11418

# int64 only holds up to 8 bytes of data.

11419

"integerValue": "A String", # integer

11420

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

11421

# or are specified elsewhere. An API may choose to allow leap seconds. Related

11422

# types are google.type.Date and `google.protobuf.Timestamp`.

11423

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

11424

# allow the value 60 if it allows leap-seconds.

11425

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

11426

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

11427

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

11428

# to allow the value "24:00:00" for scenarios like business closing time.

11429

},

11430

"dayOfWeekValue": "A String", # day of week

11431

"floatValue": 3.14, # float

11432

"stringValue": "A String", # string

11433

"timestampValue": "A String", # timestamp

11434

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

11435

# and time zone are either specified elsewhere or are not significant. The date

11436

# is relative to the Proleptic Gregorian Calendar. This can represent:

11437

#

11438

# * A full date, with non-zero year, month and day values

11439

# * A month and day value, with a zero year, e.g. an anniversary

11440

# * A year on its own, with zero month and day values

11441

# * A year and month value, with a zero day, e.g. a credit card expiration date

11442

#

11443

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

11444

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

11445

# month and day.

11446

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

11447

# a year.

11448

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

11449

# if specifying a year by itself or a year and month where the day is not

11450

# significant.

11451

},

11452

"booleanValue": True or False, # boolean

11453

},

11454

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11455

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

11456

# Uses SHA-256.

11457

# The key size must be either 32 or 64 bytes.

11458

# Outputs a base64 encoded representation of the hashed output

11459

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

11460

# Currently, only string and integer values can be hashed.

11461

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

11462

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

11463

# a key encryption key (KEK) stored by KMS).

11464

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

11465

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

11466

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11467

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

11468

# It will be discarded after the request finishes.

11469

"name": "A String", # Required. Name of the key.

11470

# This is an arbitrary string used to differentiate different keys.

11471

# A unique key is generated per name: two separate `TransientCryptoKey`

11472

# protos share the same generated key if their names are the same.

11473

# When the data crypto key is generated, this name is not used in any way

11474

# (repeating the api call will result in a different key being generated).

11475

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11476

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

11477

# The wrapped key must be a 128/192/256 bit key.

11478

# Authorization requires the following IAM permissions when sending a request

11479

# to perform a crypto transformation using a kms-wrapped crypto key:

11480

# dlp.kms.encrypt

11481

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

11482

"wrappedKey": "A String", # Required. The wrapped data crypto key.

11483

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11484

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

11485

# leaking the key. Choose another type of key if possible.

11486

"key": "A String", # Required. A 128/192/256 bit key.

11487

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11488

},

11489

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11490

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

11491

# fixed character. Masking can start from the beginning or end of the string.

11492

# This can be used on data of any type (numbers, longs, and so on) and when

11493

# de-identifying structured data we'll attempt to preserve the original data's

11494

# type. (This allows you to take a long like 123 and modify it to a string like

11495

# **3.

11496

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

11497

# characters. For example, if the input string is `555-555-5555` and you

11498

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

11499

# returns `***-**5-5555`.

11500

{ # Characters to skip when doing deidentification of a value. These will be left

11501

# alone and skipped.

11502

"charactersToSkip": "A String", # Characters to not transform when masking.

11503

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

11508

# masked. Skipped characters do not count towards this tally.

11509

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

11510

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

11511

# code or credit card number. This string must have a length of 1. If not

11512

# supplied, this value defaults to `*` for strings, and `0` for digits.

11513

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

11514

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

11515

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

11516

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

11517

# is `true`, then the string `12345` is masked as `12***`.

11518

},

11519

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

11520

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

11521

# output would be 'My phone number is '.

11522

},

11523

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

11524

# Bucketing transformation can provide all of this functionality,

11525

# but requires more configuration. This message is provided as a convenience to

11526

# the user for simple bucketing strategies.

11527

#

11528

# The transformed value will be a hyphenated string of

11529

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

11530

# all values that are within this bucket will be replaced with "10-20".

11531

#

11532

# This can be used on data of type: double, long.

11533

#

11534

# If the bound Value type differs from the type of data

11535

# being transformed, we will first attempt converting the type of the data to

11536

# be transformed to match the type of the bound before comparing.

11537

#

11538

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

11539

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

11540

# grouped together into a single bucket; for example if `upper_bound` = 89,

11541

# then all values greater than 89 are replaced with the value "89+".

11542

# Note that for the purposes of inspection or transformation, the number

11543

# of bytes considered to comprise a 'Value' is based on its representation

11544

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

11545

# 123456789, the number of bytes would be counted as 9, even though an

11546

# int64 only holds up to 8 bytes of data.

11547

"integerValue": "A String", # integer

11548

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

11549

# or are specified elsewhere. An API may choose to allow leap seconds. Related

11550

# types are google.type.Date and `google.protobuf.Timestamp`.

11551

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

11552

# allow the value 60 if it allows leap-seconds.

11553

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

11554

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

11555

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

11556

# to allow the value "24:00:00" for scenarios like business closing time.

11557

},

11558

"dayOfWeekValue": "A String", # day of week

11559

"floatValue": 3.14, # float

11560

"stringValue": "A String", # string

11561

"timestampValue": "A String", # timestamp

11562

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

11563

# and time zone are either specified elsewhere or are not significant. The date

11564

# is relative to the Proleptic Gregorian Calendar. This can represent:

11565

#

11566

# * A full date, with non-zero year, month and day values

11567

# * A month and day value, with a zero year, e.g. an anniversary

11568

# * A year on its own, with zero month and day values

11569

# * A year and month value, with a zero day, e.g. a credit card expiration date

11570

#

11571

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

11572

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

11573

# month and day.

11574

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

11575

# a year.

11576

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

11577

# if specifying a year by itself or a year and month where the day is not

11578

# significant.

11579

},

11580

"booleanValue": True or False, # boolean

11581

},

11582

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

11583

# grouped together into a single bucket; for example if `lower_bound` = 10,

11584

# then all values less than 10 are replaced with the value "-10".

11585

# Note that for the purposes of inspection or transformation, the number

11586

# of bytes considered to comprise a 'Value' is based on its representation

11587

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

11588

# 123456789, the number of bytes would be counted as 9, even though an

11589

# int64 only holds up to 8 bytes of data.

11590

"integerValue": "A String", # integer

11591

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

11592

# or are specified elsewhere. An API may choose to allow leap seconds. Related

11593

# types are google.type.Date and `google.protobuf.Timestamp`.

11594

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

11595

# allow the value 60 if it allows leap-seconds.

11596

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

11597

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

11598

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

11599

# to allow the value "24:00:00" for scenarios like business closing time.

11600

},

11601

"dayOfWeekValue": "A String", # day of week

11602

"floatValue": 3.14, # float

11603

"stringValue": "A String", # string

11604

"timestampValue": "A String", # timestamp

11605

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

11606

# and time zone are either specified elsewhere or are not significant. The date

11607

# is relative to the Proleptic Gregorian Calendar. This can represent:

11608

#

11609

# * A full date, with non-zero year, month and day values

11610

# * A month and day value, with a zero year, e.g. an anniversary

11611

# * A year on its own, with zero month and day values

11612

# * A year and month value, with a zero day, e.g. a credit card expiration date

11613

#

11614

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

11615

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

11616

# month and day.

11617

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

11618

# a year.

11619

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

11620

# if specifying a year by itself or a year and month where the day is not

11621

# significant.

11622

},

11623

"booleanValue": True or False, # boolean

11624

},

11625

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

11626

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

11627

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

11628

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

11629

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11630

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

11631

# (FPE) with the FFX mode of operation; however when used in the

11632

# `ReidentifyContent` API method, it serves the opposite function by reversing

11633

# the surrogate back into the original identifier. The identifier must be

11634

# encoded as ASCII. For a given crypto key and context, the same identifier

11635

# will be replaced with the same surrogate. Identifiers must be at least two

11636

# characters long. In the case that the identifier is the empty string, it will

11637

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

11638

# more.

11639

#

11640

# Note: We recommend using CryptoDeterministicConfig for all use cases which

11641

# do not require preserving the input alphabet space and size, plus warrant

11642

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11643

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

11644

# This annotation will be applied to the surrogate by prefixing it with

11645

# the name of the custom infoType followed by the number of

11646

# characters comprising the surrogate. The following scheme defines the

11647

# format: info_type_name(surrogate_character_count):surrogate

11648

#

11649

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

11650

# the surrogate is 'abc', the full replacement value

11651

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

11652

#

11653

# This annotation identifies the surrogate when inspecting content using the

11654

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11655

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11656

# This facilitates reversal of the surrogate when it occurs in free text.

11657

#

11658

# In order for inspection to work properly, the name of this infoType must

11659

# not occur naturally anywhere in your data; otherwise, inspection may

11660

# find a surrogate that does not correspond to an actual identifier.

11661

# Therefore, choose your custom infoType name carefully after considering

11662

# what your data looks like. One way to select a name that has a high chance

11663

# of yielding reliable detection is to include one or more unicode characters

11664

# that are highly improbable to exist in your data.

11665

# For example, assuming your data is entered from a regular ASCII keyboard,

11666

# the symbol with the hex code point 29DD might be used like so:

11667

# ⧝MY_TOKEN_TYPE

11668

"name": "A String", # Name of the information type. Either a name of your choosing when

11669

# creating a CustomInfoType, or one of the names listed

11670

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11671

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

11672

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11673

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11674

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11675

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

11676

# identifier in two different contexts won't be given the same surrogate. If

11677

# the context is not set, a default tweak will be used.

11678

#

11679

# If the context is set but:

11680

#

11681

# 1. there is no record present when transforming a given value or

11682

# 1. the field is not present when transforming a given value,

11683

#

11684

# a default tweak will be used.

11685

#

11686

# Note that case (1) is expected when an `InfoTypeTransformation` is

11687

# applied to both structured and non-structured `ContentItem`s.

11688

# Currently, the referenced field may be of value type integer or string.

11689

#

11690

# The tweak is constructed as a sequence of bytes in big endian byte order

11691

# such that:

11692

#

11693

# - a 64 bit integer is encoded followed by a single byte of value 1

11694

# - a string is encoded in UTF-8 format followed by a single byte of value 2

11695

"name": "A String", # Name describing the field.

11696

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11697

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

11698

# that the FFX mode natively supports. This happens before/after

11699

# encryption/decryption.

11700

# Each character listed must appear only once.

11701

# Number of characters must be in the range [2, 95].

11702

# This must be encoded as ASCII.

11703

# The order of characters does not matter.

11704

# The full list of allowed characters is:

11705

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

11706

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11707

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

11708

# a key encryption key (KEK) stored by KMS).

11709

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

11710

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

11711

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11712

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

11713

# It will be discarded after the request finishes.

11714

"name": "A String", # Required. Name of the key.

11715

# This is an arbitrary string used to differentiate different keys.

11716

# A unique key is generated per name: two separate `TransientCryptoKey`

11717

# protos share the same generated key if their names are the same.

11718

# When the data crypto key is generated, this name is not used in any way

11719

# (repeating the api call will result in a different key being generated).

11720

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11721

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

11722

# The wrapped key must be a 128/192/256 bit key.

11723

# Authorization requires the following IAM permissions when sending a request

11724

# to perform a crypto transformation using a kms-wrapped crypto key:

11725

# dlp.kms.encrypt

11726

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

11727

"wrappedKey": "A String", # Required. The wrapped data crypto key.

11728

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11729

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

11730

# leaking the key. Choose another type of key if possible.

11731

"key": "A String", # Required. A 128/192/256 bit key.

11732

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11733

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11734

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11735

},

11736

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

11737

# input. Outputs a base64 encoded representation of the encrypted output.

11738

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11739

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

11740

# referential integrity such that the same identifier in two different

11741

# contexts will be given a distinct surrogate. The context is appended to

11742

# plaintext value being encrypted. On decryption the provided context is

11743

# validated against the value used during encryption. If a context was

11744

# provided during encryption, same context must be provided during decryption

11745

# as well.

11746

#

11747

# If the context is not set, plaintext would be used as is for encryption.

11748

# If the context is set but:

11749

#

11750

# 1. there is no record present when transforming a given value or

11751

# 2. the field is not present when transforming a given value,

11752

#

11753

# plaintext would be used as is for encryption.

11754

#

11755

# Note that case (1) is expected when an `InfoTypeTransformation` is

11756

# applied to both structured and non-structured `ContentItem`s.

11757

"name": "A String", # Name describing the field.

11758

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11759

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

11760

# This annotation will be applied to the surrogate by prefixing it with

11761

# the name of the custom info type followed by the number of

11762

# characters comprising the surrogate. The following scheme defines the

11763

# format: {info type name}({surrogate character count}):{surrogate}

11764

#

11765

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

11766

# the surrogate is 'abc', the full replacement value

11767

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

11768

#

11769

# This annotation identifies the surrogate when inspecting content using the

11770

# custom info type 'Surrogate'. This facilitates reversal of the

11771

# surrogate when it occurs in free text.

11772

#

11773

# Note: For record transformations where the entire cell in a table is being

11774

# transformed, surrogates are not mandatory. Surrogates are used to denote

11775

# the location of the token and are necessary for re-identification in free

11776

# form text.

11777

#

11778

# In order for inspection to work properly, the name of this info type must

11779

# not occur naturally anywhere in your data; otherwise, inspection may either

11780

#

11781

# - reverse a surrogate that does not correspond to an actual identifier

11782

# - be unable to parse the surrogate and result in an error

11783

#

11784

# Therefore, choose your custom info type name carefully after considering

11785

# what your data looks like. One way to select a name that has a high chance

11786

# of yielding reliable detection is to include one or more unicode characters

11787

# that are highly improbable to exist in your data.

11788

# For example, assuming your data is entered from a regular ASCII keyboard,

11789

# the symbol with the hex code point 29DD might be used like so:

11790

# ⧝MY_TOKEN_TYPE.

11791

"name": "A String", # Name of the information type. Either a name of your choosing when

11792

# creating a CustomInfoType, or one of the names listed

11793

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11794

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

11795

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11796

},

11797

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

11798

# a key encryption key (KEK) stored by KMS).

11799

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

11800

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

11801

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11802

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

11803

# It will be discarded after the request finishes.

11804

"name": "A String", # Required. Name of the key.

11805

# This is an arbitrary string used to differentiate different keys.

11806

# A unique key is generated per name: two separate `TransientCryptoKey`

11807

# protos share the same generated key if their names are the same.

11808

# When the data crypto key is generated, this name is not used in any way

11809

# (repeating the api call will result in a different key being generated).

11810

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11811

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

11812

# The wrapped key must be a 128/192/256 bit key.

11813

# Authorization requires the following IAM permissions when sending a request

11814

# to perform a crypto transformation using a kms-wrapped crypto key:

11815

# dlp.kms.encrypt

11816

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

11817

"wrappedKey": "A String", # Required. The wrapped data crypto key.

11818

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11819

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

11820

# leaking the key. Choose another type of key if possible.

11821

"key": "A String", # Required. A 128/192/256 bit key.

11822

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11823

},

11824

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11825

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

11826

# replacement values are dynamically provided by the user for custom behavior,

11827

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

11828

# This can be used on

11829

# data of type: number, long, string, timestamp.

11830

# If the bound `Value` type differs from the type of data being transformed, we

11831

# will first attempt converting the type of the data to be transformed to match

11832

# the type of the bound before comparing.

11833

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

11834

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

11835

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11836

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11837

# Note that for the purposes of inspection or transformation, the number

11838

# of bytes considered to comprise a 'Value' is based on its representation

11839

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

11840

# 123456789, the number of bytes would be counted as 9, even though an

11841

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11842

"integerValue": "A String", # integer

11843

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

11844

# or are specified elsewhere. An API may choose to allow leap seconds. Related

11845

# types are google.type.Date and `google.protobuf.Timestamp`.

11846

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

11847

# allow the value 60 if it allows leap-seconds.

11848

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

11849

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

11850

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

11851

# to allow the value "24:00:00" for scenarios like business closing time.

11852

},

11853

"dayOfWeekValue": "A String", # day of week

11854

"floatValue": 3.14, # float

11855

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11856

"timestampValue": "A String", # timestamp

11857

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

11858

# and time zone are either specified elsewhere or are not significant. The date

11859

# is relative to the Proleptic Gregorian Calendar. This can represent:

11860

#

11861

# * A full date, with non-zero year, month and day values

11862

# * A month and day value, with a zero year, e.g. an anniversary

11863

# * A year on its own, with zero month and day values

11864

# * A year and month value, with a zero day, e.g. a credit card expiration date

11865

#

11866

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11867

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

11868

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11869

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

11870

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11871

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

11872

# if specifying a year by itself or a year and month where the day is not

11873

# significant.

11874

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11875

"booleanValue": True or False, # boolean

11876

},

11877

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

11878

# Note that for the purposes of inspection or transformation, the number

11879

# of bytes considered to comprise a 'Value' is based on its representation

11880

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

11881

# 123456789, the number of bytes would be counted as 9, even though an

11882

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11883

"integerValue": "A String", # integer

11884

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

11885

# or are specified elsewhere. An API may choose to allow leap seconds. Related

11886

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11887

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

11888

# allow the value 60 if it allows leap-seconds.

11889

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11890

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

11891

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

11892

# to allow the value "24:00:00" for scenarios like business closing time.

11893

},

11894

"dayOfWeekValue": "A String", # day of week

11895

"floatValue": 3.14, # float

11896

"stringValue": "A String", # string

11897

"timestampValue": "A String", # timestamp

11898

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

11899

# and time zone are either specified elsewhere or are not significant. The date

11900

# is relative to the Proleptic Gregorian Calendar. This can represent:

11901

#

11902

# * A full date, with non-zero year, month and day values

11903

# * A month and day value, with a zero year, e.g. an anniversary

11904

# * A year on its own, with zero month and day values

11905

# * A year and month value, with a zero day, e.g. a credit card expiration date

11906

#

11907

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

11908

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

11909

# month and day.

11910

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

11911

# a year.

11912

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

11913

# if specifying a year by itself or a year and month where the day is not

11914

# significant.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11915

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11916

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11917

},

11918

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

11919

# used.

11920

# Note that for the purposes of inspection or transformation, the number

11921

# of bytes considered to comprise a 'Value' is based on its representation

11922

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

11923

# 123456789, the number of bytes would be counted as 9, even though an

11924

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11925

"integerValue": "A String", # integer

11926

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

11927

# or are specified elsewhere. An API may choose to allow leap seconds. Related

11928

# types are google.type.Date and `google.protobuf.Timestamp`.

11929

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

11930

# allow the value 60 if it allows leap-seconds.

11931

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

11932

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

11933

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

11934

# to allow the value "24:00:00" for scenarios like business closing time.

11935

},

11936

"dayOfWeekValue": "A String", # day of week

11937

"floatValue": 3.14, # float

11938

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11939

"timestampValue": "A String", # timestamp

11940

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

11941

# and time zone are either specified elsewhere or are not significant. The date

11942

# is relative to the Proleptic Gregorian Calendar. This can represent:

11943

#

11944

# * A full date, with non-zero year, month and day values

11945

# * A month and day value, with a zero year, e.g. an anniversary

11946

# * A year on its own, with zero month and day values

11947

# * A year and month value, with a zero day, e.g. a credit card expiration date

11948

#

11949

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11950

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

11951

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

11952

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

11953

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11954

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

11955

# if specifying a year by itself or a year and month where the day is not

11956

# significant.

11957

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11958

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

"primitiveTransformation": { # A rule for transforming a value. # Apply the transformation to the entire field.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11968

"dateShiftConfig": { # Shifts dates by random number of days, with option to be consistent for the # Date Shift

11969

# same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting

11970

# to learn more.

11971

"context": { # General identifier of a data field in a storage service. # Points to the field that contains the context, for example, an entity id.

11972

# If set, must also set cryptoKey. If set, shift will be consistent for the

11973

# given context.

11974

"name": "A String", # Name describing the field.

11975

},

11976

"upperBoundDays": 42, # Required. Range of shift in days. Actual shift will be selected at random within this

11977

# range (inclusive ends). Negative means shift to earlier in time. Must not

11978

# be more than 365250 days (1000 years) each direction.

11979

#

11980

# For example, 3 means shift date to at most 3 days into the future.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11981

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Causes the shift to be computed based on this key and the context. This

11982

# results in the same shift for the same context and crypto_key. If

11983

# set, must also set context. Can only be applied to table items.

11984

# a key encryption key (KEK) stored by KMS).

11985

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

11986

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

11987

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

11988

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

11989

# It will be discarded after the request finishes.

11990

"name": "A String", # Required. Name of the key.

11991

# This is an arbitrary string used to differentiate different keys.

11992

# A unique key is generated per name: two separate `TransientCryptoKey`

11993

# protos share the same generated key if their names are the same.

11994

# When the data crypto key is generated, this name is not used in any way

11995

# (repeating the api call will result in a different key being generated).

11996

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

11997

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

11998

# The wrapped key must be a 128/192/256 bit key.

11999

# Authorization requires the following IAM permissions when sending a request

12000

# to perform a crypto transformation using a kms-wrapped crypto key:

12001

# dlp.kms.encrypt

12002

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

12003

"wrappedKey": "A String", # Required. The wrapped data crypto key.

12004

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12005

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

12006

# leaking the key. Choose another type of key if possible.

12007

"key": "A String", # Required. A 128/192/256 bit key.

12008

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12009

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12010

"lowerBoundDays": 42, # Required. For example, -5 means shift date to at most 5 days back in the past.

12011

},

12012

"timePartConfig": { # For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a # Time extraction

12013

# portion of the value.

12014

"partToExtract": "A String", # The part of the time to keep.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12015

},

12016

"replaceWithInfoTypeConfig": { # Replace each matching finding with the name of the info_type. # Replace with infotype

12017

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12018

"replaceConfig": { # Replace each input value with a given `Value`. # Replace

12019

"newValue": { # Set of primitive values supported by the system. # Value to replace it with.

12020

# Note that for the purposes of inspection or transformation, the number

12021

# of bytes considered to comprise a 'Value' is based on its representation

12022

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

12023

# 123456789, the number of bytes would be counted as 9, even though an

12024

# int64 only holds up to 8 bytes of data.

12025

"integerValue": "A String", # integer

12026

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

12027

# or are specified elsewhere. An API may choose to allow leap seconds. Related

12028

# types are google.type.Date and `google.protobuf.Timestamp`.

12029

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

12030

# allow the value 60 if it allows leap-seconds.

12031

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

12032

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

12033

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

12034

# to allow the value "24:00:00" for scenarios like business closing time.

12035

},

12036

"dayOfWeekValue": "A String", # day of week

12037

"floatValue": 3.14, # float

12038

"stringValue": "A String", # string

12039

"timestampValue": "A String", # timestamp

12040

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

12041

# and time zone are either specified elsewhere or are not significant. The date

12042

# is relative to the Proleptic Gregorian Calendar. This can represent:

12043

#

12044

# * A full date, with non-zero year, month and day values

12045

# * A month and day value, with a zero year, e.g. an anniversary

12046

# * A year on its own, with zero month and day values

12047

# * A year and month value, with a zero day, e.g. a credit card expiration date

12048

#

12049

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

12050

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

12051

# month and day.

12052

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

12053

# a year.

12054

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

12055

# if specifying a year by itself or a year and month where the day is not

12056

# significant.

12057

},

12058

"booleanValue": True or False, # boolean

12059

},

12060

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12061

"cryptoHashConfig": { # Pseudonymization method that generates surrogates via cryptographic hashing. # Crypto

12062

# Uses SHA-256.

12063

# The key size must be either 32 or 64 bytes.

12064

# Outputs a base64 encoded representation of the hashed output

12065

# (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).

12066

# Currently, only string and integer values can be hashed.

12067

# See https://cloud.google.com/dlp/docs/pseudonymization to learn more.

12068

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the hash function.

12069

# a key encryption key (KEK) stored by KMS).

12070

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

12071

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

12072

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12073

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

12074

# It will be discarded after the request finishes.

12075

"name": "A String", # Required. Name of the key.

12076

# This is an arbitrary string used to differentiate different keys.

12077

# A unique key is generated per name: two separate `TransientCryptoKey`

12078

# protos share the same generated key if their names are the same.

12079

# When the data crypto key is generated, this name is not used in any way

12080

# (repeating the api call will result in a different key being generated).

12081

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12082

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

12083

# The wrapped key must be a 128/192/256 bit key.

12084

# Authorization requires the following IAM permissions when sending a request

12085

# to perform a crypto transformation using a kms-wrapped crypto key:

12086

# dlp.kms.encrypt

12087

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

12088

"wrappedKey": "A String", # Required. The wrapped data crypto key.

12089

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12090

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

12091

# leaking the key. Choose another type of key if possible.

12092

"key": "A String", # Required. A 128/192/256 bit key.

12093

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12094

},

12095

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12096

"characterMaskConfig": { # Partially mask a string by replacing a given number of characters with a # Mask

12097

# fixed character. Masking can start from the beginning or end of the string.

12098

# This can be used on data of any type (numbers, longs, and so on) and when

12099

# de-identifying structured data we'll attempt to preserve the original data's

12100

# type. (This allows you to take a long like 123 and modify it to a string like

12101

# **3.

12102

"charactersToIgnore": [ # When masking a string, items in this list will be skipped when replacing

12103

# characters. For example, if the input string is `555-555-5555` and you

12104

# instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP

12105

# returns `***-**5-5555`.

12106

{ # Characters to skip when doing deidentification of a value. These will be left

12107

# alone and skipped.

12108

"charactersToSkip": "A String", # Characters to not transform when masking.

12109

"commonCharactersToIgnore": "A String", # Common characters to not transform when masking. Useful to avoid removing

# punctuation.

},

],

"numberToMask": 42, # Number of characters to mask. If not set, all matching chars will be

12114

# masked. Skipped characters do not count towards this tally.

12115

"maskingCharacter": "A String", # Character to use to mask the sensitive values&mdash;for example, `*` for an

12116

# alphabetic string such as a name, or `0` for a numeric string such as ZIP

12117

# code or credit card number. This string must have a length of 1. If not

12118

# supplied, this value defaults to `*` for strings, and `0` for digits.

12119

"reverseOrder": True or False, # Mask characters in reverse order. For example, if `masking_character` is

12120

# `0`, `number_to_mask` is `14`, and `reverse_order` is `false`, then the

12121

# input string `1234-5678-9012-3456` is masked as `00000000000000-3456`.

12122

# If `masking_character` is `*`, `number_to_mask` is `3`, and `reverse_order`

12123

# is `true`, then the string `12345` is masked as `12***`.

12124

},

12125

"redactConfig": { # Redact a given value. For example, if used with an `InfoTypeTransformation` # Redact

12126

# transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the

12127

# output would be 'My phone number is '.

12128

},

12129

"fixedSizeBucketingConfig": { # Buckets values based on fixed size ranges. The # Fixed size bucketing

12130

# Bucketing transformation can provide all of this functionality,

12131

# but requires more configuration. This message is provided as a convenience to

12132

# the user for simple bucketing strategies.

12133

#

12134

# The transformed value will be a hyphenated string of

12135

# {lower_bound}-{upper_bound}, i.e if lower_bound = 10 and upper_bound = 20

12136

# all values that are within this bucket will be replaced with "10-20".

12137

#

12138

# This can be used on data of type: double, long.

12139

#

12140

# If the bound Value type differs from the type of data

12141

# being transformed, we will first attempt converting the type of the data to

12142

# be transformed to match the type of the bound before comparing.

12143

#

12144

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

12145

"upperBound": { # Set of primitive values supported by the system. # Required. Upper bound value of buckets. All values greater than upper_bound are

12146

# grouped together into a single bucket; for example if `upper_bound` = 89,

12147

# then all values greater than 89 are replaced with the value "89+".

12148

# Note that for the purposes of inspection or transformation, the number

12149

# of bytes considered to comprise a 'Value' is based on its representation

12150

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

12151

# 123456789, the number of bytes would be counted as 9, even though an

12152

# int64 only holds up to 8 bytes of data.

12153

"integerValue": "A String", # integer

12154

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

12155

# or are specified elsewhere. An API may choose to allow leap seconds. Related

12156

# types are google.type.Date and `google.protobuf.Timestamp`.

12157

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

12158

# allow the value 60 if it allows leap-seconds.

12159

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

12160

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

12161

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

12162

# to allow the value "24:00:00" for scenarios like business closing time.

12163

},

12164

"dayOfWeekValue": "A String", # day of week

12165

"floatValue": 3.14, # float

12166

"stringValue": "A String", # string

12167

"timestampValue": "A String", # timestamp

12168

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

12169

# and time zone are either specified elsewhere or are not significant. The date

12170

# is relative to the Proleptic Gregorian Calendar. This can represent:

12171

#

12172

# * A full date, with non-zero year, month and day values

12173

# * A month and day value, with a zero year, e.g. an anniversary

12174

# * A year on its own, with zero month and day values

12175

# * A year and month value, with a zero day, e.g. a credit card expiration date

12176

#

12177

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

12178

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

12179

# month and day.

12180

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

12181

# a year.

12182

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

12183

# if specifying a year by itself or a year and month where the day is not

12184

# significant.

12185

},

12186

"booleanValue": True or False, # boolean

12187

},

12188

"lowerBound": { # Set of primitive values supported by the system. # Required. Lower bound value of buckets. All values less than `lower_bound` are

12189

# grouped together into a single bucket; for example if `lower_bound` = 10,

12190

# then all values less than 10 are replaced with the value "-10".

12191

# Note that for the purposes of inspection or transformation, the number

12192

# of bytes considered to comprise a 'Value' is based on its representation

12193

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

12194

# 123456789, the number of bytes would be counted as 9, even though an

12195

# int64 only holds up to 8 bytes of data.

12196

"integerValue": "A String", # integer

12197

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

12198

# or are specified elsewhere. An API may choose to allow leap seconds. Related

12199

# types are google.type.Date and `google.protobuf.Timestamp`.

12200

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

12201

# allow the value 60 if it allows leap-seconds.

12202

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

12203

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

12204

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

12205

# to allow the value "24:00:00" for scenarios like business closing time.

12206

},

12207

"dayOfWeekValue": "A String", # day of week

12208

"floatValue": 3.14, # float

12209

"stringValue": "A String", # string

12210

"timestampValue": "A String", # timestamp

12211

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

12212

# and time zone are either specified elsewhere or are not significant. The date

12213

# is relative to the Proleptic Gregorian Calendar. This can represent:

12214

#

12215

# * A full date, with non-zero year, month and day values

12216

# * A month and day value, with a zero year, e.g. an anniversary

12217

# * A year on its own, with zero month and day values

12218

# * A year and month value, with a zero day, e.g. a credit card expiration date

12219

#

12220

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

12221

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

12222

# month and day.

12223

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

12224

# a year.

12225

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

12226

# if specifying a year by itself or a year and month where the day is not

12227

# significant.

12228

},

12229

"booleanValue": True or False, # boolean

12230

},

12231

"bucketSize": 3.14, # Required. Size of each bucket (except for minimum and maximum buckets). So if

12232

# `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the

12233

# following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,

12234

# 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works.

12235

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12236

"cryptoReplaceFfxFpeConfig": { # Replaces an identifier with a surrogate using Format Preserving Encryption # Ffx-Fpe

12237

# (FPE) with the FFX mode of operation; however when used in the

12238

# `ReidentifyContent` API method, it serves the opposite function by reversing

12239

# the surrogate back into the original identifier. The identifier must be

12240

# encoded as ASCII. For a given crypto key and context, the same identifier

12241

# will be replaced with the same surrogate. Identifiers must be at least two

12242

# characters long. In the case that the identifier is the empty string, it will

12243

# be skipped. See https://cloud.google.com/dlp/docs/pseudonymization to learn

12244

# more.

12245

#

12246

# Note: We recommend using CryptoDeterministicConfig for all use cases which

12247

# do not require preserving the input alphabet space and size, plus warrant

12248

# referential integrity.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12249

"surrogateInfoType": { # Type of information detected by the API. # The custom infoType to annotate the surrogate with.

12250

# This annotation will be applied to the surrogate by prefixing it with

12251

# the name of the custom infoType followed by the number of

12252

# characters comprising the surrogate. The following scheme defines the

12253

# format: info_type_name(surrogate_character_count):surrogate

12254

#

12255

# For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and

12256

# the surrogate is 'abc', the full replacement value

12257

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

12258

#

12259

# This annotation identifies the surrogate when inspecting content using the

12260

# custom infoType

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12261

# [`SurrogateType`](https://cloud.google.com/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12262

# This facilitates reversal of the surrogate when it occurs in free text.

12263

#

12264

# In order for inspection to work properly, the name of this infoType must

12265

# not occur naturally anywhere in your data; otherwise, inspection may

12266

# find a surrogate that does not correspond to an actual identifier.

12267

# Therefore, choose your custom infoType name carefully after considering

12268

# what your data looks like. One way to select a name that has a high chance

12269

# of yielding reliable detection is to include one or more unicode characters

12270

# that are highly improbable to exist in your data.

12271

# For example, assuming your data is entered from a regular ASCII keyboard,

12272

# the symbol with the hex code point 29DD might be used like so:

12273

# ⧝MY_TOKEN_TYPE

12274

"name": "A String", # Name of the information type. Either a name of your choosing when

12275

# creating a CustomInfoType, or one of the names listed

12276

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12277

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

12278

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12279

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12280

"radix": 42, # The native way to select the alphabet. Must be in the range [2, 95].

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12281

"context": { # General identifier of a data field in a storage service. # The 'tweak', a context may be used for higher security since the same

12282

# identifier in two different contexts won't be given the same surrogate. If

12283

# the context is not set, a default tweak will be used.

12284

#

12285

# If the context is set but:

12286

#

12287

# 1. there is no record present when transforming a given value or

12288

# 1. the field is not present when transforming a given value,

12289

#

12290

# a default tweak will be used.

12291

#

12292

# Note that case (1) is expected when an `InfoTypeTransformation` is

12293

# applied to both structured and non-structured `ContentItem`s.

12294

# Currently, the referenced field may be of value type integer or string.

12295

#

12296

# The tweak is constructed as a sequence of bytes in big endian byte order

12297

# such that:

12298

#

12299

# - a 64 bit integer is encoded followed by a single byte of value 1

12300

# - a string is encoded in UTF-8 format followed by a single byte of value 2

12301

"name": "A String", # Name describing the field.

12302

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12303

"customAlphabet": "A String", # This is supported by mapping these to the alphanumeric characters

12304

# that the FFX mode natively supports. This happens before/after

12305

# encryption/decryption.

12306

# Each character listed must appear only once.

12307

# Number of characters must be in the range [2, 95].

12308

# This must be encoded as ASCII.

12309

# The order of characters does not matter.

12310

# The full list of allowed characters is:

12311

# <code>0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz

12312

# ~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/</code>

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12313

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # Required. The key used by the encryption algorithm.

12314

# a key encryption key (KEK) stored by KMS).

12315

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

12316

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

12317

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12318

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

12319

# It will be discarded after the request finishes.

12320

"name": "A String", # Required. Name of the key.

12321

# This is an arbitrary string used to differentiate different keys.

12322

# A unique key is generated per name: two separate `TransientCryptoKey`

12323

# protos share the same generated key if their names are the same.

12324

# When the data crypto key is generated, this name is not used in any way

12325

# (repeating the api call will result in a different key being generated).

12326

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12327

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

12328

# The wrapped key must be a 128/192/256 bit key.

12329

# Authorization requires the following IAM permissions when sending a request

12330

# to perform a crypto transformation using a kms-wrapped crypto key:

12331

# dlp.kms.encrypt

12332

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

12333

"wrappedKey": "A String", # Required. The wrapped data crypto key.

12334

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12335

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

12336

# leaking the key. Choose another type of key if possible.

12337

"key": "A String", # Required. A 128/192/256 bit key.

12338

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12339

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12340

"commonAlphabet": "A String", # Common alphabets.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12341

},

12342

"cryptoDeterministicConfig": { # Pseudonymization method that generates deterministic encryption for the given # Deterministic Crypto

12343

# input. Outputs a base64 encoded representation of the encrypted output.

12344

# Uses AES-SIV based on the RFC https://tools.ietf.org/html/rfc5297.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12345

"context": { # General identifier of a data field in a storage service. # A context may be used for higher security and maintaining

12346

# referential integrity such that the same identifier in two different

12347

# contexts will be given a distinct surrogate. The context is appended to

12348

# plaintext value being encrypted. On decryption the provided context is

12349

# validated against the value used during encryption. If a context was

12350

# provided during encryption, same context must be provided during decryption

12351

# as well.

12352

#

12353

# If the context is not set, plaintext would be used as is for encryption.

12354

# If the context is set but:

12355

#

12356

# 1. there is no record present when transforming a given value or

12357

# 2. the field is not present when transforming a given value,

12358

#

12359

# plaintext would be used as is for encryption.

12360

#

12361

# Note that case (1) is expected when an `InfoTypeTransformation` is

12362

# applied to both structured and non-structured `ContentItem`s.

12363

"name": "A String", # Name describing the field.

12364

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12365

"surrogateInfoType": { # Type of information detected by the API. # The custom info type to annotate the surrogate with.

12366

# This annotation will be applied to the surrogate by prefixing it with

12367

# the name of the custom info type followed by the number of

12368

# characters comprising the surrogate. The following scheme defines the

12369

# format: {info type name}({surrogate character count}):{surrogate}

12370

#

12371

# For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and

12372

# the surrogate is 'abc', the full replacement value

12373

# will be: 'MY_TOKEN_INFO_TYPE(3):abc'

12374

#

12375

# This annotation identifies the surrogate when inspecting content using the

12376

# custom info type 'Surrogate'. This facilitates reversal of the

12377

# surrogate when it occurs in free text.

12378

#

12379

# Note: For record transformations where the entire cell in a table is being

12380

# transformed, surrogates are not mandatory. Surrogates are used to denote

12381

# the location of the token and are necessary for re-identification in free

12382

# form text.

12383

#

12384

# In order for inspection to work properly, the name of this info type must

12385

# not occur naturally anywhere in your data; otherwise, inspection may either

12386

#

12387

# - reverse a surrogate that does not correspond to an actual identifier

12388

# - be unable to parse the surrogate and result in an error

12389

#

12390

# Therefore, choose your custom info type name carefully after considering

12391

# what your data looks like. One way to select a name that has a high chance

12392

# of yielding reliable detection is to include one or more unicode characters

12393

# that are highly improbable to exist in your data.

12394

# For example, assuming your data is entered from a regular ASCII keyboard,

12395

# the symbol with the hex code point 29DD might be used like so:

12396

# ⧝MY_TOKEN_TYPE.

12397

"name": "A String", # Name of the information type. Either a name of your choosing when

12398

# creating a CustomInfoType, or one of the names listed

12399

# at https://cloud.google.com/dlp/docs/infotypes-reference when specifying

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12400

# a built-in type. When sending Cloud DLP results to Data Catalog, infoType

12401

# names should conform to the pattern `[A-Za-z0-9$-_]{1,64}`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12402

},

12403

"cryptoKey": { # This is a data encryption key (DEK) (as opposed to # The key used by the encryption function.

12404

# a key encryption key (KEK) stored by KMS).

12405

# When using KMS to wrap/unwrap DEKs, be sure to set an appropriate

12406

# IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot

12407

# unwrap the data crypto key.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12408

"transient": { # Use this to have a random data crypto key generated. # Transient crypto key

12409

# It will be discarded after the request finishes.

12410

"name": "A String", # Required. Name of the key.

12411

# This is an arbitrary string used to differentiate different keys.

12412

# A unique key is generated per name: two separate `TransientCryptoKey`

12413

# protos share the same generated key if their names are the same.

12414

# When the data crypto key is generated, this name is not used in any way

12415

# (repeating the api call will result in a different key being generated).

12416

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12417

"kmsWrapped": { # Include to use an existing data crypto key wrapped by KMS. # Kms wrapped key

12418

# The wrapped key must be a 128/192/256 bit key.

12419

# Authorization requires the following IAM permissions when sending a request

12420

# to perform a crypto transformation using a kms-wrapped crypto key:

12421

# dlp.kms.encrypt

12422

"cryptoKeyName": "A String", # Required. The resource name of the KMS CryptoKey to use for unwrapping.

12423

"wrappedKey": "A String", # Required. The wrapped data crypto key.

12424

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12425

"unwrapped": { # Using raw keys is prone to security risks due to accidentally # Unwrapped crypto key

12426

# leaking the key. Choose another type of key if possible.

12427

"key": "A String", # Required. A 128/192/256 bit key.

12428

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12429

},

12430

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12431

"bucketingConfig": { # Generalization function that buckets values based on ranges. The ranges and # Bucketing

12432

# replacement values are dynamically provided by the user for custom behavior,

12433

# such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH

12434

# This can be used on

12435

# data of type: number, long, string, timestamp.

12436

# If the bound `Value` type differs from the type of data being transformed, we

12437

# will first attempt converting the type of the data to be transformed to match

12438

# the type of the bound before comparing.

12439

# See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.

12440

"buckets": [ # Set of buckets. Ranges must be non-overlapping.

12441

{ # Bucket is represented as a range, along with replacement values.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12442

"max": { # Set of primitive values supported by the system. # Upper bound of the range, exclusive; type must match min.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12443

# Note that for the purposes of inspection or transformation, the number

12444

# of bytes considered to comprise a 'Value' is based on its representation

12445

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

12446

# 123456789, the number of bytes would be counted as 9, even though an

12447

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12448

"integerValue": "A String", # integer

12449

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

12450

# or are specified elsewhere. An API may choose to allow leap seconds. Related

12451

# types are google.type.Date and `google.protobuf.Timestamp`.

12452

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

12453

# allow the value 60 if it allows leap-seconds.

12454

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

12455

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

12456

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

12457

# to allow the value "24:00:00" for scenarios like business closing time.

12458

},

12459

"dayOfWeekValue": "A String", # day of week

12460

"floatValue": 3.14, # float

12461

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12462

"timestampValue": "A String", # timestamp

12463

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

12464

# and time zone are either specified elsewhere or are not significant. The date

12465

# is relative to the Proleptic Gregorian Calendar. This can represent:

12466

#

12467

# * A full date, with non-zero year, month and day values

12468

# * A month and day value, with a zero year, e.g. an anniversary

12469

# * A year on its own, with zero month and day values

12470

# * A year and month value, with a zero day, e.g. a credit card expiration date

12471

#

12472

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12473

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

12474

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12475

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

12476

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12477

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

12478

# if specifying a year by itself or a year and month where the day is not

12479

# significant.

12480

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12481

"booleanValue": True or False, # boolean

12482

},

12483

"replacementValue": { # Set of primitive values supported by the system. # Required. Replacement value for this bucket.

12484

# Note that for the purposes of inspection or transformation, the number

12485

# of bytes considered to comprise a 'Value' is based on its representation

12486

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

12487

# 123456789, the number of bytes would be counted as 9, even though an

12488

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12489

"integerValue": "A String", # integer

12490

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

12491

# or are specified elsewhere. An API may choose to allow leap seconds. Related

12492

# types are google.type.Date and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12493

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

12494

# allow the value 60 if it allows leap-seconds.

12495

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12496

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

12497

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

12498

# to allow the value "24:00:00" for scenarios like business closing time.

12499

},

12500

"dayOfWeekValue": "A String", # day of week

12501

"floatValue": 3.14, # float

12502

"stringValue": "A String", # string

12503

"timestampValue": "A String", # timestamp

12504

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

12505

# and time zone are either specified elsewhere or are not significant. The date

12506

# is relative to the Proleptic Gregorian Calendar. This can represent:

12507

#

12508

# * A full date, with non-zero year, month and day values

12509

# * A month and day value, with a zero year, e.g. an anniversary

12510

# * A year on its own, with zero month and day values

12511

# * A year and month value, with a zero day, e.g. a credit card expiration date

12512

#

12513

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

12514

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

12515

# month and day.

12516

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

12517

# a year.

12518

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

12519

# if specifying a year by itself or a year and month where the day is not

12520

# significant.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12521

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12522

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12523

},

12524

"min": { # Set of primitive values supported by the system. # Lower bound of the range, inclusive. Type should be the same as max if

12525

# used.

12526

# Note that for the purposes of inspection or transformation, the number

12527

# of bytes considered to comprise a 'Value' is based on its representation

12528

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

12529

# 123456789, the number of bytes would be counted as 9, even though an

12530

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12531

"integerValue": "A String", # integer

12532

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

12533

# or are specified elsewhere. An API may choose to allow leap seconds. Related

12534

# types are google.type.Date and `google.protobuf.Timestamp`.

12535

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

12536

# allow the value 60 if it allows leap-seconds.

12537

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

12538

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

12539

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

12540

# to allow the value "24:00:00" for scenarios like business closing time.

12541

},

12542

"dayOfWeekValue": "A String", # day of week

12543

"floatValue": 3.14, # float

12544

"stringValue": "A String", # string

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12545

"timestampValue": "A String", # timestamp

12546

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

12547

# and time zone are either specified elsewhere or are not significant. The date

12548

# is relative to the Proleptic Gregorian Calendar. This can represent:

12549

#

12550

# * A full date, with non-zero year, month and day values

12551

# * A month and day value, with a zero year, e.g. an anniversary

12552

# * A year on its own, with zero month and day values

12553

# * A year and month value, with a zero day, e.g. a credit card expiration date

12554

#

12555

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12556

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

12557

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12558

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

12559

# a year.

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12560

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

12561

# if specifying a year by itself or a year and month where the day is not

12562

# significant.

12563

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12564

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

},

],

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12569

},

12570

"condition": { # A condition for determining whether a transformation should be applied to # Only apply the transformation if the condition evaluates to true for the

12571

# given `RecordCondition`. The conditions are allowed to reference fields

12572

# that are not used in the actual transformation.

#

# Example Use Cases:

#

# - Apply a different bucket transformation to an age column if the zip code

12577

# column for the same record is within a specific range.

12578

# - Redact a field if the date of birth field is greater than 85.

12579

# a field.

12580

"expressions": { # An expression, consisting or an operator and conditions. # An expression.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12581

"conditions": { # A collection of conditions. # Conditions to apply to the expression.

12582

"conditions": [ # A collection of conditions.

12583

{ # The field type of `value` and `field` do not need to match to be

12584

# considered equal, but not all comparisons are possible.

12585

# EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,

12586

# but all other comparisons are invalid with incompatible types.

12587

# A `value` of type:

12588

#

12589

# - `string` can be compared against all other types

12590

# - `boolean` can only be compared against other booleans

12591

# - `integer` can be compared against doubles or a string if the string value

12592

# can be parsed as an integer.

12593

# - `double` can be compared against integers or a string if the string can

12594

# be parsed as a double.

12595

# - `Timestamp` can be compared against strings in RFC 3339 date string

12596

# format.

12597

# - `TimeOfDay` can be compared against timestamps and strings in the format

12598

# of 'HH:mm:ss'.

12599

#

12600

# If we fail to compare do to type mismatch, a warning will be given and

12601

# the condition will evaluate to false.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12602

"field": { # General identifier of a data field in a storage service. # Required. Field within the record this condition is evaluated against.

12603

"name": "A String", # Name describing the field.

12604

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12605

"value": { # Set of primitive values supported by the system. # Value to compare against. [Mandatory, except for `EXISTS` tests.]

12606

# Note that for the purposes of inspection or transformation, the number

12607

# of bytes considered to comprise a 'Value' is based on its representation

12608

# as a UTF-8 encoded string. For example, if 'integer_value' is set to

12609

# 123456789, the number of bytes would be counted as 9, even though an

12610

# int64 only holds up to 8 bytes of data.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12611

"integerValue": "A String", # integer

12612

"timeValue": { # Represents a time of day. The date and time zone are either not significant # time of day

12613

# or are specified elsewhere. An API may choose to allow leap seconds. Related

12614

# types are google.type.Date and `google.protobuf.Timestamp`.

12615

"seconds": 42, # Seconds of minutes of the time. Must normally be from 0 to 59. An API may

12616

# allow the value 60 if it allows leap-seconds.

12617

"nanos": 42, # Fractions of seconds in nanoseconds. Must be from 0 to 999,999,999.

12618

"minutes": 42, # Minutes of hour of day. Must be from 0 to 59.

12619

"hours": 42, # Hours of day in 24 hour format. Should be from 0 to 23. An API may choose

12620

# to allow the value "24:00:00" for scenarios like business closing time.

12621

},

12622

"dayOfWeekValue": "A String", # day of week

12623

"floatValue": 3.14, # float

12624

"stringValue": "A String", # string

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12625

"timestampValue": "A String", # timestamp

12626

"dateValue": { # Represents a whole or partial calendar date, e.g. a birthday. The time of day # date

12627

# and time zone are either specified elsewhere or are not significant. The date

12628

# is relative to the Proleptic Gregorian Calendar. This can represent:

12629

#

12630

# * A full date, with non-zero year, month and day values

12631

# * A month and day value, with a zero year, e.g. an anniversary

12632

# * A year on its own, with zero month and day values

12633

# * A year and month value, with a zero day, e.g. a credit card expiration date

12634

#

12635

# Related types are google.type.TimeOfDay and `google.protobuf.Timestamp`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12636

"month": 42, # Month of year. Must be from 1 to 12, or 0 if specifying a year without a

12637

# month and day.

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12638

"year": 42, # Year of date. Must be from 1 to 9999, or 0 if specifying a date without

12639

# a year.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12640

"day": 42, # Day of month. Must be from 1 to 31 and valid for the year and month, or 0

12641

# if specifying a year by itself or a year and month where the day is not

12642

# significant.

12643

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12644

"booleanValue": True or False, # boolean

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12645

},

12646

"operator": "A String", # Required. Operator used to compare the field or infoType to the value.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12647

},

12648

],

12649

},

Bu Sun Kim

2020-05-27 12:20:54 -0700

[diff] [blame]

12650

"logicalOperator": "A String", # The operator to apply to the result of conditions. Default and currently

12651

# only supported value is `AND`.

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12652

},

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

12653

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12654

"fields": [ # Required. Input field(s) to apply the transformation to.

12655

{ # General identifier of a data field in a storage service.

12656

"name": "A String", # Name describing the field.

12657

},

12658

],

Bu Sun Kim

2020-05-20 12:08:20 -0700

[diff] [blame]

},

],

},

},

Bu Sun Kim

2020-07-22 17:02:09 -0700

[diff] [blame^]

12663

"createTime": "A String", # Output only. The creation timestamp of an inspectTemplate.

12664

"updateTime": "A String", # Output only. The last update timestamp of an inspectTemplate.

12665

"description": "A String", # Short description (max 256 chars).

12666

"displayName": "A String", # Display name (max 256 chars).

Bu Sun Kim