Demonstrates masking characters.
Explore further
For detailed documentation that includes this code sample, see the following:
Code sample
C#
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries .
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment .
using
System
;
using
Google.Api.Gax.ResourceNames
;
using
Google.Cloud.Dlp.V2
;
public
class
DeidentifyWithMasking
{
public
static
DeidentifyContentResponse
Deidentify
(
string
projectId
,
string
text
)
{
// Instantiate a client.
var
dlp
=
DlpServiceClient
.
Create
();
// Construct a request.
var
transformation
=
new
InfoTypeTransformations
.
Types
.
InfoTypeTransformation
{
PrimitiveTransformation
=
new
PrimitiveTransformation
{
CharacterMaskConfig
=
new
CharacterMaskConfig
{
MaskingCharacter
=
"*"
,
NumberToMask
=
5
,
ReverseOrder
=
false
,
}
}
};
var
request
=
new
DeidentifyContentRequest
{
Parent
=
new
LocationName
(
projectId
,
"global"
).
ToString
(),
InspectConfig
=
new
InspectConfig
{
InfoTypes
=
{
new
InfoType
{
Name
=
"US_SOCIAL_SECURITY_NUMBER"
}
}
},
DeidentifyConfig
=
new
DeidentifyConfig
{
InfoTypeTransformations
=
new
InfoTypeTransformations
{
Transformations
=
{
transformation
}
}
},
Item
=
new
ContentItem
{
Value
=
text
}
};
// Call the API.
var
response
=
dlp
.
DeidentifyContent
(
request
);
// Inspect the results.
Console
.
WriteLine
(
$"Deidentified content: {response.Item. Value
}"
);
return
response
;
}
}
Go
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries .
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment .
import
(
"context"
"fmt"
"io"
dlp
"cloud.google.com/go/dlp/apiv2"
"cloud.google.com/go/dlp/apiv2/dlppb"
)
// mask deidentifies the input by masking all provided info types with maskingCharacter
// and prints the result to w.
func
mask
(
w
io
.
Writer
,
projectID
,
input
string
,
infoTypeNames
[]
string
,
maskingCharacter
string
,
numberToMask
int32
)
error
{
// projectID := "my-project-id"
// input := "My SSN is 111222333"
// infoTypeNames := []string{"US_SOCIAL_SECURITY_NUMBER"}
// maskingCharacter := "+"
// numberToMask := 6
// Will print "My SSN is ++++++333"
ctx
:=
context
.
Background
()
client
,
err
:=
dlp
.
NewClient
(
ctx
)
if
err
!=
nil
{
return
fmt
.
Errorf
(
"dlp.NewClient: %w"
,
err
)
}
defer
client
.
Close
()
// Convert the info type strings to a list of InfoTypes.
var
infoTypes
[]
*
dlppb
.
InfoType
for
_
,
it
:=
range
infoTypeNames
{
infoTypes
=
append
(
infoTypes
,
& dlppb
.
InfoType
{
Name
:
it
})
}
// Create a configured request.
req
:=
& dlppb
.
DeidentifyContentRequest
{
Parent
:
fmt
.
Sprintf
(
"projects/%s/locations/global"
,
projectID
),
InspectConfig
:
& dlppb
.
InspectConfig
{
InfoTypes
:
infoTypes
,
},
DeidentifyConfig
:
& dlppb
.
DeidentifyConfig
{
Transformation
:
& dlppb
.
DeidentifyConfig_InfoTypeTransformations
{
InfoTypeTransformations
:
& dlppb
.
InfoTypeTransformations
{
Transformations
:
[]
*
dlppb
.
InfoTypeTransformations_InfoTypeTransformation
{
{
InfoTypes
:
[]
*
dlppb
.
InfoType
{},
// Match all info types.
PrimitiveTransformation
:
& dlppb
.
PrimitiveTransformation
{
Transformation
:
& dlppb
.
PrimitiveTransformation_CharacterMaskConfig
{
CharacterMaskConfig
:
& dlppb
.
CharacterMaskConfig
{
MaskingCharacter
:
maskingCharacter
,
NumberToMask
:
numberToMask
,
},
},
},
},
},
},
},
},
// The item to analyze.
Item
:
& dlppb
.
ContentItem
{
DataItem
:
& dlppb
.
ContentItem_Value
{
Value
:
input
,
},
},
}
// Send the request.
r
,
err
:=
client
.
DeidentifyContent
(
ctx
,
req
)
if
err
!=
nil
{
return
fmt
.
Errorf
(
"DeidentifyContent: %w"
,
err
)
}
// Print the result.
fmt
.
Fprint
(
w
,
r
.
GetItem
().
GetValue
())
return
nil
}
Java
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries .
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment .
import
com.google.cloud.dlp.v2. DlpServiceClient
;
import
com.google.privacy.dlp.v2. CharacterMaskConfig
;
import
com.google.privacy.dlp.v2. ContentItem
;
import
com.google.privacy.dlp.v2. DeidentifyConfig
;
import
com.google.privacy.dlp.v2. DeidentifyContentRequest
;
import
com.google.privacy.dlp.v2. DeidentifyContentResponse
;
import
com.google.privacy.dlp.v2. InfoType
;
import
com.google.privacy.dlp.v2. InfoTypeTransformations
;
import
com.google.privacy.dlp.v2. InfoTypeTransformations
. InfoTypeTransformation
;
import
com.google.privacy.dlp.v2. InspectConfig
;
import
com.google.privacy.dlp.v2. LocationName
;
import
com.google.privacy.dlp.v2. PrimitiveTransformation
;
import
java.io.IOException
;
import
java.util.Arrays
;
public
class
DeIdentifyWithMasking
{
public
static
void
main
(
String
[]
args
)
throws
Exception
{
// TODO(developer): Replace these variables before running the sample.
String
projectId
=
"your-project-id"
;
String
textToDeIdentify
=
"My SSN is 372819127"
;
deIdentifyWithMasking
(
projectId
,
textToDeIdentify
);
}
public
static
void
deIdentifyWithMasking
(
String
projectId
,
String
textToDeIdentify
)
throws
IOException
{
// Initialize client that will be used to send requests. This client only needs to be created
// once, and can be reused for multiple requests. After completing all of your requests, call
// the "close" method on the client to safely clean up any remaining background resources.
try
(
DlpServiceClient
dlp
=
DlpServiceClient
.
create
())
{
// Specify what content you want the service to DeIdentify
ContentItem
contentItem
=
ContentItem
.
newBuilder
().
setValue
(
textToDeIdentify
).
build
();
// Specify the type of info the inspection will look for.
// See https://cloud.google.com/dlp/docs/infotypes-reference for complete list of info types
InfoType
infoType
=
InfoType
.
newBuilder
().
setName
(
"US_SOCIAL_SECURITY_NUMBER"
).
build
();
InspectConfig
inspectConfig
=
InspectConfig
.
newBuilder
().
addAllInfoTypes
(
Arrays
.
asList
(
infoType
)).
build
();
// Specify how the info from the inspection should be masked.
CharacterMaskConfig
characterMaskConfig
=
CharacterMaskConfig
.
newBuilder
()
.
setMaskingCharacter
(
"X"
)
// Character to replace the found info with
.
setNumberToMask
(
5
)
// How many characters should be masked
.
build
();
PrimitiveTransformation
primitiveTransformation
=
PrimitiveTransformation
.
newBuilder
()
.
setCharacterMaskConfig
(
characterMaskConfig
)
.
build
();
InfoTypeTransformation
infoTypeTransformation
=
InfoTypeTransformation
.
newBuilder
()
.
setPrimitiveTransformation
(
primitiveTransformation
)
.
build
();
InfoTypeTransformations
transformations
=
InfoTypeTransformations
.
newBuilder
().
addTransformations
(
infoTypeTransformation
).
build
();
DeidentifyConfig
deidentifyConfig
=
DeidentifyConfig
.
newBuilder
().
setInfoTypeTransformations
(
transformations
).
build
();
// Combine configurations into a request for the service.
DeidentifyContentRequest
request
=
DeidentifyContentRequest
.
newBuilder
()
.
setParent
(
LocationName
.
of
(
projectId
,
"global"
).
toString
())
.
setItem
(
contentItem
)
.
setInspectConfig
(
inspectConfig
)
.
setDeidentifyConfig
(
deidentifyConfig
)
.
build
();
// Send the request and receive response from the service
DeidentifyContentResponse
response
=
dlp
.
deidentifyContent
(
request
);
// Print the results
System
.
out
.
println
(
"Text after masking: "
+
response
.
getItem
().
getValue
());
}
}
}
Node.js
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries .
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment .
// Imports the Google Cloud Data Loss Prevention library
const
DLP
=
require
(
' @google-cloud/dlp
'
);
// Instantiates a client
const
dlp
=
new
DLP
.
DlpServiceClient
();
// The project ID to run the API call under
// const projectId = 'my-project-id';
// The string to deidentify
// const string = 'My SSN is 372819127';
// (Optional) The maximum number of sensitive characters to mask in a match
// If omitted from the request or set to 0, the API will mask any matching characters
// const numberToMask = 5;
// (Optional) The character to mask matching sensitive data with
// const maskingCharacter = 'x';
// Construct deidentification request
const
item
=
{
value
:
string
};
async
function
deidentifyWithMask
()
{
const
request
=
{
parent
:
`projects/
${
projectId
}
/locations/global`
,
deidentifyConfig
:
{
infoTypeTransformations
:
{
transformations
:
[
{
primitiveTransformation
:
{
characterMaskConfig
:
{
maskingCharacter
:
maskingCharacter
,
numberToMask
:
numberToMask
,
},
},
},
],
},
},
item
:
item
,
};
// Run deidentification request
const
[
response
]
=
await
dlp
.
deidentifyContent
(
request
);
const
deidentifiedItem
=
response
.
item
;
console
.
log
(
deidentifiedItem
.
value
);
}
deidentifyWithMask
();
PHP
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries .
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment .
use Google\Cloud\Dlp\V2\CharacterMaskConfig;
use Google\Cloud\Dlp\V2\Client\DlpServiceClient;
use Google\Cloud\Dlp\V2\ContentItem;
use Google\Cloud\Dlp\V2\DeidentifyConfig;
use Google\Cloud\Dlp\V2\DeidentifyContentRequest;
use Google\Cloud\Dlp\V2\InfoType;
use Google\Cloud\Dlp\V2\InfoTypeTransformations;
use Google\Cloud\Dlp\V2\InfoTypeTransformations\InfoTypeTransformation;
use Google\Cloud\Dlp\V2\PrimitiveTransformation;
/**
* Deidentify sensitive data in a string by masking it with a character.
*
* @param string $callingProjectId The GCP Project ID to run the API call under
* @param string $string The string to deidentify
* @param int $numberToMask (Optional) The maximum number of sensitive characters to mask in a match
* @param string $maskingCharacter (Optional) The character to mask matching sensitive data with (defaults to "x")
*/
function deidentify_mask(
string $callingProjectId,
string $string,
int $numberToMask = 0,
string $maskingCharacter = 'x'
): void {
// Instantiate a client.
$dlp = new DlpServiceClient();
// The infoTypes of information to mask
$ssnInfoType = (new InfoType())
->setName('US_SOCIAL_SECURITY_NUMBER');
$infoTypes = [$ssnInfoType];
// Create the masking configuration object
$maskConfig = (new CharacterMaskConfig())
->setMaskingCharacter($maskingCharacter)
->setNumberToMask($numberToMask);
// Create the information transform configuration objects
$primitiveTransformation = (new PrimitiveTransformation())
->setCharacterMaskConfig($maskConfig);
$infoTypeTransformation = (new InfoTypeTransformation())
->setPrimitiveTransformation($primitiveTransformation)
->setInfoTypes($infoTypes);
$infoTypeTransformations = (new InfoTypeTransformations())
->setTransformations([$infoTypeTransformation]);
// Create the deidentification configuration object
$deidentifyConfig = (new DeidentifyConfig())
->setInfoTypeTransformations($infoTypeTransformations);
$item = (new ContentItem())
->setValue($string);
$parent = "projects/$callingProjectId/locations/global";
// Run request
$deidentifyContentRequest = (new DeidentifyContentRequest())
->setParent($parent)
->setDeidentifyConfig($deidentifyConfig)
->setItem($item);
$response = $dlp->deidentifyContent($deidentifyContentRequest);
// Print the results
$deidentifiedValue = $response->getItem()->getValue();
print($deidentifiedValue);
}
Python
To learn how to install and use the client library for Sensitive Data Protection, see Sensitive Data Protection client libraries .
To authenticate to Sensitive Data Protection, set up Application Default Credentials. For more information, see Set up authentication for a local development environment .
from
typing
import
List
import
google.cloud.dlp
def
deidentify_with_mask
(
project
:
str
,
input_str
:
str
,
info_types
:
List
[
str
],
masking_character
:
str
=
None
,
number_to_mask
:
int
=
0
,
)
-
> None
:
"""Uses the Data Loss Prevention API to deidentify sensitive data in a
string by masking it with a character.
Args:
project: The Google Cloud project id to use as a parent resource.
input_str: The string to deidentify (will be treated as text).
info_types: A list of strings representing info types to look for.
A full list of info type categories can be fetched from the API.
masking_character: The character to mask matching sensitive data with.
number_to_mask: The maximum number of sensitive characters to mask in
a match. If omitted or set to zero, the API will default to no
maximum.
Returns:
None; the response from the API is printed to the terminal.
"""
# Instantiate a client
dlp
=
google
.
cloud
.
dlp_v2
.
DlpServiceClient
()
# Convert the project id into a full resource id.
parent
=
f
"projects/
{
project
}
/locations/global"
# Construct inspect configuration dictionary
inspect_config
=
{
"info_types"
:
[{
"name"
:
info_type
}
for
info_type
in
info_types
]}
# Construct deidentify configuration dictionary
deidentify_config
=
{
"info_type_transformations"
:
{
"transformations"
:
[
{
"primitive_transformation"
:
{
"character_mask_config"
:
{
"masking_character"
:
masking_character
,
"number_to_mask"
:
number_to_mask
,
}
}
}
]
}
}
# Construct item
item
=
{
"value"
:
input_str
}
# Call the API
response
=
dlp
.
deidentify_content
(
request
=
{
"parent"
:
parent
,
"deidentify_config"
:
deidentify_config
,
"inspect_config"
:
inspect_config
,
"item"
:
item
,
}
)
# Print out the results.
print
(
response
.
item
.
value
)
What's next
To search and filter code samples for other Google Cloud products, see the Google Cloud sample browser .
