v2

0-9

A-Z

a-z

US Punctuation, one of !"#$%&'()*+,-./:;<=>?@[]^_`{|}~

Whitespace character, one of [ \t\n\x0B\f\r]

Includes entire content of a file or a data stream.

Text content within the data, excluding any metadata.

Images found in the data.

The job inspected Google Cloud for sensitive data.

The job executed a Risk Analysis computation.

A finding of this custom info type will not be excluded from results.

A finding of this custom info type will be excluded from final results, but can still affect rule execution.

[0-9] (radix of 10)

[0-9A-F] (radix of 16)

[0-9A-Z] (radix of 36)

[0-9A-Za-z] (radix of 62)

Includes all files.

Includes all file extensions not covered by text file types.

Included file extensions: asc, brf, c, cc, cpp, csv, cxx, c++, cs, css, dart, eml, go, h, hh, hpp, hxx, h++, hs, html, htm, shtml, shtm, xhtml, lhs, ini, java, js, json, ocaml, md, mkd, markdown, m, ml, mli, pl, pm, php, phtml, pht, py, pyw, rb, rbw, rs, rc, scala, sh, sql, tex, txt, text, tsv, vcard, vcs, wml, xml, xsl, xsd, yml, yaml.

Included file extensions: bmp, gif, jpg, jpeg, jpe, png. bytes_limit_per_file has no effect on image files.

Included file extensions: avro

Supported by the inspect operations.

Supported by the risk analysis operations.

The job has not yet started.

The job is currently running.

The job is no longer running.

The job was canceled before it could complete.

The job had an error and did not complete.

Default value; same as POSSIBLE.

Few matching elements.

Some matching elements.

Many matching elements.

Invalid.

Full match.

• Dictionary: join of Dictionary results matched complete finding quote
• Regex: all regex matches fill a finding quote start to end
• Exclude info type: completely inside affecting info types findings

Partial match.

• Dictionary: at least one of the tokens in the finding matches
• Regex: substring of the finding matches
• Exclude info type: intersects with affecting info types findings

Inverse match.

• Dictionary: no tokens in the finding match the dictionary
• Regex: finding doesn't match the regex
• Exclude info type: no intersection with affecting info types findings

Basic schema including only info_type, quote, certainty, and timestamp.

Schema tailored to findings from scanning Google Cloud Storage.

Schema tailored to findings from scanning Google Datastore.

Schema tailored to findings from scanning Google BigQuery.

Schema containing all columns.

Equal. Attempts to match even with incompatible types.

Not equal to. Attempts to match even with incompatible types.

Greater than.

Less than.

Greater than or equals.

Less than or equals.

Exists

Scan from the top (default).

For each file larger than bytes_limit_per_file, randomly pick the offset to start scanning. The scanned bytes are contiguous.

Scan from the top (default).

Randomly pick the row to start scanning. The scanned rows are contiguous.

Trigger is healthy.

Trigger is temporarily paused.

Trigger is cancelled and can not be resumed.

StoredInfoType version is being created.

StoredInfoType version is ready for use.

StoredInfoType creation failed. All relevant error messages are returned in the StoredInfoTypeVersion message.

StoredInfoType is no longer valid because artifacts stored in user-controlled storage were modified. To fix an invalid StoredInfoType, use the UpdateStoredInfoType method to create a new version.

[0-9999]

[1-12]

[1-31]

[1-7]

[1-52]

[0-23]

Save resulting findings in a provided location.

This object should have the same structure as SaveFindings

Publish a notification to a pubsub topic.

This object should have the same structure as PublishToPubSub

Publish summary to Cloud Security Command Center (Alpha).

This object should have the same structure as PublishSummaryToCscc

Publish findings to Cloud Datahub.

This object should have the same structure as PublishFindingsToCloudDataCatalog

Enable email notification to project owners and editors on job's completion/failure.

This object should have the same structure as JobNotificationEmails

Resource name of the trigger to activate, for example projects/dlp-test-project/jobTriggers/53234423.

Privacy metric to compute.

This object should have the same structure as PrivacyMetric

Input dataset to compute metrics over.

This object should have the same structure as BigQueryTable

This object should have the same structure as NumericalStatsResult

This object should have the same structure as CategoricalStatsResult

This object should have the same structure as KAnonymityResult

This object should have the same structure as LDiversityResult

This object should have the same structure as KMapEstimationResult

This object should have the same structure as DeltaPresenceEstimationResult

Auxiliary table location. [required]

This object should have the same structure as BigQueryTable

Quasi-identifier columns. [required]

This object should have the same structure as QuasiIdField

The relative frequency column must contain a floating-point number between 0 and 1 (inclusive). Null values are assumed to be zero. [required]

This object should have the same structure as FieldId

Source table of the field.

This object should have the same structure as BigQueryTable

Designated field in the BigQuery table.

This object should have the same structure as FieldId

Complete BigQuery table reference.

This object should have the same structure as BigQueryTable

Absolute number of the row from the beginning of the table at the time of scanning.

Complete BigQuery table reference.

This object should have the same structure as BigQueryTable

References to fields uniquely identifying rows within the table. Nested fields in the format, like person.birthdate.year, are allowed.

This object should have the same structure as FieldId

Max number of rows to scan. If the table has more rows than this value, the rest of the rows are omitted. If not set, or if set to 0, all rows will be scanned. Only one of rows_limit and rows_limit_percent can be specified. Cannot be used in conjunction with TimespanConfig.

Max percentage of rows to scan. The rest are omitted. The number of rows scanned is rounded down. Must be between 0 and 100, inclusively. Both 0 and 100 means no limit. Defaults to 0. Only one of rows_limit and rows_limit_percent can be specified. Cannot be used in conjunction with TimespanConfig.

The number should be among the values of SampleMethod

References to fields excluded from scanning. This allows you to skip inspection of entire columns which you know have no findings.

This object should have the same structure as FieldId

The Google Cloud Platform project ID of the project containing the table. If omitted, project ID is inferred from the API call.

Dataset ID of the table.

Name of the table.

Top coordinate of the bounding box. (0,0) is upper left.

Left coordinate of the bounding box. (0,0) is upper left.

Width of the bounding box in pixels.

Height of the bounding box in pixels.

Lower bound of the range, inclusive. Type should be the same as max if used.

This object should have the same structure as Value

Upper bound of the range, exclusive; type must match min.

This object should have the same structure as Value

Replacement value for this bucket. If not provided the default behavior will be to hyphenate the min-max range.

This object should have the same structure as Value

Set of buckets. Ranges must be non-overlapping.

This object should have the same structure as Bucket

The type of data stored in the bytes string. Default will be TEXT_UTF8.

The number should be among the values of BytesType

Content data to inspect or redact.

The name of the DlpJob resource to be cancelled.

Field to compute categorical stats on. All column types are supported except for arrays and structs. However, it may be more informative to use NumericalStats when the field type is supported, depending on the data.

This object should have the same structure as FieldId

Lower bound on the value frequency of the values in this bucket.

Upper bound on the value frequency of the values in this bucket.

Total number of values in this bucket.

Sample of value frequencies in this bucket. The total number of values returned per bucket is capped at 20.

This object should have the same structure as ValueFrequency

Total number of distinct values in this bucket.

Histogram of value frequencies in the column.

This object should have the same structure as CategoricalStatsHistogramBucket

Character to mask the sensitive values—for example, "" for an alphabetic string such as name, or "0" for a numeric string such as ZIP code or credit card number. String must have length 1. If not supplied, we will default to "" for strings, 0 for digits.

Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally.

Mask characters in reverse order. For example, if masking_character is '0', number_to_mask is 14, and reverse_order is false, then 1234-5678-9012-3456 -> 00000000000000-3456 If masking_character is '', number_to_mask is 3, and reverse_order is true, then 12345 -> 12**

When masking a string, items in this list will be skipped when replacing. For example, if your string is 555-555-5555 and you ask us to skip - and mask 5 chars with * we would produce ***-*55-5555.

This object should have the same structure as CharsToIgnore

The number should be among the values of CommonCharsToIgnore

The url, in the format gs://<bucket>/<path>. Trailing wildcard in the path is allowed.

The set of one or more files to scan.

This object should have the same structure as FileSet

Max number of bytes to scan from a file. If a scanned file's size is bigger than this value then the rest of the bytes are omitted. Only one of bytes_limit_per_file and bytes_limit_per_file_percent can be specified.

Max percentage of bytes to scan from a file. The rest are omitted. The number of bytes scanned is rounded down. Must be between 0 and 100, inclusively. Both 0 and 100 means no limit. Defaults to 0. Only one of bytes_limit_per_file and bytes_limit_per_file_percent can be specified.

List of file type groups to include in the scan. If empty, all files are scanned and available data format processors are applied. In addition, the binary content of the selected files is always scanned as well.

The number should be among the values of FileType

The number should be among the values of SampleMethod

Limits the number of files to scan to this percentage of the input FileSet. Number of files scanned is rounded down. Must be between 0 and 100, inclusively. Both 0 and 100 means no limit. Defaults to 0.

A url representing a file or path (no wildcards) in Cloud Storage. Example: gs://[BUCKET_NAME]/dictionary.txt

The name of a Cloud Storage bucket. Required.

A list of regular expressions matching file paths to include. All files in the bucket that match at least one of these regular expressions will be included in the set of files, except for those that also match an item in exclude_regex. Leaving this field empty will match all files by default (this is equivalent to including .* in the list).

Regular expressions use RE2 syntax; a guide can be found under the google/re2 repository on GitHub.

A list of regular expressions matching file paths to exclude. All files in the bucket that match at least one of these regular expressions will be excluded from the scan.

Regular expressions use RE2 syntax; a guide can be found under the google/re2 repository on GitHub.

The amount of red in the color as a value in the interval [0, 1].

The amount of green in the color as a value in the interval [0, 1].

The amount of blue in the color as a value in the interval [0, 1].

Field within the record this condition is evaluated against. [required]

This object should have the same structure as FieldId

Operator used to compare the field or infoType to the value. [required]

The number should be among the values of RelationalOperator

Value to compare against. [Required, except for EXISTS tests.]

This object should have the same structure as Value

This object should have the same structure as Condition

String data to inspect or redact.

Structured content for inspection. See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to learn more.

This object should have the same structure as Table

Content data to inspect or redact. Replaces type and data.

This object should have the same structure as ByteContentItem

Name of the container where the finding is located. The top level name is the source file name or table name. Names of some common storage containers are formatted as follows:

• BigQuery tables: <project_id>:<dataset_id>.<table_id>
• Cloud Storage files: gs://<bucket>/<path>
• Datastore namespace:

Nested names could be absent if the embedded object has no string identifier (for an example an image contained within a document).

Location within a row or record of a database table.

This object should have the same structure as RecordLocation

Location within an image's pixels.

This object should have the same structure as ImageLocation

Location data for document files.

This object should have the same structure as DocumentLocation

Findings container modification timestamp, if applicable. For Google Cloud Storage contains last file modification timestamp. For BigQuery table contains last_modified_time property. For Datastore - not populated.

This object should have the same structure as Timestamp

Findings container version, if available ("generation" for Google Cloud Storage).

The parent resource name, for example projects/my-project-id or organizations/my-org-id.

The DeidentifyTemplate to create.

This object should have the same structure as DeidentifyTemplate

The template id can contain uppercase and lowercase letters, numbers, and hyphens; that is, it must match the regular expression: [a-zA-Z\\d-_]+. The maximum length is 100 characters. Can be empty to allow the system to generate one.

The parent resource name, for example projects/my-project-id.

This object should have the same structure as InspectJobConfig

This object should have the same structure as RiskAnalysisJobConfig

The job id can contain uppercase and lowercase letters, numbers, and hyphens; that is, it must match the regular expression: [a-zA-Z\\d-_]+. The maximum length is 100 characters. Can be empty to allow the system to generate one.

The parent resource name, for example projects/my-project-id or organizations/my-org-id.

The InspectTemplate to create.

This object should have the same structure as InspectTemplate

The template id can contain uppercase and lowercase letters, numbers, and hyphens; that is, it must match the regular expression: [a-zA-Z\\d-_]+. The maximum length is 100 characters. Can be empty to allow the system to generate one.

The parent resource name, for example projects/my-project-id.

The JobTrigger to create.

This object should have the same structure as JobTrigger

The trigger id can contain uppercase and lowercase letters, numbers, and hyphens; that is, it must match the regular expression: [a-zA-Z\\d-_]+. The maximum length is 100 characters. Can be empty to allow the system to generate one.

The parent resource name, for example projects/my-project-id or organizations/my-org-id.

Configuration of the storedInfoType to create.

This object should have the same structure as StoredInfoTypeConfig

The storedInfoType ID can contain uppercase and lowercase letters, numbers, and hyphens; that is, it must match the regular expression: [a-zA-Z\\d-_]+. The maximum length is 100 characters. Can be empty to allow the system to generate one.

The key used by the encryption function.

This object should have the same structure as CryptoKey

The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: ():

For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc'

This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text.

In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either

• reverse a surrogate that does not correspond to an actual identifier
• be unable to parse the surrogate and result in an error

Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

This object should have the same structure as InfoType

Optional. A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well.

If the context is not set, plaintext would be used as is for encryption. If the context is set but:

1. there is no record present when transforming a given value or
2. the field is not present when transforming a given value,

plaintext would be used as is for encryption.

Note that case (1) is expected when an InfoTypeTransformation is applied to both structured and non-structured ContentItems.

This object should have the same structure as FieldId

The key used by the hash function.

This object should have the same structure as CryptoKey

This object should have the same structure as TransientCryptoKey

This object should have the same structure as UnwrappedCryptoKey

This object should have the same structure as KmsWrappedCryptoKey

The key used by the encryption algorithm. [required]

This object should have the same structure as CryptoKey

The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used.

If the context is set but:

1. there is no record present when transforming a given value or
2. the field is not present when transforming a given value,

a default tweak will be used.

Note that case (1) is expected when an InfoTypeTransformation is applied to both structured and non-structured ContentItems. Currently, the referenced field may be of value type integer or string.

The tweak is constructed as a sequence of bytes in big endian byte order such that:

• a 64 bit integer is encoded followed by a single byte of value 1
• a string is encoded in UTF-8 format followed by a single byte of value 2

This object should have the same structure as FieldId

The number should be among the values of FfxCommonNativeAlphabet

This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range [2, 62]. This must be encoded as ASCII. The order of characters does not matter.

The native way to select the alphabet. Must be in the range [2, 62].

The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: info_type_name(surrogate_character_count):surrogate

For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc'

This annotation identifies the surrogate when inspecting content using the custom infoType SurrogateType. This facilitates reversal of the surrogate when it occurs in free text.

In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE

This object should have the same structure as InfoType

CustomInfoType can either be a new infoType, or an extension of built-in infoType, when the name matches one of existing infoTypes and that infoType is specified in InspectContent.info_types field. Specifying the latter adds findings to the one detected by the system. If built-in info type is not specified in InspectContent.info_types list then the name is treated as a custom info type.

This object should have the same structure as InfoType

Likelihood to return for this CustomInfoType. This base value can be altered by a detection rule if the finding meets the criteria specified by the rule. Defaults to VERY_LIKELY if not specified.

The number should be among the values of Likelihood

A list of phrases to detect as a CustomInfoType.

This object should have the same structure as Dictionary

Regular expression based CustomInfoType.

This object should have the same structure as Regex

Message for detecting output from deidentification transformations that support reversing.

This object should have the same structure as SurrogateType

Load an existing StoredInfoType resource for use in InspectDataSource. Not currently supported in InspectContent.

This object should have the same structure as StoredType

Set of detection rules to apply to all findings of this CustomInfoType. Rules are applied in order that they are specified. Not supported for the surrogate_type CustomInfoType.

This object should have the same structure as DetectionRule

If set to EXCLUSION_TYPE_EXCLUDE this infoType will not cause a finding to be returned. It still can be used for rules matching.

The number should be among the values of ExclusionType

Datastore entity key.

This object should have the same structure as Key

A partition ID identifies a grouping of entities. The grouping is always by project and namespace, however the namespace ID may be empty.

This object should have the same structure as PartitionId

The kind to process.

This object should have the same structure as KindExpression

Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction.

For example, 3 means shift date to at most 3 days into the future. [Required]

For example, -5 means shift date to at most 5 days back in the past. [Required]

Points to the field that contains the context, for example, an entity id. If set, must also set method. If set, shift will be consistent for the given context.

This object should have the same structure as FieldId

Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and crypto_key.

This object should have the same structure as CryptoKey

One or more of the following must be set. All fields are optional, but when set must be valid date or time values.

This object should have the same structure as Date

The number should be among the values of DayOfWeek

This object should have the same structure as TimeOfDay

This object should have the same structure as TimeZone

Treat the dataset as free-form text and apply the same free text transformation everywhere.

This object should have the same structure as InfoTypeTransformations

Treat the dataset as structured. Transformations can be applied to specific locations within structured datasets, such as transforming a column within a table.

This object should have the same structure as RecordTransformations

The parent resource name, for example projects/my-project-id.

Configuration for the de-identification of the content item. Items specified here will override the template referenced by the deidentify_template_name argument.

This object should have the same structure as DeidentifyConfig

Configuration for the inspector. Items specified here will override the template referenced by the inspect_template_name argument.

This object should have the same structure as InspectConfig

The item to de-identify. Will be treated as text.

This object should have the same structure as ContentItem

Optional template to use. Any configuration directly specified in inspect_config will override those set in the template. Singular fields that are set in this request will replace their corresponding fields in the template. Repeated fields are appended. Singular sub-messages and groups are recursively merged.

Optional template to use. Any configuration directly specified in deidentify_config will override those set in the template. Singular fields that are set in this request will replace their corresponding fields in the template. Repeated fields are appended. Singular sub-messages and groups are recursively merged.

The de-identified item.

This object should have the same structure as ContentItem

An overview of the changes that were made on the item.

This object should have the same structure as TransformationOverview

The template name. Output only.

The template will have one of the following formats: projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID OR organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID

Display name (max 256 chars).

Short description (max 256 chars).

The creation timestamp of a inspectTemplate, output only field.

This object should have the same structure as Timestamp

The last update timestamp of a inspectTemplate, output only field.

This object should have the same structure as Timestamp

///////////// // The core content of the template // ///////////////

This object should have the same structure as DeidentifyConfig

Resource name of the organization and deidentify template to be deleted, for example organizations/433245324/deidentifyTemplates/432452342 or projects/project-id/deidentifyTemplates/432452342.

The name of the DlpJob resource to be deleted.

Resource name of the organization and inspectTemplate to be deleted, for example organizations/433245324/inspectTemplates/432452342 or projects/project-id/inspectTemplates/432452342.

Resource name of the project and the triggeredJob, for example projects/dlp-test-project/jobTriggers/53234423.

Resource name of the organization and storedInfoType to be deleted, for example organizations/433245324/storedInfoTypes/432452342 or projects/project-id/storedInfoTypes/432452342.

Fields considered to be quasi-identifiers. No two fields can have the same tag. [required]

This object should have the same structure as QuasiId

ISO 3166-1 alpha-2 region code to use in the statistical modeling. Required if no column is tagged with a region-specific InfoType (like US_ZIP_5) or a region code.

Several auxiliary tables can be used in the analysis. Each custom_tag used to tag a quasi-identifiers field must appear in exactly one field of one auxiliary table.

This object should have the same structure as StatisticalTable

Between 0 and 1.

Always greater than or equal to min_probability.

Number of records within these probability bounds.

Sample of quasi-identifier tuple values in this bucket. The total number of classes returned per bucket is capped at 20.

This object should have the same structure as DeltaPresenceEstimationQuasiIdValues

Total number of distinct quasi-identifier tuple values in this bucket.

The quasi-identifier values.

This object should have the same structure as Value

The estimated probability that a given individual sharing these quasi-identifier values is in the dataset. This value, typically called δ, is the ratio between the number of records in the dataset with these quasi-identifier values, and the total number of individuals (inside and outside the dataset) with these quasi-identifier values. For example, if there are 15 individuals in the dataset who share the same quasi-identifier values, and an estimated 100 people in the entire population with these values, then δ is 0.15.

The intervals [min_probability, max_probability) do not overlap. If a value doesn't correspond to any such interval, the associated frequency is zero. For example, the following records: {min_probability: 0, max_probability: 0.1, frequency: 17} {min_probability: 0.2, max_probability: 0.3, frequency: 42} {min_probability: 0.3, max_probability: 0.4, frequency: 99} mean that there are no record with an estimated probability in [0.1, 0.2) nor larger or equal to 0.4.

This object should have the same structure as DeltaPresenceEstimationHistogramBucket

Hotword-based detection rule.

This object should have the same structure as HotwordRule

List of words or phrases to search for.

This object should have the same structure as WordList

Newline-delimited file of words in Cloud Storage. Only a single file is accepted.

This object should have the same structure as CloudStoragePath

The server-assigned name.

The type of job.

The number should be among the values of DlpJobType

State of a job.

The number should be among the values of JobState

Results from analyzing risk of a data source.

This object should have the same structure as AnalyzeDataSourceRiskDetails

Results from inspecting a data source.

This object should have the same structure as InspectDataSourceDetails

Time when the job was created.

This object should have the same structure as Timestamp

Time when the job started.

This object should have the same structure as Timestamp

Time when the job finished.

This object should have the same structure as Timestamp

If created by a job trigger, the resource name of the trigger that instantiated the job.

A stream of errors encountered running the job.

This object should have the same structure as Error

Offset of the line, from the beginning of the file, where the finding is located.

Composite key indicating which field contains the entity identifier.

This object should have the same structure as FieldId

This object should have the same structure as Status

The times the error occurred.

This object should have the same structure as Timestamp

InfoType list in ExclusionRule rule drops a finding when it overlaps or contained within with a finding of an infoType from this list. For example, for InspectionRuleSet.info_types containing "PHONE_NUMBER"andexclusion_rulecontainingexclude_info_types.info_types` with "EMAIL_ADDRESS" the phone number findings are dropped if they overlap with EMAIL_ADDRESS finding. That leads to "555-222-2222@example.org" to generate only a single finding, namely email address.

This object should have the same structure as InfoType

Dictionary which defines the rule.

This object should have the same structure as Dictionary

Regular expression which defines the rule.

This object should have the same structure as Regex

Set of infoTypes for which findings would affect this rule.

This object should have the same structure as ExcludeInfoTypes

How the rule is applied, see MatchingType documentation for details.

The number should be among the values of MatchingType

The operator to apply to the result of conditions. Default and currently only supported value is AND.

The number should be among the values of LogicalOperator

This object should have the same structure as Conditions

Name describing the field.

Input field(s) to apply the transformation to. [required]

This object should have the same structure as FieldId

Only apply the transformation if the condition evaluates to true for the given RecordCondition. The conditions are allowed to reference fields that are not used in the actual transformation. [optional]

Example Use Cases:

• Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range.
• Redact a field if the date of birth field is greater than 85.

This object should have the same structure as RecordCondition

Apply the transformation to the entire field.

This object should have the same structure as PrimitiveTransformation

Treat the contents of the field as free text, and selectively transform content that matches an InfoType.

This object should have the same structure as InfoTypeTransformations

The Cloud Storage url of the file(s) to scan, in the format gs://<bucket>/<path>. Trailing wildcard in the path is allowed.

If the url ends in a trailing slash, the bucket or directory represented by the url will be scanned non-recursively (content in sub-directories will not be scanned). This means that gs://mybucket/ is equivalent to gs://mybucket/*, and gs://mybucket/directory/ is equivalent to gs://mybucket/directory/*.

Exactly one of url or regex_file_set must be set.

The regex-filtered set of files to scan. Exactly one of url or regex_file_set must be set.

This object should have the same structure as CloudStorageRegexFileSet

The content that was found. Even if the content is not textual, it may be converted to a textual representation here. Provided if include_quote is true and the finding is less than or equal to 4096 bytes long. If the finding exceeds 4096 bytes in length, the quote may be omitted.

The type of content that might have been found. Provided if excluded_types is false.

This object should have the same structure as InfoType

Confidence of how likely it is that the info_type is correct.

The number should be among the values of Likelihood

Where the content was found.

This object should have the same structure as Location

Timestamp when finding was detected.

This object should have the same structure as Timestamp

Contains data parsed from quotes. Only populated if include_quote was set to true and a supported infoType was requested. Currently supported infoTypes: DATE, DATE_OF_BIRTH and TIME.

This object should have the same structure as QuoteInfo

Max number of findings that will be returned for each item scanned. When set within InspectDataSourceRequest, the maximum returned is 2000 regardless if this is set higher. When set within InspectContentRequest, this field is ignored.

Max number of findings that will be returned per request/job. When set within InspectContentRequest, the maximum returned is 2000 regardless if this is set higher.

Configuration of findings limit given for specified infoTypes.

This object should have the same structure as InfoTypeLimit

Lower bound value of buckets. All values less than lower_bound are grouped together into a single bucket; for example if lower_bound = 10, then all values less than 10 are replaced with the value “-10”. [Required].

This object should have the same structure as Value

Upper bound value of buckets. All values greater than upper_bound are grouped together into a single bucket; for example if upper_bound = 89, then all values greater than 89 are replaced with the value “89+”. [Required].

This object should have the same structure as Value

Size of each bucket (except for minimum and maximum buckets). So if lower_bound = 10, upper_bound = 89, and bucket_size = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works. [Required].

Resource name of the organization and deidentify template to be read, for example organizations/433245324/deidentifyTemplates/432452342 or projects/project-id/deidentifyTemplates/432452342.

The name of the DlpJob resource.

Resource name of the organization and inspectTemplate to be read, for example organizations/433245324/inspectTemplates/432452342 or projects/project-id/inspectTemplates/432452342.

Resource name of the project and the triggeredJob, for example projects/dlp-test-project/jobTriggers/53234423.

Resource name of the organization and storedInfoType to be read, for example organizations/433245324/storedInfoTypes/432452342 or projects/project-id/storedInfoTypes/432452342.

Regular expression pattern defining what qualifies as a hotword.

This object should have the same structure as Regex

Proximity of the finding within which the entire hotword must reside. The total length of the window cannot exceed 1000 characters. Note that the finding itself will be included in the window, so that hotwords may be used to match substrings of the finding itself. For example, the certainty of a phone number regex "(\d{3}) \d{3}-\d{4}" could be adjusted upwards if the area code is known to be the local area code of a company office using the hotword regex "(xxx)", where "xxx" is the area code in question.

This object should have the same structure as Proximity

Likelihood adjustment to apply to all matching findings.

This object should have the same structure as LikelihoodAdjustment

Bounding boxes locating the pixels within the image containing the finding.

This object should have the same structure as BoundingBox

Only one per info_type should be provided per request. If not specified, and redact_all_text is false, the DLP API will redact all text that it matches against all info_types that are found, but not specified in another ImageRedactionConfig.

This object should have the same structure as InfoType

If true, all text found in the image, regardless whether it matches an info_type, is redacted. Only one should be provided.

The color to use when redacting content from an image. If not specified, the default is black.

This object should have the same structure as Color

Name of the information type. Either a name of your choosing when creating a CustomInfoType, or one of the names listed at https://cloud.google.com/dlp/docs/infotypes-reference when specifying a built-in type. InfoType names should conform to the pattern [a-zA-Z0-9_]{1,64}.

Internal name of the infoType.

Human readable form of the infoType name.

Which parts of the API supports this InfoType.

The number should be among the values of InfoTypeSupportedBy

Description of the infotype. Translated when language is provided in the request.

Type of information the findings limit applies to. Only one limit per info_type should be provided. If InfoTypeLimit does not have an info_type, the DLP API applies the limit against all info_types that are found but not specified in another InfoTypeLimit.

This object should have the same structure as InfoType

Max findings limit for the given infoType.

The type of finding this stat is for.

This object should have the same structure as InfoType

Number of findings for this infoType.

InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in InspectConfig.

This object should have the same structure as InfoType

Primitive transformation to apply to the infoType. [required]

This object should have the same structure as PrimitiveTransformation

Transformation for each infoType. Cannot specify more than one for a given infoType. [required]

This object should have the same structure as InfoTypeTransformation

Restricts what info_types to look for. The values must correspond to InfoType values returned by ListInfoTypes or listed at https://cloud.google.com/dlp/docs/infotypes-reference.

When no InfoTypes or CustomInfoTypes are specified in a request, the system may automatically choose what detectors to run. By default this may be all types, but may change over time as detectors are updated.

The special InfoType name "ALL_BASIC" can be used to trigger all detectors, but may change over time as new InfoTypes are added. If you need precise control and predictability as to what detectors are run you should specify specific InfoTypes listed in the reference.

This object should have the same structure as InfoType

Only returns findings equal or above this threshold. The default is POSSIBLE. See https://cloud.google.com/dlp/docs/likelihood to learn more.

The number should be among the values of Likelihood

This object should have the same structure as FindingLimits

When true, a contextual quote from the data that triggered a finding is included in the response; see Finding.quote.

When true, excludes type information of the findings.

CustomInfoTypes provided by the user. See https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.

This object should have the same structure as CustomInfoType

List of options defining data content to scan. If empty, text, images, and other content will be included.

The number should be among the values of ContentOption

Set of rules to apply to the findings for this InspectConfig. Exclusion rules, contained in the set are executed in the end, other rules are executed in the order they are specified for each info type.

This object should have the same structure as InspectionRuleSet

The parent resource name, for example projects/my-project-id.

Configuration for the inspector. What specified here will override the template referenced by the inspect_template_name argument.

This object should have the same structure as InspectConfig

The item to inspect.

This object should have the same structure as ContentItem

Optional template to use. Any configuration directly specified in inspect_config will override those set in the template. Singular fields that are set in this request will replace their corresponding fields in the template. Repeated fields are appended. Singular sub-messages and groups are recursively merged.

The findings.

This object should have the same structure as InspectResult

The configuration used for this job.

This object should have the same structure as RequestedOptions

A summary of the outcome of this inspect job.

This object should have the same structure as Result

Hotword-based detection rule.

This object should have the same structure as HotwordRule

Exclusion rule.

This object should have the same structure as ExclusionRule

List of infoTypes this rule set is applied to.

This object should have the same structure as InfoType

Set of rules to be applied to infoTypes. The rules are applied in order.

This object should have the same structure as InspectionRule

The data to scan.

This object should have the same structure as StorageConfig

How and what to scan for.

This object should have the same structure as InspectConfig

If provided, will be used as the default for all values in InspectConfig. inspect_config will be merged into the values persisted as part of the template.

Actions to execute at the completion of the job.

This object should have the same structure as Action

List of findings for an item.

This object should have the same structure as Finding

If true, then this item might have more findings than were returned, and the findings returned are an arbitrary subset of all findings. The findings list might be truncated because the input items were too large, or because the server reached the maximum amount of resources allowed for a single API call. For best results, divide the input into smaller batches.

The template name. Output only.

The template will have one of the following formats: projects/PROJECT_ID/inspectTemplates/TEMPLATE_ID OR organizations/ORGANIZATION_ID/inspectTemplates/TEMPLATE_ID

Display name (max 256 chars).

Short description (max 256 chars).

The creation timestamp of a inspectTemplate, output only field.

This object should have the same structure as Timestamp

The last update timestamp of a inspectTemplate, output only field.

This object should have the same structure as Timestamp

The core content of the template. Configuration of the scanning process.

This object should have the same structure as InspectConfig

Unique resource name for the triggeredJob, assigned by the service when the triggeredJob is created, for example projects/dlp-test-project/triggeredJobs/53234423.

Display name (max 100 chars)

User provided description (max 256 chars)

This object should have the same structure as InspectJobConfig

A list of triggers which will be OR'ed together. Only one in the list needs to trigger for a job to be started. The list may contain only a single Schedule trigger and must have at least one object.

This object should have the same structure as Trigger

A stream of errors encountered when the trigger was activated. Repeated errors may result in the JobTrigger automatically being paused. Will return the last 100 errors. Whenever the JobTrigger is modified this list will be cleared. Output only field.

This object should have the same structure as Error

The creation timestamp of a triggeredJob, output only field.

This object should have the same structure as Timestamp

The last update timestamp of a triggeredJob, output only field.

This object should have the same structure as Timestamp

The timestamp of the last time this trigger executed, output only field.

This object should have the same structure as Timestamp

A status for this trigger. [required]

The number should be among the values of Status

Set of fields to compute k-anonymity over. When multiple fields are specified, they are considered a single composite key. Structs and repeated data types are not supported; however, nested fields are supported so long as they are not structs themselves or nested within a repeated field.

This object should have the same structure as FieldId

Optional message indicating that multiple rows might be associated to a single individual. If the same entity_id is associated to multiple quasi-identifier tuples over distinct rows, we consider the entire collection of tuples as the composite quasi-identifier. This collection is a multiset: the order in which the different tuples appear in the dataset is ignored, but their frequency is taken into account.

Important note: a maximum of 1000 rows can be associated to a single entity ID. If more rows are associated with the same entity ID, some might be ignored.

This object should have the same structure as EntityId

Set of values defining the equivalence class. One value per quasi-identifier column in the original KAnonymity metric message. The order is always the same as the original request.

This object should have the same structure as Value

Size of the equivalence class, for example number of rows with the above set of values.

Lower bound on the size of the equivalence classes in this bucket.

Upper bound on the size of the equivalence classes in this bucket.

Total number of equivalence classes in this bucket.

Sample of equivalence classes in this bucket. The total number of classes returned per bucket is capped at 20.

This object should have the same structure as KAnonymityEquivalenceClass

Total number of distinct equivalence classes in this bucket.

Histogram of k-anonymity equivalence classes.

This object should have the same structure as KAnonymityHistogramBucket

Entities are partitioned into subsets, currently identified by a project ID and namespace ID. Queries are scoped to a single partition.

This object should have the same structure as PartitionId

The entity path. An entity path consists of one or more elements composed of a kind and a string or numerical identifier, which identify entities. The first element identifies a root entity, the second element identifies a child of the root entity, the third element identifies a child of the second entity, and so forth. The entities identified by all prefixes of the path are called the element's ancestors.

A path can never be empty, and a path can have at most 100 elements.

This object should have the same structure as PathElement

The name of the kind.

Fields considered to be quasi-identifiers. No two columns can have the same tag. [required]

This object should have the same structure as TaggedField

ISO 3166-1 alpha-2 region code to use in the statistical modeling. Required if no column is tagged with a region-specific InfoType (like US_ZIP_5) or a region code.

Several auxiliary tables can be used in the analysis. Each custom_tag used to tag a quasi-identifiers column must appear in exactly one column of one auxiliary table.

This object should have the same structure as AuxiliaryTable

Always positive.

Always greater than or equal to min_anonymity.

Number of records within these anonymity bounds.

Sample of quasi-identifier tuple values in this bucket. The total number of classes returned per bucket is capped at 20.

This object should have the same structure as KMapEstimationQuasiIdValues

Total number of distinct quasi-identifier tuple values in this bucket.

The quasi-identifier values.

This object should have the same structure as Value

The estimated anonymity for these quasi-identifier values.

The intervals [min_anonymity, max_anonymity] do not overlap. If a value doesn't correspond to any such interval, the associated frequency is zero. For example, the following records: {min_anonymity: 1, max_anonymity: 1, frequency: 17} {min_anonymity: 2, max_anonymity: 3, frequency: 42} {min_anonymity: 5, max_anonymity: 10, frequency: 99} mean that there are no record with an estimated anonymity of 4, 5, or larger than 10.

This object should have the same structure as KMapEstimationHistogramBucket

The wrapped data crypto key. [required]

The resource name of the KMS CryptoKey to use for unwrapping. [required]

Location to store dictionary artifacts in Google Cloud Storage. These files will only be accessible by project owners and the DLP API. If any of these artifacts are modified, the dictionary is considered invalid and can no longer be used.

This object should have the same structure as CloudStoragePath

Set of files containing newline-delimited lists of dictionary phrases.

This object should have the same structure as CloudStorageFileSet

Field in a BigQuery table where each cell represents a dictionary phrase.

This object should have the same structure as BigQueryField

Approximate number of distinct phrases in the dictionary.

Set of quasi-identifiers indicating how equivalence classes are defined for the l-diversity computation. When multiple fields are specified, they are considered a single composite key.

This object should have the same structure as FieldId

Sensitive field for computing the l-value.

This object should have the same structure as FieldId

Quasi-identifier values defining the k-anonymity equivalence class. The order is always the same as the original request.

This object should have the same structure as Value

Size of the k-anonymity equivalence class.

Number of distinct sensitive values in this equivalence class.

Estimated frequencies of top sensitive values.

This object should have the same structure as ValueFrequency

Lower bound on the sensitive value frequencies of the equivalence classes in this bucket.

Upper bound on the sensitive value frequencies of the equivalence classes in this bucket.

Total number of equivalence classes in this bucket.

Sample of equivalence classes in this bucket. The total number of classes returned per bucket is capped at 20.

This object should have the same structure as LDiversityEquivalenceClass

Total number of distinct equivalence classes in this bucket.

Histogram of l-diversity equivalence class sensitive value frequencies.

This object should have the same structure as LDiversityHistogramBucket

Set the likelihood of a finding to a fixed value.

The number should be among the values of Likelihood

Increase or decrease the likelihood by the specified number of levels. For example, if a finding would be POSSIBLE without the detection rule and relative_likelihood is 1, then it is upgraded to LIKELY, while a value of -1 would downgrade it to UNLIKELY. Likelihood may never drop below VERY_UNLIKELY or exceed VERY_LIKELY, so applying an adjustment of 1 followed by an adjustment of -1 when base likelihood is VERY_LIKELY will result in a final likelihood of LIKELY.

The parent resource name, for example projects/my-project-id or organizations/my-org-id.

Optional page token to continue retrieval. Comes from previous call to ListDeidentifyTemplates.

Optional size of the page, can be limited by server. If zero server returns a page of max size 100.

Optional comma separated list of fields to order by, followed by asc or desc postfix. This list is case-insensitive, default sorting order is ascending, redundant space characters are insignificant.

Example: name asc,update_time, create_time desc

Supported fields are:

• create_time: corresponds to time the template was created.
• update_time: corresponds to time the template was last updated.
• name: corresponds to template's name.
• display_name: corresponds to template's display name.

List of deidentify templates, up to page_size in ListDeidentifyTemplatesRequest.

This object should have the same structure as DeidentifyTemplate

If the next page is available then the next page token to be used in following ListDeidentifyTemplates request.

The parent resource name, for example projects/my-project-id.

Optional. Allows filtering.

Supported syntax:

• Filter expressions are made up of one or more restrictions.
• Restrictions can be combined by AND or OR logical operators. A sequence of restrictions implicitly uses AND.
• A restriction has the form of <field> <operator> <value>.
• Supported fields/values for inspect jobs:
  • state - PENDING|RUNNING|CANCELED|FINISHED|FAILED
  • inspected_storage - DATASTORE|CLOUD_STORAGE|BIGQUERY
  • trigger_name - The resource name of the trigger that created job.
  • 'end_time` - Corresponds to time the job finished.
  • 'start_time` - Corresponds to time the job finished.
• Supported fields for risk analysis jobs:
  • state - RUNNING|CANCELED|FINISHED|FAILED
  • 'end_time` - Corresponds to time the job finished.
  • 'start_time` - Corresponds to time the job finished.
• The operator must be = or !=.

Examples:

• inspected_storage = cloud_storage AND state = done
• inspected_storage = cloud_storage OR inspected_storage = bigquery
• inspected_storage = cloud_storage AND (state = done OR state = canceled)
• end_time > "2017-12-12T00:00:00+00:00"

The length of this field should be no more than 500 characters.

The standard list page size.

The standard list page token.

The type of job. Defaults to DlpJobType.INSPECT

The number should be among the values of DlpJobType

Optional comma separated list of fields to order by, followed by asc or desc postfix. This list is case-insensitive, default sorting order is ascending, redundant space characters are insignificant.

Example: name asc, end_time asc, create_time desc

Supported fields are:

• create_time: corresponds to time the job was created.
• end_time: corresponds to time the job ended.
• name: corresponds to job's name.
• state: corresponds to state

A list of DlpJobs that matches the specified filter in the request.

This object should have the same structure as DlpJob

The standard List next-page token.

Optional BCP-47 language code for localized infoType friendly names. If omitted, or if localized strings are not available, en-US strings will be returned.

Optional filter to only return infoTypes supported by certain parts of the API. Defaults to supported_by=INSPECT.

Set of sensitive infoTypes.

This object should have the same structure as InfoTypeDescription

The parent resource name, for example projects/my-project-id or organizations/my-org-id.

Optional page token to continue retrieval. Comes from previous call to ListInspectTemplates.

Optional size of the page, can be limited by server. If zero server returns a page of max size 100.

Optional comma separated list of fields to order by, followed by asc or desc postfix. This list is case-insensitive, default sorting order is ascending, redundant space characters are insignificant.

Example: name asc,update_time, create_time desc

Supported fields are:

• create_time: corresponds to time the template was created.
• update_time: corresponds to time the template was last updated.
• name: corresponds to template's name.
• display_name: corresponds to template's display name.

List of inspectTemplates, up to page_size in ListInspectTemplatesRequest.

This object should have the same structure as InspectTemplate

If the next page is available then the next page token to be used in following ListInspectTemplates request.

The parent resource name, for example projects/my-project-id.

Optional page token to continue retrieval. Comes from previous call to ListJobTriggers. order_by field must not change for subsequent calls.

Optional size of the page, can be limited by a server.

Optional comma separated list of triggeredJob fields to order by, followed by asc or desc postfix. This list is case-insensitive, default sorting order is ascending, redundant space characters are insignificant.

Example: name asc,update_time, create_time desc

Supported fields are:

• create_time: corresponds to time the JobTrigger was created.
• update_time: corresponds to time the JobTrigger was last updated.
• last_run_time: corresponds to the last time the JobTrigger ran.
• name: corresponds to JobTrigger's name.
• display_name: corresponds to JobTrigger's display name.
• status: corresponds to JobTrigger's status.

Optional. Allows filtering.

Supported syntax:

• Filter expressions are made up of one or more restrictions.
• Restrictions can be combined by AND or OR logical operators. A sequence of restrictions implicitly uses AND.
• A restriction has the form of <field> <operator> <value>.
• Supported fields/values for inspect jobs:
  • status - HEALTHY|PAUSED|CANCELLED
  • inspected_storage - DATASTORE|CLOUD_STORAGE|BIGQUERY
  • 'last_run_time` - RFC 3339 formatted timestamp, surrounded by quotation marks. Nanoseconds are ignored.
  • 'error_count' - Number of errors that have occurred while running.
• The operator must be = or != for status and inspected_storage.

Examples:

• inspected_storage = cloud_storage AND status = HEALTHY
• inspected_storage = cloud_storage OR inspected_storage = bigquery
• inspected_storage = cloud_storage AND (state = PAUSED OR state = HEALTHY)
• last_run_time > "2017-12-12T00:00:00+00:00"

The length of this field should be no more than 500 characters.

List of triggeredJobs, up to page_size in ListJobTriggersRequest.

This object should have the same structure as JobTrigger

If the next page is available then the next page token to be used in following ListJobTriggers request.

The parent resource name, for example projects/my-project-id or organizations/my-org-id.

Optional page token to continue retrieval. Comes from previous call to ListStoredInfoTypes.

Optional size of the page, can be limited by server. If zero server returns a page of max size 100.

Optional comma separated list of fields to order by, followed by asc or desc postfix. This list is case-insensitive, default sorting order is ascending, redundant space characters are insignificant.

Example: name asc, display_name, create_time desc

Supported fields are:

• create_time: corresponds to time the most recent version of the resource was created.
• state: corresponds to the state of the resource.
• name: corresponds to resource name.
• display_name: corresponds to info type's display name.

List of storedInfoTypes, up to page_size in ListStoredInfoTypesRequest.

This object should have the same structure as StoredInfoType

If the next page is available then the next page token to be used in following ListStoredInfoTypes request.

Zero-based byte offsets delimiting the finding. These are relative to the finding's containing element. Note that when the content is not textual, this references the UTF-8 encoded textual representation of the content. Omitted if content is an image.

This object should have the same structure as Range

Unicode character offsets delimiting the finding. These are relative to the finding's containing element. Provided when the content is text.

This object should have the same structure as Range

List of nested objects pointing to the precise location of the finding within the file or record.

This object should have the same structure as ContentLocation

Field to compute numerical stats on. Supported types are integer, float, date, datetime, timestamp, time.

This object should have the same structure as FieldId