Nested message and enum types in Action.
Nested message and enum types in ActionDetails.
Nested message and enum types in AnalyzeDataSourceRiskDetails.
Nested message and enum types in BigQueryDiscoveryTarget.
Nested message and enum types in BigQueryOptions.
Nested message and enum types in BigQueryTableCollection.
Nested message and enum types in BucketingConfig.
Nested message and enum types in ByteContentItem.
Nested message and enum types in CharsToIgnore.
Nested message and enum types in CloudSqlDiscoveryTarget.
Nested message and enum types in CloudSqlProperties.
Nested message and enum types in CloudStorageOptions.
Nested message and enum types in ColumnDataProfile.
Nested message and enum types in Connection.
Nested message and enum types in ContentItem.
Nested message and enum types in ContentLocation.
Nested message and enum types in CreateDlpJobRequest.
Nested message and enum types in CryptoKey.
Nested message and enum types in CryptoReplaceFfxFpeConfig.
Nested message and enum types in CustomInfoType.
Nested message and enum types in DataProfileAction.
Nested message and enum types in DataProfileBigQueryRowSchema.
Nested message and enum types in DataProfileLocation.
Nested message and enum types in DataProfilePubSubCondition.
Nested message and enum types in DataRiskLevel.
Nested message and enum types in DatabaseResourceCollection.
Nested message and enum types in DateShiftConfig.
Nested message and enum types in DateTime.
Nested message and enum types in DeidentifyConfig.
Nested message and enum types in DeidentifyDataSourceDetails.
Nested message and enum types in DiscoveryBigQueryConditions.
Nested message and enum types in DiscoveryBigQueryFilter.
Nested message and enum types in DiscoveryCloudSqlConditions.
Nested message and enum types in DiscoveryCloudSqlFilter.
Nested message and enum types in DiscoveryCloudSqlGenerationCadence.
Nested message and enum types in DiscoveryConfig.
Nested message and enum types in DiscoveryStartingLocation.
Nested message and enum types in DiscoveryTarget.
Nested message and enum types in DlpJob.
Generated client implementations.
Nested message and enum types in ExclusionRule.
Nested message and enum types in FieldTransformation.
Nested message and enum types in ImageTransformations.
Nested message and enum types in InfoTypeCategory.
Nested message and enum types in InfoTypeTransformations.
Nested message and enum types in InspectConfig.
Nested message and enum types in InspectDataSourceDetails.
Nested message and enum types in InspectionRule.
Nested message and enum types in JobTrigger.
Nested message and enum types in Key.
Nested message and enum types in LargeCustomDictionaryConfig.
Nested message and enum types in MetadataLocation.
Nested message and enum types in OutputStorageConfig.
Nested message and enum types in PrimitiveTransformation.
Nested message and enum types in PrivacyMetric.
Nested message and enum types in QuasiId.
Nested message and enum types in QuoteInfo.
Nested message and enum types in RecordCondition.
Nested message and enum types in RecordKey.
Nested message and enum types in RedactImageRequest.
Nested message and enum types in ReplaceDictionaryConfig.
Nested message and enum types in Schedule.
Nested message and enum types in SensitivityScore.
Nested message and enum types in StatisticalTable.
Nested message and enum types in StorageConfig.
Nested message and enum types in StoredInfoTypeConfig.
Nested message and enum types in StoredInfoTypeStats.
Nested message and enum types in Table.
Nested message and enum types in TableDataProfile.
Nested message and enum types in TimePartConfig.
Nested message and enum types in TransformationDetailsStorageConfig.
Nested message and enum types in TransformationErrorHandling.
Nested message and enum types in TransformationLocation.
Nested message and enum types in TransformationSummary.
Nested message and enum types in Value.
The results of an [Action][google.privacy.dlp.v2.Action].
Request message for ActivateJobTrigger.
Match database resources not covered by any other filter.
Result of a risk analysis operation request.
Target used to match against for discovery with BigQuery tables
Message defining a field of a BigQuery table.
Row key for identifying a record in BigQuery table.
Options defining BigQuery table and row identifiers.
A pattern to match against one or more tables, datasets, or projects that
contain BigQuery tables. At least one pattern must be specified.
Regular expressions use RE2
syntax; a guide can be found
under the google/re2 repository on GitHub.
A collection of regular expressions to determine what tables to match
against.
Message defining the location of a BigQuery table. A table is uniquely
identified by its project_id, dataset_id, and table_name. Within a query
a table is often referenced with a string in the format of:
<project_id>:<dataset_id>.<table_id> or
<project_id>.<dataset_id>.<table_id>.
Specifies a collection of BigQuery tables. Used for Discovery.
The types of BigQuery tables supported by Cloud DLP.
Bounding box encompassing detected text within an image.
Generalization function that buckets values based on ranges. The ranges and
replacement values are dynamically provided by the user for custom behavior,
such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
This can be used on
data of type: number, long, string, timestamp.
If the bound
Value type differs from the type of data being transformed, we
will first attempt converting the type of the data to be transformed to match
the type of the bound before comparing.
See
https://cloud.google.com/sensitive-data-protection/docs/concepts-bucketing to
learn more.
Container for bytes to inspect or redact.
The request message for canceling a DLP job.
Partially mask a string by replacing a given number of characters with a
fixed character. Masking can start from the beginning or end of the string.
This can be used on data of any type (numbers, longs, and so on) and when
de-identifying structured data we’ll attempt to preserve the original data’s
type. (This allows you to take a long like 123 and modify it to a string like
**3.
Characters to skip when doing deidentification of a value. These will be left
alone and skipped.
Target used to match against for discovery with Cloud SQL tables.
Cloud SQL connection properties.
Message representing a set of files in Cloud Storage.
Options defining a file or a set of files within a Cloud Storage
bucket.
Message representing a single file or path in Cloud Storage.
Message representing a set of files in a Cloud Storage bucket. Regular
expressions are used to allow fine-grained control over which files in the
bucket to include.
Represents a color in the RGB color space.
The profile for a scanned column within a table.
A data connection to allow DLP to profile data in locations that require
additional configuration.
Represents a container that may contain DLP findings.
Examples of a container include a file, table, or database record.
Type of content to inspect.
Precise location of the finding within a document, record, image, or metadata
container.
Request message for CreateConnection.
Request message for CreateDeidentifyTemplate.
Request message for CreateDiscoveryConfig.
Request message for CreateDlpJobRequest. Used to initiate long running
jobs such as calculating risk metrics or inspecting Google Cloud
Storage.
Request message for CreateInspectTemplate.
Request message for CreateJobTrigger.
Request message for CreateStoredInfoType.
Pseudonymization method that generates deterministic encryption for the given
input. Outputs a base64 encoded representation of the encrypted output.
Uses AES-SIV based on the RFC
https://tools.ietf.org/html/rfc5297.Pseudonymization method that generates surrogates via cryptographic hashing.
Uses SHA-256.
The key size must be either 32 or 64 bytes.
Outputs a base64 encoded representation of the hashed output
(for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).
Currently, only string and integer values can be hashed.
See
https://cloud.google.com/sensitive-data-protection/docs/pseudonymization
to learn more.
This is a data encryption key (DEK) (as opposed to
a key encryption key (KEK) stored by Cloud Key Management Service
(Cloud KMS).
When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate
IAM policy on the KEK to ensure an attacker cannot
unwrap the DEK.
Replaces an identifier with a surrogate using Format Preserving Encryption
(FPE) with the FFX mode of operation; however when used in the
ReidentifyContent API method, it serves the opposite function by reversing
the surrogate back into the original identifier. The identifier must be
encoded as ASCII. For a given crypto key and context, the same identifier
will be replaced with the same surrogate. Identifiers must be at least two
characters long. In the case that the identifier is the empty string, it will
be skipped. See
https://cloud.google.com/sensitive-data-protection/docs/pseudonymization to
learn more.
Custom information type provided by the user. Used to find domain-specific
sensitive information configurable to the data in question.
A task to execute when a data profile has been generated.
The schema of data to be saved to the BigQuery table when the
DataProfileAction is enabled.
Snapshot of the configurations used to generate the profile.
Configuration for setting up a job to scan resources for profile generation.
Only one data profile configuration may exist per organization, folder,
or project.
The data that will be profiled.
A condition for determining whether a Pub/Sub should be triggered.
Pub/Sub topic message for a DataProfileAction.PubSubNotification event.
To receive a message of protocol buffer schema type, convert the message data
to an object of this proto class.
Score is a summary of all elements in the data profile.
A higher number means more risk.
Message used to identify the type of resource being profiled.
Match database resources using regex filters. Examples of database
resources are tables, views, and stored procedures.
Identifies a single database resource, like a table within a database.
A pattern to match against one or more database resources. At least one
pattern must be specified. Regular expressions use RE2
syntax; a guide can be found
under the google/re2 repository on GitHub.
A collection of regular expressions to determine what database resources to
match against.
Record key for a finding in Cloud Datastore.
Options defining a data set within Google Cloud Datastore.
Message for a date time object.
e.g. 2018-01-01, 5th August.
The configuration that controls how the data will change.
Request to de-identify a ContentItem.
Results of de-identifying a ContentItem.
The results of a [Deidentify][google.privacy.dlp.v2.Action.Deidentify] action
from an inspect job.
Summary of what was modified during a transformation.
Request message for DeleteConnection.
Request message for DeleteDeidentifyTemplate.
Request message for DeleteDiscoveryConfig.
The request message for deleting a DLP job.
Request message for DeleteInspectTemplate.
Request message for DeleteJobTrigger.
Request message for DeleteStoredInfoType.
Request message for DeleteTableProfile.
Do not profile the tables.
Requirements that must be true before a table is scanned in discovery for the
first time. There is an AND relationship between the top-level attributes.
Additionally, minimum conditions with an OR relationship that must be met
before Cloud DLP scans a table can be set (like a minimum row count or a
minimum table age).
Determines what tables will have profiles generated within an organization
or project. Includes the ability to filter by regular expression patterns
on project ID, dataset ID, and table ID.
Requirements that must be true before a table is profiled for the
first time.
Determines what tables will have profiles generated within an organization
or project. Includes the ability to filter by regular expression patterns
on project ID, location, instance, database, and database resource name.
How often existing tables should have their profiles refreshed.
New tables are scanned as quickly as possible depending on system
capacity.
Configuration for discovery to scan resources for profile generation.
Only one discovery configuration may exist per organization, folder,
or project.
What must take place for a profile to be updated and how
frequently it should occur.
New tables are scanned as quickly as possible depending on system
capacity.
The cadence at which to update data profiles when a schema is modified.
The location to begin a discovery scan. Denotes an organization ID or folder
ID within an organization.
The cadence at which to update data profiles when a table is modified.
Target used to match against for Discovery.
Combines all of the information about a DLP job.
Location of a finding within a document.
An entity in a dataset is a field or set of fields that correspond to a
single person. For example, in medical records the EntityId might be a
patient identifier, or for financial records it might be an account
identifier. This message is used when generalizations or analysis must take
into account that multiple rows correspond to the same entity.
Details information about an error encountered during job execution or
the results of an unsuccessful activation of the JobTrigger.
The rule to exclude findings based on a hotword. For record inspection of
tables, column names are considered hotwords. An example of this is to
exclude a finding if it belongs to a BigQuery column that matches a specific
pattern.
List of excluded infoTypes.
The rule that specifies conditions when findings of infoTypes specified in
InspectionRuleSet are removed from results.
General identifier of a data field in a storage service.
The transformation to apply to the field.
Represents a piece of potentially sensitive content.
The request message for finishing a DLP hybrid job.
Buckets values based on fixed size ranges. The
Bucketing transformation can provide all of this functionality,
but requires more configuration. This message is provided as a convenience to
the user for simple bucketing strategies.
Request to get a column data profile.
Request message for GetConnection.
Request message for GetDeidentifyTemplate.
Request message for GetDiscoveryConfig.
The request message for [DlpJobs.GetDlpJob][].
Request message for GetInspectTemplate.
Request message for GetJobTrigger.
Request to get a project data profile.
Request message for GetStoredInfoType.
Request to get a table data profile.
An individual hybrid item to inspect. Will be stored temporarily during
processing.
Populate to associate additional data with each finding.
Request to search for potentially sensitive info in a custom location.
Request to search for potentially sensitive info in a custom location.
Quota exceeded errors will be thrown once quota has been met.
Statistics related to processing hybrid inspect requests.
Configuration to control jobs where the content being inspected is outside
of Google Cloud Platform.
Location of the finding within an image.
A type of transformation that is applied over images.
Type of information detected by the API.
Classification of infoTypes to organize them according to geographic
location, industry, and data type.
InfoType description.
Statistics regarding a specific InfoType.
The infoType details for this column.
A type of transformation that will scan unstructured text and
apply various PrimitiveTransformations to each finding, where the
transformation is applied to only values that were identified as a specific
info_type.
Configuration description of the scanning process.
When used with redactContent only info_types and min_likelihood are currently
used.
Request to search for potentially sensitive info in a ContentItem.
Results of inspecting an item.
The results of an inspect DataSource job.
Controls what and how to inspect for findings.
All the findings for a single scanned item.
A single inspection rule to be applied to infoTypes, specified in
InspectionRuleSet.
Rule set for modifying a set of infoTypes to alter behavior under certain
circumstances, depending on the specific details of the rules within the set.
A unique identifier for a Datastore entity.
If a key’s partition ID or any of its path kinds or names are
reserved/read-only, the key is reserved/read-only.
A reserved/read-only key is forbidden in certain documented contexts.
A representation of a Datastore kind.
Include to use an existing data crypto key wrapped by KMS.
The wrapped key must be a 128-, 192-, or 256-bit key.
Authorization requires the following IAM permissions when sending a request
to perform a crypto transformation using a KMS-wrapped crypto key:
dlp.kms.encrypt
Configuration for a custom dictionary created from a data source of any size
up to the maximum size defined in the
limits page. The
artifacts of dictionary creation are stored in the specified Cloud Storage
location. Consider using
CustomInfoType.Dictionary for smaller dictionaries
that satisfy the size requirements.
Summary statistics of a custom dictionary.
Request to list the profiles generated for a given organization or project.
List of profiles generated for a given organization or project.
Request message for ListConnections.
Response message for ListConnections.
Request message for ListDeidentifyTemplates.
Response message for ListDeidentifyTemplates.
Request message for ListDiscoveryConfigs.
Response message for ListDiscoveryConfigs.
The request message for listing DLP jobs.
The response message for listing DLP jobs.
Request for the list of infoTypes.
Response to the ListInfoTypes request.
Request message for ListInspectTemplates.
Response message for ListInspectTemplates.
Request message for ListJobTriggers.
Response message for ListJobTriggers.
Request to list the profiles generated for a given organization or project.
List of profiles generated for a given organization or project.
Request message for ListStoredInfoTypes.
Response message for ListStoredInfoTypes.
Request to list the profiles generated for a given organization or project.
List of profiles generated for a given organization or project.
Specifies the location of the finding.
Job trigger option for hybrid jobs. Jobs must be manually created
and finished.
Metadata Location
Infotype details for other infoTypes found within a column.
Cloud repository for storing output.
Datastore partition ID.
A partition ID identifies a grouping of entities. The grouping is always
by project and namespace, however the namespace ID may be empty.
A rule for transforming a value.
Privacy metric to compute for reidentification risk analysis.
Success or errors for the profile generation.
An aggregated profile for this project, based on the resources profiled
within it.
A column with a semantic tag attached.
Message for infoType-dependent details parsed from quote.
Generic half-open interval [start, end)
A condition for determining whether a transformation should be applied to
a field.
Message for a unique key indicating a record that contains a finding.
Location of a finding within a row or record.
Configuration to suppress records whose suppression conditions evaluate to
true.
The field in a record to transform.
A type of transformation that is applied over structured data such as a
table.
Redact a given value. For example, if used with an InfoTypeTransformation
transforming PHONE_NUMBER, and input ‘My phone number is 206-555-0123’, the
output would be ’My phone number is ’.
Request to search for potentially sensitive info in an image and redact it
by covering it with a colored rectangle.
Results of redacting an image.
Request to re-identify an item.
Results of re-identifying an item.
Replace each input value with a value randomly selected from the dictionary.
Replace each input value with a given Value.
Replace each matching finding with the name of the info_type.
Schedule for inspect job triggers.
Request message for SearchConnections.
Response message for SearchConnections.
A credential consisting of a username and password, where the password is
stored in a Secret Manager resource.
Note: Secret Manager
charges
apply.
Score is calculated from of all elements in the data profile.
A higher level means the data is more sensitive.
An auxiliary table containing statistical information on the relative
frequency of different quasi-identifiers values. It has one or several
quasi-identifiers columns, and one column that indicates the relative
frequency of each quasi-identifier tuple.
If a tuple is present in the data but not in the auxiliary table, the
corresponding relative frequency is assumed to be zero (and thus, the
tuple is highly reidentifiable).
Shared message indicating Cloud storage type.
Storage metadata label to indicate which metadata entry contains findings.
StoredInfoType resource message that contains information about the current
version and any pending updates.
Statistics for a StoredInfoType.
Version of a StoredInfoType, including the configuration used to build it,
create timestamp, and current state.
A reference to a StoredInfoType to use with scanning.
The profile for a scanned table.
Location of a finding within a table.
Instructions regarding the table content being inspected.
For use with Date, Timestamp, and TimeOfDay, extract or preserve a
portion of the value.
User specified templates and configs for how to deidentify structured,
unstructures, and image files. User must provide either a unstructured
deidentify template or at least one redact image config.
A flattened description of a PrimitiveTransformation or
RecordSuppression.
Details about a single transformation. This object contains a description of
the transformation, information about whether the transformation was
successfully applied, and the precise location where the transformation
occurred. These details are stored in a user-specified BigQuery table.
Config for storing transformation details.
How to handle transformation errors during de-identification. A
transformation error occurs when the requested transformation is incompatible
with the data. For example, trying to de-identify an IP address using a
DateShift transformation would result in a transformation error, since date
info cannot be extracted from an IP address.
Information about any incompatible transformations, and how they were
handled, is returned in the response as part of the
TransformationOverviews.
Specifies the location of a transformation.
Overview of the modifications that occurred.
The outcome of a transformation.
Summary of a single transformation.
Only one of ‘transformation’, ‘field_transformation’, or ‘record_suppress’
will be set.
Use this to have a random data crypto key generated.
It will be discarded after the request finishes.
Using raw keys is prone to security risks due to accidentally
leaking the key. Choose another type of key if possible.
Request message for UpdateConnection.
Request message for UpdateDeidentifyTemplate.
Request message for UpdateDiscoveryConfig.
Request message for UpdateInspectTemplate.
Request message for UpdateJobTrigger.
Request message for UpdateStoredInfoType.
Set of primitive values supported by the system.
Note that for the purposes of inspection or transformation, the number
of bytes considered to comprise a ‘Value’ is based on its representation
as a UTF-8 encoded string. For example, if ‘integer_value’ is set to
123456789, the number of bytes would be counted as 9, even though an
int64 only holds up to 8 bytes of data.
A value of a field, including its frequency.
Details about each available version for an infotype.