Data masking

Hide selected fields or recognized sensitive values without replacing the entire response. For known JavaScript Object Notation (JSON) fields, name the fields to hide. Data Guard detects supported credit card and Social Security number formats. Use synthetic data to test either mechanism.

Mechanism	Selection	Expected change
Sensitive-data disclosure rule	GET /disclosure and named JSON fields	Selected values are hidden; other fields remain usable.
Data Guard rule	/data-guard with an attached application firewall	Supported sensitive values are masked in the selected response.

Selected JSON fields

Visitor response: The JSON response keeps its structure but hides the values of card and ssn.

The sensitive_data_disclosure_rules entry matches GET /disclosure, names card and ssn in body.fields, and selects mask. Check that the selected synthetic values are absent, not merely that a masking rule is configured.

Selected-field masking source

{
  "spec": {
    "sensitive_data_disclosure_rules": {
      "sensitive_data_types_in_response": [
        {
          "api_endpoint": {
            "path": "/disclosure",
            "methods": [
              "GET"
            ]
          },
          "body": {
            "fields": [
              "card",
              "ssn"
            ]
          },
          "mask": {}
        }
      ]
    }
  }
}

Measured result: /disclosure returned 200 with card and ssn masked.

Expected result: The selected synthetic values are absent and unrelated fields remain intact. Compare /disclosure-control, which this rule does not select.

Verified live example: View selected-field masking.

Data Guard

Visitor response: Supported credit-card and Social Security numbers are masked.

The data_guard_rules entry matches /data-guard and selects apply_data_guard. The path rule does not define new recognition patterns. Data Guard requires an application firewall attached through the load balancer’s app_firewall reference.

Data Guard path selection source

{
  "spec": {
    "data_guard_rules": [
      {
        "metadata": {
          "name": "mask-synthetic"
        },
        "any_domain": {},
        "path": {
          "path": "/data-guard"
        },
        "apply_data_guard": {}
      }
    ]
  }
}

Firewall attachment:

{
  "spec": {
    "app_firewall": {
      "name": "<APP_FIREWALL_NAME>",
      "namespace": "<XC_NAMESPACE>"
    }
  }
}

Measured result: /data-guard returned 200 with the recognized synthetic values masked.

Expected result: The sensitive values are hidden and other content remains intact. Compare /data-guard-control. Both rules share the JSON WAF load balancer but select separate paths. Compare each path with its matching control to identify the rule that changed the response.

Verified live example: View Data Guard masking.

For a complete rejection instead of selective response changes, see WAF blocking.