In API Gateway, it is allowed to define data masking such that sensitive data can be masked per application level and it is responsed to caller.

Would like to full list of masking characters we can used in masking. Use Guide just mentions “*” and “#”, but didn’t provide explanation and full list.

You can specify any value you like if masking type is set to “Mask” in policy Request/Response processing:

Masking Type: Specifies the type of masking required. You select either Mask or Filter.

1. Selecting Mask replaces the value with the given value (the default value being ********).

2. Selecting Filter removes the field completely.

Mask Value: This is available if masking type selected is Mask. Provide a mask value. For example: “sold”, or any mask value like “####.”

Suppose an API return DOB in “yyyymmdd”. What is the correct mask value if I want certain application to see the output value as “yyyy*****” only?

For example, if original return value is “19920406”, I would like caller to see “1992****” only.

would mask value be “####****”?

Hi Kelvin, here’s some info I received about how to achieve this.
You can use a regex shown in the first image below to select the text part after the year and you can mask only that part with ****

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/6fb697dcd9ce5a3942ba42db73b4e55889d00c7a_2_1035x370.jpeg 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/6fb697dcd9ce5a3942ba42db73b4e55889d00c7a_2_1380x494.jpeg 2x" data-dominant-color="F7F8F8">

data mask 11616×580 42.1 KB

Actual response:

data mask 2840×275 14.7 KB

Masked response:

data mask 3825×200 13 KB

Note: regex will work only for text content types. If you are using json content types, use jsonpath and xpath for xml content types in response.

Hi Wayne, do you have any advice?

We try but fail to mask. Given the attached response json, suppose I want to mask details.database to keep first 4 chars but mask remaining chars, and mask details.validationQuery to keep first 2 chars such that:

details.database → Micr************
details.validationQuery → SE***********

What is the proper setting in masking criteria? From your example, we can’t configure masking a particular json node in the response.