- [Resource: DeidentifyTemplate](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate)
  - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.SCHEMA_REPRESENTATION)
  - [DeidentifyConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.DeidentifyConfig)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.DeidentifyConfig.SCHEMA_REPRESENTATION)
  - [InfoTypeTransformations](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.InfoTypeTransformations)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.InfoTypeTransformations.SCHEMA_REPRESENTATION)
  - [InfoTypeTransformation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.InfoTypeTransformation)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.InfoTypeTransformation.SCHEMA_REPRESENTATION)
  - [PrimitiveTransformation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.PrimitiveTransformation)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.PrimitiveTransformation.SCHEMA_REPRESENTATION)
  - [ReplaceValueConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceValueConfig)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceValueConfig.SCHEMA_REPRESENTATION)
  - [RedactConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RedactConfig)
  - [CharacterMaskConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CharacterMaskConfig)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CharacterMaskConfig.SCHEMA_REPRESENTATION)
  - [CharsToIgnore](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CharsToIgnore)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CharsToIgnore.SCHEMA_REPRESENTATION)
  - [CommonCharsToIgnore](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CommonCharsToIgnore)
  - [CryptoReplaceFfxFpeConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoReplaceFfxFpeConfig)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoReplaceFfxFpeConfig.SCHEMA_REPRESENTATION)
  - [CryptoKey](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoKey)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoKey.SCHEMA_REPRESENTATION)
  - [TransientCryptoKey](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TransientCryptoKey)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TransientCryptoKey.SCHEMA_REPRESENTATION)
  - [UnwrappedCryptoKey](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.UnwrappedCryptoKey)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.UnwrappedCryptoKey.SCHEMA_REPRESENTATION)
  - [KmsWrappedCryptoKey](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.KmsWrappedCryptoKey)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.KmsWrappedCryptoKey.SCHEMA_REPRESENTATION)
  - [FfxCommonNativeAlphabet](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.FfxCommonNativeAlphabet)
  - [FixedSizeBucketingConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.FixedSizeBucketingConfig)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.FixedSizeBucketingConfig.SCHEMA_REPRESENTATION)
  - [BucketingConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.BucketingConfig)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.BucketingConfig.SCHEMA_REPRESENTATION)
  - [Bucket](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Bucket)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Bucket.SCHEMA_REPRESENTATION)
  - [ReplaceWithInfoTypeConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceWithInfoTypeConfig)
  - [TimePartConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TimePartConfig)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TimePartConfig.SCHEMA_REPRESENTATION)
  - [TimePart](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TimePart)
  - [CryptoHashConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoHashConfig)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoHashConfig.SCHEMA_REPRESENTATION)
  - [DateShiftConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.DateShiftConfig)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.DateShiftConfig.SCHEMA_REPRESENTATION)
  - [CryptoDeterministicConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoDeterministicConfig)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoDeterministicConfig.SCHEMA_REPRESENTATION)
  - [ReplaceDictionaryConfig](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceDictionaryConfig)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceDictionaryConfig.SCHEMA_REPRESENTATION)
  - [RecordTransformations](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordTransformations)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordTransformations.SCHEMA_REPRESENTATION)
  - [FieldTransformation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.FieldTransformation)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.FieldTransformation.SCHEMA_REPRESENTATION)
  - [RecordCondition](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordCondition)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordCondition.SCHEMA_REPRESENTATION)
  - [Expressions](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Expressions)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Expressions.SCHEMA_REPRESENTATION)
  - [LogicalOperator](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.LogicalOperator)
  - [Conditions](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Conditions)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Conditions.SCHEMA_REPRESENTATION)
  - [Condition](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Condition)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Condition.SCHEMA_REPRESENTATION)
  - [RelationalOperator](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RelationalOperator)
  - [RecordSuppression](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordSuppression)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordSuppression.SCHEMA_REPRESENTATION)
  - [ImageTransformations](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ImageTransformations)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ImageTransformations.SCHEMA_REPRESENTATION)
  - [ImageTransformation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ImageTransformation)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ImageTransformation.SCHEMA_REPRESENTATION)
  - [SelectedInfoTypes](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.SelectedInfoTypes)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.SelectedInfoTypes.SCHEMA_REPRESENTATION)
  - [AllInfoTypes](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.AllInfoTypes)
  - [AllText](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.AllText)
  - [Color](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Color)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Color.SCHEMA_REPRESENTATION)
  - [TransformationErrorHandling](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TransformationErrorHandling)
    - [JSON representation](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TransformationErrorHandling.SCHEMA_REPRESENTATION)
  - [ThrowError](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ThrowError)
  - [LeaveUntransformed](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.LeaveUntransformed)
- [Methods](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#METHODS_SUMMARY)

## Resource: DeidentifyTemplate

DeidentifyTemplates contains instructions on how to de-identify content. See <https://docs.cloud.google.com/sensitive-data-protection/docs/concepts-templates> to learn more.

| JSON representation |
|---|
| ``` { "name": string, "displayName": string, "description": string, "createTime": string, "updateTime": string, "deidentifyConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.DeidentifyConfig`) } } ``` |

| Fields ||
|---|---|
| `name` | `string` Output only. The template name. The template will have one of the following formats: `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID` |
| `displayName` | `string` Display name (max 256 chars). |
| `description` | `string` Short description (max 256 chars). |
| `createTime` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#timestamp` format)`` Output only. The creation timestamp of an inspectTemplate. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`. |
| `updateTime` | ``string (`https://protobuf.dev/reference/protobuf/google.protobuf#timestamp` format)`` Output only. The last update timestamp of an inspectTemplate. Uses RFC 3339, where generated output will always be Z-normalized and use 0, 3, 6 or 9 fractional digits. Offsets other than "Z" are also accepted. Examples: `"2014-10-02T15:01:23Z"`, `"2014-10-02T15:01:23.045123456Z"` or `"2014-10-02T15:01:23+05:30"`. |
| `deidentifyConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.DeidentifyConfig`)`` The core content of the template. |

### DeidentifyConfig

The configuration that controls how the data will change.

| JSON representation |
|---|
| ``` { "transformationErrorHandling": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TransformationErrorHandling`) }, // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "infoTypeTransformations": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.InfoTypeTransformations`) }, "recordTransformations": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordTransformations`) }, "imageTransformations": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ImageTransformations`) } // End of mutually exclusive fields. } ``` |

| Fields ||
|---|---|
| `transformationErrorHandling` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TransformationErrorHandling`)`` Mode for handling transformation errors. If left unspecified, the default mode is `TransformationErrorHandling.ThrowError`. |
| Type of transformation The following is a list of mutually exclusive fields. At most one of the fields will be set in a response: ||
| `infoTypeTransformations` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.InfoTypeTransformations`)`` Treat the dataset as free-form text and apply the same free text transformation everywhere. |
| `recordTransformations` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordTransformations`)`` Treat the dataset as structured. Transformations can be applied to specific locations within structured datasets, such as transforming a column within a table. |
| `imageTransformations` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ImageTransformations`)`` Treat the dataset as an image and redact. |
| End of mutually exclusive fields. ||

### InfoTypeTransformations

A type of transformation that will scan unstructured text and apply various `PrimitiveTransformation`s to each finding, where the transformation is applied to only values that were identified as a specific infoType.

| JSON representation |
|---|
| ``` { "transformations": [ { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.InfoTypeTransformation`) } ] } ``` |

| Fields ||
|---|---|
| `transformations[]` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.InfoTypeTransformation`)`` Required. Transformation for each infoType. Cannot specify more than one for a given infoType. |

### InfoTypeTransformation

A transformation to apply to text that is identified as a specific infoType.

| JSON representation |
|---|
| ``` { "infoTypes": [ { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/InfoType`) } ], "primitiveTransformation": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.PrimitiveTransformation`) } } ``` |

| Fields ||
|---|---|
| `infoTypes[]` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/InfoType`)`` InfoTypes to apply the transformation to. An empty list will cause this transformation to apply to all findings that correspond to infoTypes that were requested in `InspectConfig`. |
| `primitiveTransformation` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.PrimitiveTransformation`)`` Required. Primitive transformation to apply to the infoType. |

### PrimitiveTransformation

A rule for transforming a value.

| JSON representation |
|---|
| ``` { // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "replaceConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceValueConfig`) }, "redactConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RedactConfig`) }, "characterMaskConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CharacterMaskConfig`) }, "cryptoReplaceFfxFpeConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoReplaceFfxFpeConfig`) }, "fixedSizeBucketingConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.FixedSizeBucketingConfig`) }, "bucketingConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.BucketingConfig`) }, "replaceWithInfoTypeConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceWithInfoTypeConfig`) }, "timePartConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TimePartConfig`) }, "cryptoHashConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoHashConfig`) }, "dateShiftConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.DateShiftConfig`) }, "cryptoDeterministicConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoDeterministicConfig`) }, "replaceDictionaryConfig": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceDictionaryConfig`) } // End of mutually exclusive fields. } ``` |

| Fields ||
|---|---|
| Type of transformation. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response: ||
| `replaceConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceValueConfig`)`` Replace with a specified value. |
| `redactConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RedactConfig`)`` Redact |
| `characterMaskConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CharacterMaskConfig`)`` Mask |
| `cryptoReplaceFfxFpeConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoReplaceFfxFpeConfig`)`` Ffx-Fpe. Strongly discouraged, consider using CryptoDeterministicConfig instead. Fpe is computationally expensive incurring latency costs. |
| `fixedSizeBucketingConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.FixedSizeBucketingConfig`)`` Fixed size bucketing |
| `bucketingConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.BucketingConfig`)`` Bucketing |
| `replaceWithInfoTypeConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceWithInfoTypeConfig`)`` Replace with infotype |
| `timePartConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TimePartConfig`)`` Time extraction |
| `cryptoHashConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoHashConfig`)`` Crypto |
| `dateShiftConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.DateShiftConfig`)`` Date Shift |
| `cryptoDeterministicConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoDeterministicConfig`)`` Deterministic Crypto |
| `replaceDictionaryConfig` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ReplaceDictionaryConfig`)`` Replace with a value randomly drawn (with replacement) from a dictionary. |
| End of mutually exclusive fields. ||

### ReplaceValueConfig

Replace each input value with a given `Value`.

| JSON representation |
|---|
| ``` { "newValue": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`) } } ``` |

| Fields ||
|---|---|
| `newValue` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`)`` Value to replace it with. |

### RedactConfig

This type has no fields.
Redact a given value. For example, if used with an `InfoTypeTransformation` transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the output would be 'My phone number is '.

### CharacterMaskConfig

Partially mask a string by replacing a given number of characters with a fixed character. Masking can start from the beginning or end of the string. This can be used on data of any type (numbers, longs, and so on) and when de-identifying structured data we'll attempt to preserve the original data's type. (This allows you to take a long like 123 and modify it to a string like \*\*3.

| JSON representation |
|---|
| ``` { "maskingCharacter": string, "numberToMask": integer, "reverseOrder": boolean, "charactersToIgnore": [ { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CharsToIgnore`) } ] } ``` |

| Fields ||
|---|---|
| `maskingCharacter` | `string` Character to use to mask the sensitive values---for example, `*` for an alphabetic string such as a name, or `0` for a numeric string such as ZIP code or credit card number. This string must have a length of 1. If not supplied, this value defaults to `*` for strings, and `0` for digits. |
| `numberToMask` | `integer` Number of characters to mask. If not set, all matching chars will be masked. Skipped characters do not count towards this tally. If `numberToMask` is negative, this denotes inverse masking. Cloud DLP masks all but a number of characters. For example, suppose you have the following values: - `maskingCharacter` is `*` - `numberToMask` is `-4` - `reverseOrder` is `false` - `CharsToIgnore` includes `-` - Input string is `1234-5678-9012-3456` The resulting de-identified string is `****-****-****-3456`. Cloud DLP masks all but the last four characters. If `reverseOrder` is `true`, all but the first four characters are masked as `1234-****-****-****`. |
| `reverseOrder` | `boolean` Mask characters in reverse order. For example, if `maskingCharacter` is `0`, `numberToMask` is `14`, and `reverseOrder` is `false`, then the input string `1234-5678-9012-3456` is masked as `00000000000000-3456`. If `maskingCharacter` is `*`, `numberToMask` is `3`, and `reverseOrder` is `true`, then the string `12345` is masked as `12***`. |
| `charactersToIgnore[]` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CharsToIgnore`)`` When masking a string, items in this list will be skipped when replacing characters. For example, if the input string is `555-555-5555` and you instruct Cloud DLP to skip `-` and mask 5 characters with `*`, Cloud DLP returns `***-**5-5555`. |

### CharsToIgnore

Characters to skip when doing deidentification of a value. These will be left alone and skipped.

| JSON representation |
|---|
| ``` { // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "charactersToSkip": string, "commonCharactersToIgnore": enum (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CommonCharsToIgnore`) // End of mutually exclusive fields. } ``` |

| Fields ||
|---|---|
| Type of characters to skip. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response: ||
| `charactersToSkip` | `string` Characters to not transform when masking. |
| `commonCharactersToIgnore` | ``enum (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CommonCharsToIgnore`)`` Common characters to not transform when masking. Useful to avoid removing punctuation. |
| End of mutually exclusive fields. ||

### CommonCharsToIgnore

Convenience enum for indicating common characters to not transform.

| Enums ||
|---|---|
| `COMMON_CHARS_TO_IGNORE_UNSPECIFIED` | Unused. |
| `NUMERIC` | 0-9 |
| `ALPHA_UPPER_CASE` | A-Z |
| `ALPHA_LOWER_CASE` | a-z |
| `PUNCTUATION` | US Punctuation, one of !"#$%\&'()\*+,-./:;\<=\>?@\[\]\^_\`{\|}\~ |
| `WHITESPACE` | Whitespace character, one of \[ \\t\\n\\x0B\\f\\r\] |

### CryptoReplaceFfxFpeConfig

Replaces an identifier with a surrogate using Format Preserving Encryption (FPE) with the FFX mode of operation; however when used in the `content.reidentify` API method, it serves the opposite function by reversing the surrogate back into the original identifier. The identifier must be encoded as ASCII. For a given crypto key and context, the same identifier will be replaced with the same surrogate. Identifiers must be at least two characters long. In the case that the identifier is the empty string, it will be skipped. See <https://docs.cloud.google.com/sensitive-data-protection/docs/pseudonymization> to learn more.

Note: We recommend using CryptoDeterministicConfig for all use cases which do not require preserving the input alphabet space and size, plus warrant referential integrity. FPE incurs significant latency costs.

| JSON representation |
|---|
| ``` { "cryptoKey": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoKey`) }, "context": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/FieldId`) }, "surrogateInfoType": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/InfoType`) }, // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "commonAlphabet": enum (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.FfxCommonNativeAlphabet`), "customAlphabet": string, "radix": integer // End of mutually exclusive fields. } ``` |

| Fields ||
|---|---|
| `cryptoKey` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoKey`)`` Required. The key used by the encryption algorithm. |
| `context` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/FieldId`)`` The 'tweak', a context may be used for higher security since the same identifier in two different contexts won't be given the same surrogate. If the context is not set, a default tweak will be used. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, a default tweak will be used. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and unstructured `ContentItem`s. Currently, the referenced field may be of value type integer or string. The tweak is constructed as a sequence of bytes in big endian byte order such that: - a 64 bit integer is encoded followed by a single byte of value 1 - a string is encoded in UTF-8 format followed by a single byte of value 2 |
| `surrogateInfoType` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/InfoType`)`` The custom infoType to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom infoType followed by the number of characters comprising the surrogate. The following scheme defines the format: infoTypeName(surrogate_character_count):surrogate For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom infoType [`SurrogateType`](https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/InspectConfig#surrogatetype). This facilitates reversal of the surrogate when it occurs in free text. In order for inspection to work properly, the name of this infoType must not occur naturally anywhere in your data; otherwise, inspection may find a surrogate that does not correspond to an actual identifier. Therefore, choose your custom infoType name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE |
| Choose an alphabet which the data being transformed will be made up of. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response: ||
| `commonAlphabet` | ``enum (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.FfxCommonNativeAlphabet`)`` Common alphabets. |
| `customAlphabet` | `string` This is supported by mapping these to the alphanumeric characters that the FFX mode natively supports. This happens before/after encryption/decryption. Each character listed must appear only once. Number of characters must be in the range \[2, 95\]. This must be encoded as ASCII. The order of characters does not matter. The full list of allowed characters is: ``0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz~`!@#$%^&*()_-+={[}]|\:;"'<,>.?/`` |
| `radix` | `integer` The native way to select the alphabet. Must be in the range \[2, 95\]. |
| End of mutually exclusive fields. ||

### CryptoKey

This is a data encryption key (DEK) (as opposed to a key encryption key (KEK) stored by Cloud Key Management Service (Cloud KMS). When using Cloud KMS to wrap or unwrap a DEK, be sure to set an appropriate IAM policy on the KEK to ensure an attacker cannot unwrap the DEK.

| JSON representation |
|---|
| ``` { // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "transient": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TransientCryptoKey`) }, "unwrapped": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.UnwrappedCryptoKey`) }, "kmsWrapped": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.KmsWrappedCryptoKey`) } // End of mutually exclusive fields. } ``` |

| Fields ||
|---|---|
| Sources of crypto keys. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response: ||
| `transient` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TransientCryptoKey`)`` Transient crypto key |
| `unwrapped` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.UnwrappedCryptoKey`)`` Unwrapped crypto key |
| `kmsWrapped` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.KmsWrappedCryptoKey`)`` Key wrapped using Cloud KMS |
| End of mutually exclusive fields. ||

### TransientCryptoKey

Use this to have a random data crypto key generated. It will be discarded after the request finishes.

| JSON representation |
|---|
| ``` { "name": string } ``` |

| Fields ||
|---|---|
| `name` | `string` Required. Name of the key. This is an arbitrary string used to differentiate different keys. A unique key is generated per name: two separate `TransientCryptoKey` protos share the same generated key if their names are the same. When the data crypto key is generated, this name is not used in any way (repeating the api call will result in a different key being generated). |

### UnwrappedCryptoKey

Using raw keys is prone to security risks due to accidentally leaking the key. Choose another type of key if possible.

| JSON representation |
|---|
| ``` { "key": string } ``` |

| Fields ||
|---|---|
| `key` | `string (https://developers.google.com/discovery/v1/type-format format)` Required. A 128/192/256 bit key. A base64-encoded string. |

### KmsWrappedCryptoKey

Include to use an existing data crypto key wrapped by KMS. The wrapped key must be a 128-, 192-, or 256-bit key. Authorization requires the following IAM permissions when sending a request to perform a crypto transformation using a KMS-wrapped crypto key: dlp.kms.encrypt

For more information, see [Creating a wrapped key](https://docs.cloud.google.com/sensitive-data-protection/docs/create-wrapped-key).

Note: When you use Cloud KMS for cryptographic operations, [charges apply](https://cloud.google.com/kms/pricing).

| JSON representation |
|---|
| ``` { "wrappedKey": string, "cryptoKeyName": string } ``` |

| Fields ||
|---|---|
| `wrappedKey` | `string (https://developers.google.com/discovery/v1/type-format format)` Required. The wrapped data crypto key. A base64-encoded string. |
| `cryptoKeyName` | `string` Required. The resource name of the KMS CryptoKey to use for unwrapping. |

### FfxCommonNativeAlphabet

These are commonly used subsets of the alphabet that the FFX mode natively supports. In the algorithm, the alphabet is selected using the "radix". Therefore each corresponds to a particular radix.

| Enums ||
|---|---|
| `FFX_COMMON_NATIVE_ALPHABET_UNSPECIFIED` | Unused. |
| `NUMERIC` | `[0-9]` (radix of 10) |
| `HEXADECIMAL` | `[0-9A-F]` (radix of 16) |
| `UPPER_CASE_ALPHA_NUMERIC` | `[0-9A-Z]` (radix of 36) |
| `ALPHA_NUMERIC` | `[0-9A-Za-z]` (radix of 62) |

### FixedSizeBucketingConfig

Buckets values based on fixed size ranges. The Bucketing transformation can provide all of this functionality, but requires more configuration. This message is provided as a convenience to the user for simple bucketing strategies.

The transformed value will be a hyphenated string of {lowerBound}-{upperBound}. For example, if lowerBound = 10 and upperBound = 20, all values that are within this bucket will be replaced with "10-20".

This can be used on data of type: double, long.

If the bound Value type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing.

See <https://docs.cloud.google.com/sensitive-data-protection/docs/concepts-bucketing> to learn more.

| JSON representation |
|---|
| ``` { "lowerBound": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`) }, "upperBound": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`) }, "bucketSize": number } ``` |

| Fields ||
|---|---|
| `lowerBound` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`)`` Required. Lower bound value of buckets. All values less than `lowerBound` are grouped together into a single bucket; for example if `lowerBound` = 10, then all values less than 10 are replaced with the value "-10". |
| `upperBound` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`)`` Required. Upper bound value of buckets. All values greater than upperBound are grouped together into a single bucket; for example if `upperBound` = 89, then all values greater than 89 are replaced with the value "89+". |
| `bucketSize` | `number` Required. Size of each bucket (except for minimum and maximum buckets). So if `lowerBound` = 10, `upperBound` = 89, and `bucketSize` = 10, then the following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60, 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works. |

### BucketingConfig

Generalization function that buckets values based on ranges. The ranges and replacement values are dynamically provided by the user for custom behavior, such as 1-30 -\> LOW, 31-65 -\> MEDIUM, 66-100 -\> HIGH.

This can be used on data of type: number, long, string, timestamp.

If the bound `Value` type differs from the type of data being transformed, we will first attempt converting the type of the data to be transformed to match the type of the bound before comparing. See <https://docs.cloud.google.com/sensitive-data-protection/docs/concepts-bucketing> to learn more.

| JSON representation |
|---|
| ``` { "buckets": [ { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Bucket`) } ] } ``` |

| Fields ||
|---|---|
| `buckets[]` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Bucket`)`` Set of buckets. Ranges must be non-overlapping. |

### Bucket

Bucket is represented as a range, along with replacement values.

| JSON representation |
|---|
| ``` { "min": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`) }, "max": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`) }, "replacementValue": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`) } } ``` |

| Fields ||
|---|---|
| `min` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`)`` Lower bound of the range, inclusive. Type should be the same as max if used. |
| `max` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`)`` Upper bound of the range, exclusive; type must match min. |
| `replacementValue` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`)`` Required. Replacement value for this bucket. |

### ReplaceWithInfoTypeConfig

This type has no fields.
Replace each matching finding with the name of the infoType.

### TimePartConfig

For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a portion of the value.

| JSON representation |
|---|
| ``` { "partToExtract": enum (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TimePart`) } ``` |

| Fields ||
|---|---|
| `partToExtract` | ``enum (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.TimePart`)`` The part of the time to keep. |

### TimePart

Components that make up time.

| Enums ||
|---|---|
| `TIME_PART_UNSPECIFIED` | Unused |
| `YEAR` | \[0-9999\] |
| `MONTH` | \[1-12\] |
| `DAY_OF_MONTH` | \[1-31\] |
| `DAY_OF_WEEK` | \[1-7\] |
| `WEEK_OF_YEAR` | \[1-53\] |
| `HOUR_OF_DAY` | \[0-23\] |

### CryptoHashConfig

Pseudonymization method that generates surrogates via cryptographic hashing. Uses SHA-256. The key size must be either 32 or 64 bytes. Outputs a base64 encoded representation of the hashed output (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=). Currently, only string and integer values can be hashed. See <https://docs.cloud.google.com/sensitive-data-protection/docs/pseudonymization> to learn more.

| JSON representation |
|---|
| ``` { "cryptoKey": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoKey`) } } ``` |

| Fields ||
|---|---|
| `cryptoKey` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoKey`)`` The key used by the hash function. |

### DateShiftConfig

Shifts dates by random number of days, with option to be consistent for the same context. See <https://docs.cloud.google.com/sensitive-data-protection/docs/concepts-date-shifting> to learn more.

| JSON representation |
|---|
| ``` { "upperBoundDays": integer, "lowerBoundDays": integer, "context": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/FieldId`) }, // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "cryptoKey": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoKey`) } // End of mutually exclusive fields. } ``` |

| Fields ||
|---|---|
| `upperBoundDays` | `integer` Required. Range of shift in days. Actual shift will be selected at random within this range (inclusive ends). Negative means shift to earlier in time. Must not be more than 365250 days (1000 years) each direction. For example, 3 means shift date to at most 3 days into the future. |
| `lowerBoundDays` | `integer` Required. For example, -5 means shift date to at most 5 days back in the past. |
| `context` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/FieldId`)`` Points to the field that contains the context, for example, an entity id. If set, must also set cryptoKey. If set, shift will be consistent for the given context. |
| Method for calculating shift that takes context into consideration. If set, must also set context. Can only be applied to table items. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response: ||
| `cryptoKey` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoKey`)`` Causes the shift to be computed based on this key and the context. This results in the same shift for the same context and cryptoKey. If set, must also set context. Can only be applied to table items. |
| End of mutually exclusive fields. ||

### CryptoDeterministicConfig

Pseudonymization method that generates deterministic encryption for the given input. Outputs a base64 encoded representation of the encrypted output. Uses AES-SIV based on the RFC <https://tools.ietf.org/html/rfc5297>.

| JSON representation |
|---|
| ``` { "cryptoKey": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoKey`) }, "surrogateInfoType": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/InfoType`) }, "context": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/FieldId`) } } ``` |

| Fields ||
|---|---|
| `cryptoKey` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.CryptoKey`)`` The key used by the encryption function. For deterministic encryption using AES-SIV, the provided key is internally expanded to 64 bytes prior to use. |
| `surrogateInfoType` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/InfoType`)`` The custom info type to annotate the surrogate with. This annotation will be applied to the surrogate by prefixing it with the name of the custom info type followed by the number of characters comprising the surrogate. The following scheme defines the format: {info type name}({surrogate character count}):{surrogate} For example, if the name of custom info type is 'MY_TOKEN_INFO_TYPE' and the surrogate is 'abc', the full replacement value will be: 'MY_TOKEN_INFO_TYPE(3):abc' This annotation identifies the surrogate when inspecting content using the custom info type 'Surrogate'. This facilitates reversal of the surrogate when it occurs in free text. Note: For record transformations where the entire cell in a table is being transformed, surrogates are not mandatory. Surrogates are used to denote the location of the token and are necessary for re-identification in free form text. In order for inspection to work properly, the name of this info type must not occur naturally anywhere in your data; otherwise, inspection may either - reverse a surrogate that does not correspond to an actual identifier - be unable to parse the surrogate and result in an error Therefore, choose your custom info type name carefully after considering what your data looks like. One way to select a name that has a high chance of yielding reliable detection is to include one or more unicode characters that are highly improbable to exist in your data. For example, assuming your data is entered from a regular ASCII keyboard, the symbol with the hex code point 29DD might be used like so: ⧝MY_TOKEN_TYPE. |
| `context` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/FieldId`)`` A context may be used for higher security and maintaining referential integrity such that the same identifier in two different contexts will be given a distinct surrogate. The context is appended to plaintext value being encrypted. On decryption the provided context is validated against the value used during encryption. If a context was provided during encryption, same context must be provided during decryption as well. If the context is not set, plaintext would be used as is for encryption. If the context is set but: 1. there is no record present when transforming a given value or 2. the field is not present when transforming a given value, plaintext would be used as is for encryption. Note that case (1) is expected when an `InfoTypeTransformation` is applied to both structured and unstructured `ContentItem`s. |

### ReplaceDictionaryConfig

Replace each input value with a value randomly selected from the dictionary.

| JSON representation |
|---|
| ``` { // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "wordList": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/WordList`) } // End of mutually exclusive fields. } ``` |

| Fields ||
|---|---|
| Type of dictionary. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response: ||
| `wordList` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/WordList`)`` A list of words to select from for random replacement. The [limits](https://docs.cloud.google.com/sensitive-data-protection/limits) page contains details about the size limits of dictionaries. |
| End of mutually exclusive fields. ||

### RecordTransformations

A type of transformation that is applied over structured data such as a table.

| JSON representation |
|---|
| ``` { "fieldTransformations": [ { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.FieldTransformation`) } ], "recordSuppressions": [ { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordSuppression`) } ] } ``` |

| Fields ||
|---|---|
| `fieldTransformations[]` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.FieldTransformation`)`` Transform the record by applying various field transformations. |
| `recordSuppressions[]` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordSuppression`)`` Configuration defining which records get suppressed entirely. Records that match any suppression rule are omitted from the output. |

### FieldTransformation

The transformation to apply to the field.

| JSON representation |
|---|
| ``` { "fields": [ { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/FieldId`) } ], "condition": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordCondition`) }, // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "primitiveTransformation": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.PrimitiveTransformation`) }, "infoTypeTransformations": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.InfoTypeTransformations`) } // End of mutually exclusive fields. } ``` |

| Fields ||
|---|---|
| `fields[]` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/FieldId`)`` Required. Input field(s) to apply the transformation to. When you have columns that reference their position within a list, omit the index from the FieldId. FieldId name matching ignores the index. For example, instead of "contact.nums\[0\].type", use "contact.nums.type". |
| `condition` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordCondition`)`` Only apply the transformation if the condition evaluates to true for the given `RecordCondition`. The conditions are allowed to reference fields that are not used in the actual transformation. Example Use Cases: - Apply a different bucket transformation to an age column if the zip code column for the same record is within a specific range. - Redact a field if the date of birth field is greater than 85. |
| Transformation to apply. \[required\] The following is a list of mutually exclusive fields. At most one of the fields will be set in a response: ||
| `primitiveTransformation` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.PrimitiveTransformation`)`` Apply the transformation to the entire field. |
| `infoTypeTransformations` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.InfoTypeTransformations`)`` Treat the contents of the field as free text, and selectively transform content that matches an `InfoType`. |
| End of mutually exclusive fields. ||

### RecordCondition

A condition for determining whether a transformation should be applied to a field.

| JSON representation |
|---|
| ``` { "expressions": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Expressions`) } } ``` |

| Fields ||
|---|---|
| `expressions` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Expressions`)`` An expression. |

### Expressions

An expression, consisting of an operator and conditions.

| JSON representation |
|---|
| ``` { "logicalOperator": enum (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.LogicalOperator`), // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "conditions": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Conditions`) } // End of mutually exclusive fields. } ``` |

| Fields ||
|---|---|
| `logicalOperator` | ``enum (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.LogicalOperator`)`` The operator to apply to the result of conditions. Default and currently only supported value is `AND`. |
| Expression types. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response: ||
| `conditions` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Conditions`)`` Conditions to apply to the expression. |
| End of mutually exclusive fields. ||

### LogicalOperator

Logical operators for conditional checks.

| Enums ||
|---|---|
| `LOGICAL_OPERATOR_UNSPECIFIED` | Unused |
| `AND` | Conditional AND |

### Conditions

A collection of conditions.

| JSON representation |
|---|
| ``` { "conditions": [ { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Condition`) } ] } ``` |

| Fields ||
|---|---|
| `conditions[]` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Condition`)`` A collection of conditions. |

### Condition

The field type of `value` and `field` do not need to match to be considered equal, but not all comparisons are possible. EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types, but all other comparisons are invalid with incompatible types. A `value` of type:

- `string` can be compared against all other types
- `boolean` can only be compared against other booleans
- `integer` can be compared against doubles or a string if the string value can be parsed as an integer.
- `double` can be compared against integers or a string if the string can be parsed as a double.
- `Timestamp` can be compared against strings in RFC 3339 date string format.
- `TimeOfDay` can be compared against timestamps and strings in the format of 'HH:mm:ss'.

If we fail to compare do to type mismatch, a warning will be given and the condition will evaluate to false.

| JSON representation |
|---|
| ``` { "field": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/FieldId`) }, "operator": enum (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RelationalOperator`), "value": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`) } } ``` |

| Fields ||
|---|---|
| `field` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/FieldId`)`` Required. Field within the record this condition is evaluated against. |
| `operator` | ``enum (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RelationalOperator`)`` Required. Operator used to compare the field or infoType to the value. |
| `value` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/Value`)`` Value to compare against. \[Mandatory, except for `EXISTS` tests.\] |

### RelationalOperator

Operators available for comparing the value of fields.

| Enums ||
|---|---|
| `RELATIONAL_OPERATOR_UNSPECIFIED` | Unused |
| `EQUAL_TO` | Equal. Attempts to match even with incompatible types. |
| `NOT_EQUAL_TO` | Not equal to. Attempts to match even with incompatible types. |
| `GREATER_THAN` | Greater than. |
| `LESS_THAN` | Less than. |
| `GREATER_THAN_OR_EQUALS` | Greater than or equals. |
| `LESS_THAN_OR_EQUALS` | Less than or equals. |
| `EXISTS` | Exists |

### RecordSuppression

Configuration to suppress records whose suppression conditions evaluate to true.

| JSON representation |
|---|
| ``` { "condition": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordCondition`) } } ``` |

| Fields ||
|---|---|
| `condition` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.RecordCondition`)`` A condition that when it evaluates to true will result in the record being evaluated to be suppressed from the transformed content. |

### ImageTransformations

A type of transformation that is applied over images.

| JSON representation |
|---|
| ``` { "transforms": [ { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ImageTransformation`) } ] } ``` |

| Fields ||
|---|---|
| `transforms[]` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ImageTransformation`)`` List of transforms to make. |

### ImageTransformation

Configuration for determining how redaction of images should occur.

| JSON representation |
|---|
| ``` { "redactionColor": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Color`) }, // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "selectedInfoTypes": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.SelectedInfoTypes`) }, "allInfoTypes": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.AllInfoTypes`) }, "allText": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.AllText`) } // End of mutually exclusive fields. } ``` |

| Fields ||
|---|---|
| `redactionColor` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.Color`)`` The color to use when redacting content from an image. If not specified, the default is black. |
| Part of the image to transform. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response: ||
| `selectedInfoTypes` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.SelectedInfoTypes`)`` Apply transformation to the selected infoTypes. |
| `allInfoTypes` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.AllInfoTypes`)`` Apply transformation to all findings not specified in other ImageTransformation's selectedInfoTypes. Only one instance is allowed within the ImageTransformations message. |
| `allText` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.AllText`)`` Apply transformation to all text that doesn't match an infoType. Only one instance is allowed within the ImageTransformations message. |
| End of mutually exclusive fields. ||

### SelectedInfoTypes

Apply transformation to the selected infoTypes.

| JSON representation |
|---|
| ``` { "infoTypes": [ { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/InfoType`) } ] } ``` |

| Fields ||
|---|---|
| `infoTypes[]` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/InfoType`)`` Required. InfoTypes to apply the transformation to. Required. Provided InfoType must be unique within the ImageTransformations message. |

### AllInfoTypes

This type has no fields.
Apply transformation to all findings.

### AllText

This type has no fields.
Apply to all text.

### Color

Represents a color in the RGB color space.

| JSON representation |
|---|
| ``` { "red": number, "green": number, "blue": number } ``` |

| Fields ||
|---|---|
| `red` | `number` The amount of red in the color as a value in the interval \[0, 1\]. |
| `green` | `number` The amount of green in the color as a value in the interval \[0, 1\]. |
| `blue` | `number` The amount of blue in the color as a value in the interval \[0, 1\]. |

### TransformationErrorHandling

How to handle transformation errors during de-identification. A transformation error occurs when the requested transformation is incompatible with the data. For example, trying to de-identify an IP address using a `DateShift` transformation would result in a transformation error, since date info cannot be extracted from an IP address. Information about any incompatible transformations, and how they were handled, is returned in the response as part of the `TransformationOverviews`.

| JSON representation |
|---|
| ``` { // The following is a list of mutually exclusive fields. At most one of the // fields will be set in a response: "throwError": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ThrowError`) }, "leaveUntransformed": { object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.LeaveUntransformed`) } // End of mutually exclusive fields. } ``` |

| Fields ||
|---|---|
| How transformation errors should be handled. The following is a list of mutually exclusive fields. At most one of the fields will be set in a response: ||
| `throwError` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.ThrowError`)`` Throw an error |
| `leaveUntransformed` | ``object (`https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates#DeidentifyTemplate.LeaveUntransformed`)`` Ignore errors |
| End of mutually exclusive fields. ||

### ThrowError

This type has no fields.
Throw an error and fail the request when a transformation error occurs.

### LeaveUntransformed

This type has no fields.
Skips the data without modifying it if the requested transformation would cause an error. For example, if a `DateShift` transformation were applied an an IP address, this mode would leave the IP address unchanged in the response.

| ## Methods ||
|---|---|
| ### `https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates/create` | Creates a DeidentifyTemplate for reusing frequently used configuration for de-identifying content, images, and storage. |
| ### `https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates/delete` | Deletes a DeidentifyTemplate. |
| ### `https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates/get` | Gets a DeidentifyTemplate. |
| ### `https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates/list` | Lists DeidentifyTemplates. |
| ### `https://docs.cloud.google.com/sensitive-data-protection/docs/reference/rest/v2/projects.deidentifyTemplates/patch` | Updates the DeidentifyTemplate. |