Manage personally identifiable information (PII) masking in proxy and sharedflow bundles

You're viewing Apigee Edge documentation.
Go to the Apigee X documentation. info

Manage PII masking in proxy and sharedflow bundles

As part of the synchronization process, API hub connector integration uploads your API proxy bundles to API hub. These bundles may contain sensitive data, or Personally Identifiable Information (PII), within policy configurations. This feature allows you to mask identified PII fields before the bundles are uploaded to API hub.

Masking approach

PII masking is applied using XPath expressions to target specific elements within policy configurations in the XML-formatted proxy and sharedflow bundles, but not to other general XML elements within the bundle. This feature is divided into two parts:

Default masks

Apigee Edge includes a pre-defined, built-in list of XPath expressions that automatically target common PII fields. These masks are applied automatically during the upload process.

List of default masks:

Manage custom masks

A dedicated API allows you to submit a customized list of XPath expressions to mask specific fields you identify as PII, ensuring your unique data privacy needs are met.

You can manage your organization's custom PII masks using the /v1/organizations/<var>ORG_NAME/uapim/proxymasks Edge management API endpoint. You must have the orgadmin role to perform these operations.

The API operates on a single list of XPaths named proxymasks for a given organization.

All requests and successful responses for creating, replacing, getting, appending, or deleting items from the XPath list use the following JSON schema:

{
  "xpaths": [
    "//Path/To/Element"
  ]
}

1. Create or replace the custom XPath list (PUT)

Use the PUT method to either create a new custom list or completely replace an existing list's contents. Any existing XPaths are overwritten.

curl -X PUT https://api.enterprise.apigee.com/v1/organizations/ORG_NAME/uapim/proxymasks \
  -H "Authorization: Bearer OAUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "xpaths": [
      "//StatisticsCollector/Statistics/Statistic[@name='caller']",
      "//AssignMessage/AssignVariable[Name='password']/Value"
    ]
  }'

When the update completes, a 201 Created or 200K response displays with the following message: Success response (201 Created or 200 OK)

{
  "xpaths": [
    "//StatisticsCollector/Statistics/Statistic[@name='caller']",
    "//AssignMessage/AssignVariable[Name='password']/Value"
  ]
}

2. Retrieve the custom XPath list (GET)

Use the GET method to retrieve the current list of custom XPath expressions.

curl -X GET https://api.enterprise.apigee.com/v1/organizations/ORG_NAME/uapim/proxymasks \
  -H "Authorization: Bearer OAUTH_TOKEN"

When the retrieve completes, a 200K response displays with the following message:Success response (200 OK):

{
  "xpaths": [
    "//StatisticsCollector/Statistics/Statistic[@name='caller']",
    "//AssignMessage/AssignVariable[Name='password']/Value"
  ]
}

3. Append XPaths to the list (POST append)

Use the POST method to append one or more XPath expressions to the existing list without overwriting the current content.

curl -X POST https://api.enterprise.apigee.com/v1/organizations/ORG_NAME/uapim/proxymasks/append \
  -H "Authorization: Bearer OAUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "xpaths": [
      "//New/Appended/XPath"
    ]
  }'

When the append completes, a 200K response displays with the following message: Success response (200 OK):

{
  "xpaths": [
    "//StatisticsCollector/Statistics/Statistic[@name='caller']",
    "//AssignMessage/AssignVariable[Name='password']/Value",
    "//New/Appended/XPath"
  ]
}

4. Delete specific XPaths from the list (POST deleteItems)

Use the POST method to remove specific XPath expressions from the existing list. The request must contain the exact XPath strings to be removed.

curl -X POST https://api.enterprise.apigee.com/v1/organizations/ORG_NAME/uapim/proxymasks/deleteItems \
  -H "Authorization: Bearer OAUTH_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "xpaths": [
      "//New/Appended/XPath"
    ]
  }'

When the delete completes, a 200K response displays with the following message: Success response (200 OK):

{
  "xpaths": [
    "//StatisticsCollector/Statistics/Statistic[@name='caller']",
    "//AssignMessage/AssignVariable[Name='password']/Value"
  ]
}

5. Delete the entire custom XPath list (DELETE)

Use the DELETE method to completely remove the custom XPath list. This will remove only the custom masks; default masks will still be applied.

curl -X DELETE https://api.enterprise.apigee.com/v1/organizations/ORG_NAME/uapim/proxymasks \
  -H "Authorization: Bearer OAUTH_TOKEN"

When the delete completes, a 204 No Content response displays with the following message: Success response (204 No Content):

HTTP/1.1 204 No Content

Updating masked bundles

When you modify your custom PII masking configuration, API proxy bundles that were previously uploaded with an older mask configuration need to be reprocessed with the latest masks. To update the bundles with the latest masking settings, please file a support ticket to initiate the necessary reprocessing.