3114 lines
109 KiB
Protocol Buffer
3114 lines
109 KiB
Protocol Buffer
// Copyright 2018 Google LLC.
|
||
//
|
||
// Licensed under the Apache License, Version 2.0 (the "License");
|
||
// you may not use this file except in compliance with the License.
|
||
// You may obtain a copy of the License at
|
||
//
|
||
// http://www.apache.org/licenses/LICENSE-2.0
|
||
//
|
||
// Unless required by applicable law or agreed to in writing, software
|
||
// distributed under the License is distributed on an "AS IS" BASIS,
|
||
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
// See the License for the specific language governing permissions and
|
||
// limitations under the License.
|
||
//
|
||
|
||
syntax = "proto3";
|
||
|
||
package google.privacy.dlp.v2;
|
||
|
||
import "google/api/annotations.proto";
|
||
import "google/privacy/dlp/v2/storage.proto";
|
||
import "google/protobuf/duration.proto";
|
||
import "google/protobuf/empty.proto";
|
||
import "google/protobuf/field_mask.proto";
|
||
import "google/protobuf/timestamp.proto";
|
||
import "google/rpc/status.proto";
|
||
import "google/type/date.proto";
|
||
import "google/type/dayofweek.proto";
|
||
import "google/type/timeofday.proto";
|
||
|
||
option csharp_namespace = "Google.Cloud.Dlp.V2";
|
||
option go_package = "google.golang.org/genproto/googleapis/privacy/dlp/v2;dlp";
|
||
option java_multiple_files = true;
|
||
option java_outer_classname = "DlpProto";
|
||
option java_package = "com.google.privacy.dlp.v2";
|
||
option php_namespace = "Google\\Cloud\\Dlp\\V2";
|
||
|
||
// The Cloud Data Loss Prevention (DLP) API is a service that allows clients
|
||
// to detect the presence of Personally Identifiable Information (PII) and other
|
||
// privacy-sensitive data in user-supplied, unstructured data streams, like text
|
||
// blocks or images.
|
||
// The service also includes methods for sensitive data redaction and
|
||
// scheduling of data scans on Google Cloud Platform based data sets.
|
||
//
|
||
// To learn more about concepts and find how-to guides see
|
||
// https://cloud.google.com/dlp/docs/.
|
||
service DlpService {
|
||
// Finds potentially sensitive info in content.
|
||
// This method has limits on input size, processing time, and output size.
|
||
//
|
||
// When no InfoTypes or CustomInfoTypes are specified in this request, the
|
||
// system will automatically choose what detectors to run. By default this may
|
||
// be all types, but may change over time as detectors are updated.
|
||
//
|
||
// For how to guides, see https://cloud.google.com/dlp/docs/inspecting-images
|
||
// and https://cloud.google.com/dlp/docs/inspecting-text,
|
||
rpc InspectContent(InspectContentRequest) returns (InspectContentResponse) {
|
||
option (google.api.http) = {
|
||
post: "/v2/{parent=projects/*}/content:inspect"
|
||
body: "*"
|
||
};
|
||
}
|
||
|
||
// Redacts potentially sensitive info from an image.
|
||
// This method has limits on input size, processing time, and output size.
|
||
// See https://cloud.google.com/dlp/docs/redacting-sensitive-data-images to
|
||
// learn more.
|
||
//
|
||
// When no InfoTypes or CustomInfoTypes are specified in this request, the
|
||
// system will automatically choose what detectors to run. By default this may
|
||
// be all types, but may change over time as detectors are updated.
|
||
rpc RedactImage(RedactImageRequest) returns (RedactImageResponse) {
|
||
option (google.api.http) = {
|
||
post: "/v2/{parent=projects/*}/image:redact"
|
||
body: "*"
|
||
};
|
||
}
|
||
|
||
// De-identifies potentially sensitive info from a ContentItem.
|
||
// This method has limits on input size and output size.
|
||
// See https://cloud.google.com/dlp/docs/deidentify-sensitive-data to
|
||
// learn more.
|
||
//
|
||
// When no InfoTypes or CustomInfoTypes are specified in this request, the
|
||
// system will automatically choose what detectors to run. By default this may
|
||
// be all types, but may change over time as detectors are updated.
|
||
rpc DeidentifyContent(DeidentifyContentRequest)
|
||
returns (DeidentifyContentResponse) {
|
||
option (google.api.http) = {
|
||
post: "/v2/{parent=projects/*}/content:deidentify"
|
||
body: "*"
|
||
};
|
||
}
|
||
|
||
// Re-identifies content that has been de-identified.
|
||
// See
|
||
// https://cloud.google.com/dlp/docs/pseudonymization#re-identification_in_free_text_code_example
|
||
// to learn more.
|
||
rpc ReidentifyContent(ReidentifyContentRequest)
|
||
returns (ReidentifyContentResponse) {
|
||
option (google.api.http) = {
|
||
post: "/v2/{parent=projects/*}/content:reidentify"
|
||
body: "*"
|
||
};
|
||
}
|
||
|
||
// Returns a list of the sensitive information types that the DLP API
|
||
// supports. See https://cloud.google.com/dlp/docs/infotypes-reference to
|
||
// learn more.
|
||
rpc ListInfoTypes(ListInfoTypesRequest) returns (ListInfoTypesResponse) {
|
||
option (google.api.http) = {
|
||
get: "/v2/infoTypes"
|
||
};
|
||
}
|
||
|
||
// Creates an InspectTemplate for re-using frequently used configuration
|
||
// for inspecting content, images, and storage.
|
||
// See https://cloud.google.com/dlp/docs/creating-templates to learn more.
|
||
rpc CreateInspectTemplate(CreateInspectTemplateRequest)
|
||
returns (InspectTemplate) {
|
||
option (google.api.http) = {
|
||
post: "/v2/{parent=organizations/*}/inspectTemplates"
|
||
body: "*"
|
||
additional_bindings {
|
||
post: "/v2/{parent=projects/*}/inspectTemplates"
|
||
body: "*"
|
||
}
|
||
};
|
||
}
|
||
|
||
// Updates the InspectTemplate.
|
||
// See https://cloud.google.com/dlp/docs/creating-templates to learn more.
|
||
rpc UpdateInspectTemplate(UpdateInspectTemplateRequest)
|
||
returns (InspectTemplate) {
|
||
option (google.api.http) = {
|
||
patch: "/v2/{name=organizations/*/inspectTemplates/*}"
|
||
body: "*"
|
||
additional_bindings {
|
||
patch: "/v2/{name=projects/*/inspectTemplates/*}"
|
||
body: "*"
|
||
}
|
||
};
|
||
}
|
||
|
||
// Gets an InspectTemplate.
|
||
// See https://cloud.google.com/dlp/docs/creating-templates to learn more.
|
||
rpc GetInspectTemplate(GetInspectTemplateRequest) returns (InspectTemplate) {
|
||
option (google.api.http) = {
|
||
get: "/v2/{name=organizations/*/inspectTemplates/*}"
|
||
additional_bindings { get: "/v2/{name=projects/*/inspectTemplates/*}" }
|
||
};
|
||
}
|
||
|
||
// Lists InspectTemplates.
|
||
// See https://cloud.google.com/dlp/docs/creating-templates to learn more.
|
||
rpc ListInspectTemplates(ListInspectTemplatesRequest)
|
||
returns (ListInspectTemplatesResponse) {
|
||
option (google.api.http) = {
|
||
get: "/v2/{parent=organizations/*}/inspectTemplates"
|
||
additional_bindings { get: "/v2/{parent=projects/*}/inspectTemplates" }
|
||
};
|
||
}
|
||
|
||
// Deletes an InspectTemplate.
|
||
// See https://cloud.google.com/dlp/docs/creating-templates to learn more.
|
||
rpc DeleteInspectTemplate(DeleteInspectTemplateRequest)
|
||
returns (google.protobuf.Empty) {
|
||
option (google.api.http) = {
|
||
delete: "/v2/{name=organizations/*/inspectTemplates/*}"
|
||
additional_bindings { delete: "/v2/{name=projects/*/inspectTemplates/*}" }
|
||
};
|
||
}
|
||
|
||
// Creates a DeidentifyTemplate for re-using frequently used configuration
|
||
// for de-identifying content, images, and storage.
|
||
// See https://cloud.google.com/dlp/docs/creating-templates-deid to learn
|
||
// more.
|
||
rpc CreateDeidentifyTemplate(CreateDeidentifyTemplateRequest)
|
||
returns (DeidentifyTemplate) {
|
||
option (google.api.http) = {
|
||
post: "/v2/{parent=organizations/*}/deidentifyTemplates"
|
||
body: "*"
|
||
additional_bindings {
|
||
post: "/v2/{parent=projects/*}/deidentifyTemplates"
|
||
body: "*"
|
||
}
|
||
};
|
||
}
|
||
|
||
// Updates the DeidentifyTemplate.
|
||
// See https://cloud.google.com/dlp/docs/creating-templates-deid to learn
|
||
// more.
|
||
rpc UpdateDeidentifyTemplate(UpdateDeidentifyTemplateRequest)
|
||
returns (DeidentifyTemplate) {
|
||
option (google.api.http) = {
|
||
patch: "/v2/{name=organizations/*/deidentifyTemplates/*}"
|
||
body: "*"
|
||
additional_bindings {
|
||
patch: "/v2/{name=projects/*/deidentifyTemplates/*}"
|
||
body: "*"
|
||
}
|
||
};
|
||
}
|
||
|
||
// Gets a DeidentifyTemplate.
|
||
// See https://cloud.google.com/dlp/docs/creating-templates-deid to learn
|
||
// more.
|
||
rpc GetDeidentifyTemplate(GetDeidentifyTemplateRequest)
|
||
returns (DeidentifyTemplate) {
|
||
option (google.api.http) = {
|
||
get: "/v2/{name=organizations/*/deidentifyTemplates/*}"
|
||
additional_bindings { get: "/v2/{name=projects/*/deidentifyTemplates/*}" }
|
||
};
|
||
}
|
||
|
||
// Lists DeidentifyTemplates.
|
||
// See https://cloud.google.com/dlp/docs/creating-templates-deid to learn
|
||
// more.
|
||
rpc ListDeidentifyTemplates(ListDeidentifyTemplatesRequest)
|
||
returns (ListDeidentifyTemplatesResponse) {
|
||
option (google.api.http) = {
|
||
get: "/v2/{parent=organizations/*}/deidentifyTemplates"
|
||
additional_bindings { get: "/v2/{parent=projects/*}/deidentifyTemplates" }
|
||
};
|
||
}
|
||
|
||
// Deletes a DeidentifyTemplate.
|
||
// See https://cloud.google.com/dlp/docs/creating-templates-deid to learn
|
||
// more.
|
||
rpc DeleteDeidentifyTemplate(DeleteDeidentifyTemplateRequest)
|
||
returns (google.protobuf.Empty) {
|
||
option (google.api.http) = {
|
||
delete: "/v2/{name=organizations/*/deidentifyTemplates/*}"
|
||
additional_bindings {
|
||
delete: "/v2/{name=projects/*/deidentifyTemplates/*}"
|
||
}
|
||
};
|
||
}
|
||
|
||
// Creates a job trigger to run DLP actions such as scanning storage for
|
||
// sensitive information on a set schedule.
|
||
// See https://cloud.google.com/dlp/docs/creating-job-triggers to learn more.
|
||
rpc CreateJobTrigger(CreateJobTriggerRequest) returns (JobTrigger) {
|
||
option (google.api.http) = {
|
||
post: "/v2/{parent=projects/*}/jobTriggers"
|
||
body: "*"
|
||
};
|
||
}
|
||
|
||
// Updates a job trigger.
|
||
// See https://cloud.google.com/dlp/docs/creating-job-triggers to learn more.
|
||
rpc UpdateJobTrigger(UpdateJobTriggerRequest) returns (JobTrigger) {
|
||
option (google.api.http) = {
|
||
patch: "/v2/{name=projects/*/jobTriggers/*}"
|
||
body: "*"
|
||
};
|
||
}
|
||
|
||
// Gets a job trigger.
|
||
// See https://cloud.google.com/dlp/docs/creating-job-triggers to learn more.
|
||
rpc GetJobTrigger(GetJobTriggerRequest) returns (JobTrigger) {
|
||
option (google.api.http) = {
|
||
get: "/v2/{name=projects/*/jobTriggers/*}"
|
||
};
|
||
}
|
||
|
||
// Lists job triggers.
|
||
// See https://cloud.google.com/dlp/docs/creating-job-triggers to learn more.
|
||
rpc ListJobTriggers(ListJobTriggersRequest)
|
||
returns (ListJobTriggersResponse) {
|
||
option (google.api.http) = {
|
||
get: "/v2/{parent=projects/*}/jobTriggers"
|
||
};
|
||
}
|
||
|
||
// Deletes a job trigger.
|
||
// See https://cloud.google.com/dlp/docs/creating-job-triggers to learn more.
|
||
rpc DeleteJobTrigger(DeleteJobTriggerRequest)
|
||
returns (google.protobuf.Empty) {
|
||
option (google.api.http) = {
|
||
delete: "/v2/{name=projects/*/jobTriggers/*}"
|
||
};
|
||
}
|
||
|
||
// Activate a job trigger. Causes the immediate execute of a trigger
|
||
// instead of waiting on the trigger event to occur.
|
||
rpc ActivateJobTrigger(ActivateJobTriggerRequest) returns (DlpJob) {
|
||
option (google.api.http) = {
|
||
post: "/v2/{name=projects/*/jobTriggers/*}:activate"
|
||
body: "*"
|
||
};
|
||
}
|
||
|
||
// Creates a new job to inspect storage or calculate risk metrics.
|
||
// See https://cloud.google.com/dlp/docs/inspecting-storage and
|
||
// https://cloud.google.com/dlp/docs/compute-risk-analysis to learn more.
|
||
//
|
||
// When no InfoTypes or CustomInfoTypes are specified in inspect jobs, the
|
||
// system will automatically choose what detectors to run. By default this may
|
||
// be all types, but may change over time as detectors are updated.
|
||
rpc CreateDlpJob(CreateDlpJobRequest) returns (DlpJob) {
|
||
option (google.api.http) = {
|
||
post: "/v2/{parent=projects/*}/dlpJobs"
|
||
body: "*"
|
||
};
|
||
}
|
||
|
||
// Lists DlpJobs that match the specified filter in the request.
|
||
// See https://cloud.google.com/dlp/docs/inspecting-storage and
|
||
// https://cloud.google.com/dlp/docs/compute-risk-analysis to learn more.
|
||
rpc ListDlpJobs(ListDlpJobsRequest) returns (ListDlpJobsResponse) {
|
||
option (google.api.http) = {
|
||
get: "/v2/{parent=projects/*}/dlpJobs"
|
||
};
|
||
}
|
||
|
||
// Gets the latest state of a long-running DlpJob.
|
||
// See https://cloud.google.com/dlp/docs/inspecting-storage and
|
||
// https://cloud.google.com/dlp/docs/compute-risk-analysis to learn more.
|
||
rpc GetDlpJob(GetDlpJobRequest) returns (DlpJob) {
|
||
option (google.api.http) = {
|
||
get: "/v2/{name=projects/*/dlpJobs/*}"
|
||
};
|
||
}
|
||
|
||
// Deletes a long-running DlpJob. This method indicates that the client is
|
||
// no longer interested in the DlpJob result. The job will be cancelled if
|
||
// possible.
|
||
// See https://cloud.google.com/dlp/docs/inspecting-storage and
|
||
// https://cloud.google.com/dlp/docs/compute-risk-analysis to learn more.
|
||
rpc DeleteDlpJob(DeleteDlpJobRequest) returns (google.protobuf.Empty) {
|
||
option (google.api.http) = {
|
||
delete: "/v2/{name=projects/*/dlpJobs/*}"
|
||
};
|
||
}
|
||
|
||
// Starts asynchronous cancellation on a long-running DlpJob. The server
|
||
// makes a best effort to cancel the DlpJob, but success is not
|
||
// guaranteed.
|
||
// See https://cloud.google.com/dlp/docs/inspecting-storage and
|
||
// https://cloud.google.com/dlp/docs/compute-risk-analysis to learn more.
|
||
rpc CancelDlpJob(CancelDlpJobRequest) returns (google.protobuf.Empty) {
|
||
option (google.api.http) = {
|
||
post: "/v2/{name=projects/*/dlpJobs/*}:cancel"
|
||
body: "*"
|
||
};
|
||
}
|
||
|
||
// Creates a pre-built stored infoType to be used for inspection.
|
||
// See https://cloud.google.com/dlp/docs/creating-stored-infotypes to
|
||
// learn more.
|
||
rpc CreateStoredInfoType(CreateStoredInfoTypeRequest)
|
||
returns (StoredInfoType) {
|
||
option (google.api.http) = {
|
||
post: "/v2/{parent=organizations/*}/storedInfoTypes"
|
||
body: "*"
|
||
additional_bindings {
|
||
post: "/v2/{parent=projects/*}/storedInfoTypes"
|
||
body: "*"
|
||
}
|
||
};
|
||
}
|
||
|
||
// Updates the stored infoType by creating a new version. The existing version
|
||
// will continue to be used until the new version is ready.
|
||
// See https://cloud.google.com/dlp/docs/creating-stored-infotypes to
|
||
// learn more.
|
||
rpc UpdateStoredInfoType(UpdateStoredInfoTypeRequest)
|
||
returns (StoredInfoType) {
|
||
option (google.api.http) = {
|
||
patch: "/v2/{name=organizations/*/storedInfoTypes/*}"
|
||
body: "*"
|
||
additional_bindings {
|
||
patch: "/v2/{name=projects/*/storedInfoTypes/*}"
|
||
body: "*"
|
||
}
|
||
};
|
||
}
|
||
|
||
// Gets a stored infoType.
|
||
// See https://cloud.google.com/dlp/docs/creating-stored-infotypes to
|
||
// learn more.
|
||
rpc GetStoredInfoType(GetStoredInfoTypeRequest) returns (StoredInfoType) {
|
||
option (google.api.http) = {
|
||
get: "/v2/{name=organizations/*/storedInfoTypes/*}"
|
||
additional_bindings { get: "/v2/{name=projects/*/storedInfoTypes/*}" }
|
||
};
|
||
}
|
||
|
||
// Lists stored infoTypes.
|
||
// See https://cloud.google.com/dlp/docs/creating-stored-infotypes to
|
||
// learn more.
|
||
rpc ListStoredInfoTypes(ListStoredInfoTypesRequest)
|
||
returns (ListStoredInfoTypesResponse) {
|
||
option (google.api.http) = {
|
||
get: "/v2/{parent=organizations/*}/storedInfoTypes"
|
||
additional_bindings { get: "/v2/{parent=projects/*}/storedInfoTypes" }
|
||
};
|
||
}
|
||
|
||
// Deletes a stored infoType.
|
||
// See https://cloud.google.com/dlp/docs/creating-stored-infotypes to
|
||
// learn more.
|
||
rpc DeleteStoredInfoType(DeleteStoredInfoTypeRequest)
|
||
returns (google.protobuf.Empty) {
|
||
option (google.api.http) = {
|
||
delete: "/v2/{name=organizations/*/storedInfoTypes/*}"
|
||
additional_bindings { delete: "/v2/{name=projects/*/storedInfoTypes/*}" }
|
||
};
|
||
}
|
||
}
|
||
|
||
// List of exclude infoTypes.
|
||
message ExcludeInfoTypes {
|
||
// InfoType list in ExclusionRule rule drops a finding when it overlaps or
|
||
// contained within with a finding of an infoType from this list. For
|
||
// example, for `InspectionRuleSet.info_types` containing "PHONE_NUMBER"` and
|
||
// `exclusion_rule` containing `exclude_info_types.info_types` with
|
||
// "EMAIL_ADDRESS" the phone number findings are dropped if they overlap
|
||
// with EMAIL_ADDRESS finding.
|
||
// That leads to "555-222-2222@example.org" to generate only a single
|
||
// finding, namely email address.
|
||
repeated InfoType info_types = 1;
|
||
}
|
||
|
||
// The rule that specifies conditions when findings of infoTypes specified in
|
||
// `InspectionRuleSet` are removed from results.
|
||
message ExclusionRule {
|
||
oneof type {
|
||
// Dictionary which defines the rule.
|
||
CustomInfoType.Dictionary dictionary = 1;
|
||
|
||
// Regular expression which defines the rule.
|
||
CustomInfoType.Regex regex = 2;
|
||
|
||
// Set of infoTypes for which findings would affect this rule.
|
||
ExcludeInfoTypes exclude_info_types = 3;
|
||
}
|
||
|
||
// How the rule is applied, see MatchingType documentation for details.
|
||
MatchingType matching_type = 4;
|
||
}
|
||
|
||
// Options describing which parts of the provided content should be scanned.
|
||
enum ContentOption {
|
||
// Includes entire content of a file or a data stream.
|
||
CONTENT_UNSPECIFIED = 0;
|
||
|
||
// Text content within the data, excluding any metadata.
|
||
CONTENT_TEXT = 1;
|
||
|
||
// Images found in the data.
|
||
CONTENT_IMAGE = 2;
|
||
}
|
||
|
||
// A single inspection rule to be applied to infoTypes, specified in
|
||
// `InspectionRuleSet`.
|
||
message InspectionRule {
|
||
oneof type {
|
||
// Hotword-based detection rule.
|
||
CustomInfoType.DetectionRule.HotwordRule hotword_rule = 1;
|
||
|
||
// Exclusion rule.
|
||
ExclusionRule exclusion_rule = 2;
|
||
}
|
||
}
|
||
|
||
// Rule set for modifying a set of infoTypes to alter behavior under certain
|
||
// circumstances, depending on the specific details of the rules within the set.
|
||
message InspectionRuleSet {
|
||
// List of infoTypes this rule set is applied to.
|
||
repeated InfoType info_types = 1;
|
||
|
||
// Set of rules to be applied to infoTypes. The rules are applied in order.
|
||
repeated InspectionRule rules = 2;
|
||
}
|
||
|
||
// Configuration description of the scanning process.
|
||
// When used with redactContent only info_types and min_likelihood are currently
|
||
// used.
|
||
message InspectConfig {
|
||
message FindingLimits {
|
||
// Max findings configuration per infoType, per content item or long
|
||
// running DlpJob.
|
||
message InfoTypeLimit {
|
||
// Type of information the findings limit applies to. Only one limit per
|
||
// info_type should be provided. If InfoTypeLimit does not have an
|
||
// info_type, the DLP API applies the limit against all info_types that
|
||
// are found but not specified in another InfoTypeLimit.
|
||
InfoType info_type = 1;
|
||
|
||
// Max findings limit for the given infoType.
|
||
int32 max_findings = 2;
|
||
}
|
||
|
||
// Max number of findings that will be returned for each item scanned.
|
||
// When set within `InspectDataSourceRequest`,
|
||
// the maximum returned is 2000 regardless if this is set higher.
|
||
// When set within `InspectContentRequest`, this field is ignored.
|
||
int32 max_findings_per_item = 1;
|
||
|
||
// Max number of findings that will be returned per request/job.
|
||
// When set within `InspectContentRequest`, the maximum returned is 2000
|
||
// regardless if this is set higher.
|
||
int32 max_findings_per_request = 2;
|
||
|
||
// Configuration of findings limit given for specified infoTypes.
|
||
repeated InfoTypeLimit max_findings_per_info_type = 3;
|
||
}
|
||
|
||
// Restricts what info_types to look for. The values must correspond to
|
||
// InfoType values returned by ListInfoTypes or listed at
|
||
// https://cloud.google.com/dlp/docs/infotypes-reference.
|
||
//
|
||
// When no InfoTypes or CustomInfoTypes are specified in a request, the
|
||
// system may automatically choose what detectors to run. By default this may
|
||
// be all types, but may change over time as detectors are updated.
|
||
//
|
||
// The special InfoType name "ALL_BASIC" can be used to trigger all detectors,
|
||
// but may change over time as new InfoTypes are added. If you need precise
|
||
// control and predictability as to what detectors are run you should specify
|
||
// specific InfoTypes listed in the reference.
|
||
repeated InfoType info_types = 1;
|
||
|
||
// Only returns findings equal or above this threshold. The default is
|
||
// POSSIBLE.
|
||
// See https://cloud.google.com/dlp/docs/likelihood to learn more.
|
||
Likelihood min_likelihood = 2;
|
||
|
||
FindingLimits limits = 3;
|
||
|
||
// When true, a contextual quote from the data that triggered a finding is
|
||
// included in the response; see Finding.quote.
|
||
bool include_quote = 4;
|
||
|
||
// When true, excludes type information of the findings.
|
||
bool exclude_info_types = 5;
|
||
|
||
// CustomInfoTypes provided by the user. See
|
||
// https://cloud.google.com/dlp/docs/creating-custom-infotypes to learn more.
|
||
repeated CustomInfoType custom_info_types = 6;
|
||
|
||
// List of options defining data content to scan.
|
||
// If empty, text, images, and other content will be included.
|
||
repeated ContentOption content_options = 8;
|
||
|
||
// Set of rules to apply to the findings for this InspectConfig.
|
||
// Exclusion rules, contained in the set are executed in the end, other
|
||
// rules are executed in the order they are specified for each info type.
|
||
repeated InspectionRuleSet rule_set = 10;
|
||
}
|
||
|
||
// Container for bytes to inspect or redact.
|
||
message ByteContentItem {
|
||
enum BytesType {
|
||
BYTES_TYPE_UNSPECIFIED = 0;
|
||
|
||
IMAGE = 6;
|
||
|
||
IMAGE_JPEG = 1;
|
||
|
||
IMAGE_BMP = 2;
|
||
|
||
IMAGE_PNG = 3;
|
||
|
||
IMAGE_SVG = 4;
|
||
|
||
TEXT_UTF8 = 5;
|
||
}
|
||
|
||
// The type of data stored in the bytes string. Default will be TEXT_UTF8.
|
||
BytesType type = 1;
|
||
|
||
// Content data to inspect or redact.
|
||
bytes data = 2;
|
||
}
|
||
|
||
// Container structure for the content to inspect.
|
||
message ContentItem {
|
||
// Data of the item either in the byte array or UTF-8 string form, or table.
|
||
oneof data_item {
|
||
// String data to inspect or redact.
|
||
string value = 3;
|
||
|
||
// Structured content for inspection. See
|
||
// https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to
|
||
// learn more.
|
||
Table table = 4;
|
||
|
||
// Content data to inspect or redact. Replaces `type` and `data`.
|
||
ByteContentItem byte_item = 5;
|
||
}
|
||
}
|
||
|
||
// Structured content to inspect. Up to 50,000 `Value`s per request allowed.
|
||
// See https://cloud.google.com/dlp/docs/inspecting-text#inspecting_a_table to
|
||
// learn more.
|
||
message Table {
|
||
message Row {
|
||
repeated Value values = 1;
|
||
}
|
||
|
||
repeated FieldId headers = 1;
|
||
|
||
repeated Row rows = 2;
|
||
}
|
||
|
||
// All the findings for a single scanned item.
|
||
message InspectResult {
|
||
// List of findings for an item.
|
||
repeated Finding findings = 1;
|
||
|
||
// If true, then this item might have more findings than were returned,
|
||
// and the findings returned are an arbitrary subset of all findings.
|
||
// The findings list might be truncated because the input items were too
|
||
// large, or because the server reached the maximum amount of resources
|
||
// allowed for a single API call. For best results, divide the input into
|
||
// smaller batches.
|
||
bool findings_truncated = 2;
|
||
}
|
||
|
||
// Represents a piece of potentially sensitive content.
|
||
message Finding {
|
||
// The content that was found. Even if the content is not textual, it
|
||
// may be converted to a textual representation here.
|
||
// Provided if `include_quote` is true and the finding is
|
||
// less than or equal to 4096 bytes long. If the finding exceeds 4096 bytes
|
||
// in length, the quote may be omitted.
|
||
string quote = 1;
|
||
|
||
// The type of content that might have been found.
|
||
// Provided if `excluded_types` is false.
|
||
InfoType info_type = 2;
|
||
|
||
// Confidence of how likely it is that the `info_type` is correct.
|
||
Likelihood likelihood = 3;
|
||
|
||
// Where the content was found.
|
||
Location location = 4;
|
||
|
||
// Timestamp when finding was detected.
|
||
google.protobuf.Timestamp create_time = 6;
|
||
|
||
// Contains data parsed from quotes. Only populated if include_quote was set
|
||
// to true and a supported infoType was requested. Currently supported
|
||
// infoTypes: DATE, DATE_OF_BIRTH and TIME.
|
||
QuoteInfo quote_info = 7;
|
||
}
|
||
|
||
// Specifies the location of the finding.
|
||
message Location {
|
||
// Zero-based byte offsets delimiting the finding.
|
||
// These are relative to the finding's containing element.
|
||
// Note that when the content is not textual, this references
|
||
// the UTF-8 encoded textual representation of the content.
|
||
// Omitted if content is an image.
|
||
Range byte_range = 1;
|
||
|
||
// Unicode character offsets delimiting the finding.
|
||
// These are relative to the finding's containing element.
|
||
// Provided when the content is text.
|
||
Range codepoint_range = 2;
|
||
|
||
// List of nested objects pointing to the precise location of the finding
|
||
// within the file or record.
|
||
repeated ContentLocation content_locations = 7;
|
||
}
|
||
|
||
// Type of the match which can be applied to different ways of matching, like
|
||
// Dictionary, regular expression and intersecting with findings of another
|
||
// info type.
|
||
enum MatchingType {
|
||
// Invalid.
|
||
MATCHING_TYPE_UNSPECIFIED = 0;
|
||
|
||
// Full match.
|
||
//
|
||
// - Dictionary: join of Dictionary results matched complete finding quote
|
||
// - Regex: all regex matches fill a finding quote start to end
|
||
// - Exclude info type: completely inside affecting info types findings
|
||
MATCHING_TYPE_FULL_MATCH = 1;
|
||
|
||
// Partial match.
|
||
//
|
||
// - Dictionary: at least one of the tokens in the finding matches
|
||
// - Regex: substring of the finding matches
|
||
// - Exclude info type: intersects with affecting info types findings
|
||
MATCHING_TYPE_PARTIAL_MATCH = 2;
|
||
|
||
// Inverse match.
|
||
//
|
||
// - Dictionary: no tokens in the finding match the dictionary
|
||
// - Regex: finding doesn't match the regex
|
||
// - Exclude info type: no intersection with affecting info types findings
|
||
MATCHING_TYPE_INVERSE_MATCH = 3;
|
||
}
|
||
|
||
// Findings container location data.
|
||
message ContentLocation {
|
||
// Name of the container where the finding is located.
|
||
// The top level name is the source file name or table name. Names of some
|
||
// common storage containers are formatted as follows:
|
||
//
|
||
// * BigQuery tables: `<project_id>:<dataset_id>.<table_id>`
|
||
// * Cloud Storage files: `gs://<bucket>/<path>`
|
||
// * Datastore namespace: <namespace>
|
||
//
|
||
// Nested names could be absent if the embedded object has no string
|
||
// identifier (for an example an image contained within a document).
|
||
string container_name = 1;
|
||
|
||
// Type of the container within the file with location of the finding.
|
||
oneof location {
|
||
// Location within a row or record of a database table.
|
||
RecordLocation record_location = 2;
|
||
|
||
// Location within an image's pixels.
|
||
ImageLocation image_location = 3;
|
||
|
||
// Location data for document files.
|
||
DocumentLocation document_location = 5;
|
||
}
|
||
|
||
// Findings container modification timestamp, if applicable.
|
||
// For Google Cloud Storage contains last file modification timestamp.
|
||
// For BigQuery table contains last_modified_time property.
|
||
// For Datastore - not populated.
|
||
google.protobuf.Timestamp container_timestamp = 6;
|
||
|
||
// Findings container version, if available
|
||
// ("generation" for Google Cloud Storage).
|
||
string container_version = 7;
|
||
}
|
||
|
||
// Location of a finding within a document.
|
||
message DocumentLocation {
|
||
// Offset of the line, from the beginning of the file, where the finding
|
||
// is located.
|
||
int64 file_offset = 1;
|
||
}
|
||
|
||
// Location of a finding within a row or record.
|
||
message RecordLocation {
|
||
// Key of the finding.
|
||
RecordKey record_key = 1;
|
||
|
||
// Field id of the field containing the finding.
|
||
FieldId field_id = 2;
|
||
|
||
// Location within a `ContentItem.Table`.
|
||
TableLocation table_location = 3;
|
||
}
|
||
|
||
// Location of a finding within a table.
|
||
message TableLocation {
|
||
// The zero-based index of the row where the finding is located.
|
||
int64 row_index = 1;
|
||
}
|
||
|
||
// Generic half-open interval [start, end)
|
||
message Range {
|
||
// Index of the first character of the range (inclusive).
|
||
int64 start = 1;
|
||
|
||
// Index of the last character of the range (exclusive).
|
||
int64 end = 2;
|
||
}
|
||
|
||
// Location of the finding within an image.
|
||
message ImageLocation {
|
||
// Bounding boxes locating the pixels within the image containing the finding.
|
||
repeated BoundingBox bounding_boxes = 1;
|
||
}
|
||
|
||
// Bounding box encompassing detected text within an image.
|
||
message BoundingBox {
|
||
// Top coordinate of the bounding box. (0,0) is upper left.
|
||
int32 top = 1;
|
||
|
||
// Left coordinate of the bounding box. (0,0) is upper left.
|
||
int32 left = 2;
|
||
|
||
// Width of the bounding box in pixels.
|
||
int32 width = 3;
|
||
|
||
// Height of the bounding box in pixels.
|
||
int32 height = 4;
|
||
}
|
||
|
||
// Request to search for potentially sensitive info in an image and redact it
|
||
// by covering it with a colored rectangle.
|
||
message RedactImageRequest {
|
||
// Configuration for determining how redaction of images should occur.
|
||
message ImageRedactionConfig {
|
||
// Type of information to redact from images.
|
||
oneof target {
|
||
// Only one per info_type should be provided per request. If not
|
||
// specified, and redact_all_text is false, the DLP API will redact all
|
||
// text that it matches against all info_types that are found, but not
|
||
// specified in another ImageRedactionConfig.
|
||
InfoType info_type = 1;
|
||
|
||
// If true, all text found in the image, regardless whether it matches an
|
||
// info_type, is redacted. Only one should be provided.
|
||
bool redact_all_text = 2;
|
||
}
|
||
|
||
// The color to use when redacting content from an image. If not specified,
|
||
// the default is black.
|
||
Color redaction_color = 3;
|
||
}
|
||
|
||
// The parent resource name, for example projects/my-project-id.
|
||
string parent = 1;
|
||
|
||
// Configuration for the inspector.
|
||
InspectConfig inspect_config = 2;
|
||
|
||
// The configuration for specifying what content to redact from images.
|
||
repeated ImageRedactionConfig image_redaction_configs = 5;
|
||
|
||
// Whether the response should include findings along with the redacted
|
||
// image.
|
||
bool include_findings = 6;
|
||
|
||
// The content must be PNG, JPEG, SVG or BMP.
|
||
ByteContentItem byte_item = 7;
|
||
}
|
||
|
||
// Represents a color in the RGB color space.
|
||
message Color {
|
||
// The amount of red in the color as a value in the interval [0, 1].
|
||
float red = 1;
|
||
|
||
// The amount of green in the color as a value in the interval [0, 1].
|
||
float green = 2;
|
||
|
||
// The amount of blue in the color as a value in the interval [0, 1].
|
||
float blue = 3;
|
||
}
|
||
|
||
// Results of redacting an image.
|
||
message RedactImageResponse {
|
||
// The redacted image. The type will be the same as the original image.
|
||
bytes redacted_image = 1;
|
||
|
||
// If an image was being inspected and the InspectConfig's include_quote was
|
||
// set to true, then this field will include all text, if any, that was found
|
||
// in the image.
|
||
string extracted_text = 2;
|
||
|
||
// The findings. Populated when include_findings in the request is true.
|
||
InspectResult inspect_result = 3;
|
||
}
|
||
|
||
// Request to de-identify a list of items.
|
||
message DeidentifyContentRequest {
|
||
// The parent resource name, for example projects/my-project-id.
|
||
string parent = 1;
|
||
|
||
// Configuration for the de-identification of the content item.
|
||
// Items specified here will override the template referenced by the
|
||
// deidentify_template_name argument.
|
||
DeidentifyConfig deidentify_config = 2;
|
||
|
||
// Configuration for the inspector.
|
||
// Items specified here will override the template referenced by the
|
||
// inspect_template_name argument.
|
||
InspectConfig inspect_config = 3;
|
||
|
||
// The item to de-identify. Will be treated as text.
|
||
ContentItem item = 4;
|
||
|
||
// Optional template to use. Any configuration directly specified in
|
||
// inspect_config will override those set in the template. Singular fields
|
||
// that are set in this request will replace their corresponding fields in the
|
||
// template. Repeated fields are appended. Singular sub-messages and groups
|
||
// are recursively merged.
|
||
string inspect_template_name = 5;
|
||
|
||
// Optional template to use. Any configuration directly specified in
|
||
// deidentify_config will override those set in the template. Singular fields
|
||
// that are set in this request will replace their corresponding fields in the
|
||
// template. Repeated fields are appended. Singular sub-messages and groups
|
||
// are recursively merged.
|
||
string deidentify_template_name = 6;
|
||
}
|
||
|
||
// Results of de-identifying a ContentItem.
|
||
message DeidentifyContentResponse {
|
||
// The de-identified item.
|
||
ContentItem item = 1;
|
||
|
||
// An overview of the changes that were made on the `item`.
|
||
TransformationOverview overview = 2;
|
||
}
|
||
|
||
// Request to re-identify an item.
|
||
message ReidentifyContentRequest {
|
||
// The parent resource name.
|
||
string parent = 1;
|
||
|
||
// Configuration for the re-identification of the content item.
|
||
// This field shares the same proto message type that is used for
|
||
// de-identification, however its usage here is for the reversal of the
|
||
// previous de-identification. Re-identification is performed by examining
|
||
// the transformations used to de-identify the items and executing the
|
||
// reverse. This requires that only reversible transformations
|
||
// be provided here. The reversible transformations are:
|
||
//
|
||
// - `CryptoReplaceFfxFpeConfig`
|
||
DeidentifyConfig reidentify_config = 2;
|
||
|
||
// Configuration for the inspector.
|
||
InspectConfig inspect_config = 3;
|
||
|
||
// The item to re-identify. Will be treated as text.
|
||
ContentItem item = 4;
|
||
|
||
// Optional template to use. Any configuration directly specified in
|
||
// `inspect_config` will override those set in the template. Singular fields
|
||
// that are set in this request will replace their corresponding fields in the
|
||
// template. Repeated fields are appended. Singular sub-messages and groups
|
||
// are recursively merged.
|
||
string inspect_template_name = 5;
|
||
|
||
// Optional template to use. References an instance of `DeidentifyTemplate`.
|
||
// Any configuration directly specified in `reidentify_config` or
|
||
// `inspect_config` will override those set in the template. Singular fields
|
||
// that are set in this request will replace their corresponding fields in the
|
||
// template. Repeated fields are appended. Singular sub-messages and groups
|
||
// are recursively merged.
|
||
string reidentify_template_name = 6;
|
||
}
|
||
|
||
// Results of re-identifying a item.
|
||
message ReidentifyContentResponse {
|
||
// The re-identified item.
|
||
ContentItem item = 1;
|
||
|
||
// An overview of the changes that were made to the `item`.
|
||
TransformationOverview overview = 2;
|
||
}
|
||
|
||
// Request to search for potentially sensitive info in a ContentItem.
|
||
message InspectContentRequest {
|
||
// The parent resource name, for example projects/my-project-id.
|
||
string parent = 1;
|
||
|
||
// Configuration for the inspector. What specified here will override
|
||
// the template referenced by the inspect_template_name argument.
|
||
InspectConfig inspect_config = 2;
|
||
|
||
// The item to inspect.
|
||
ContentItem item = 3;
|
||
|
||
// Optional template to use. Any configuration directly specified in
|
||
// inspect_config will override those set in the template. Singular fields
|
||
// that are set in this request will replace their corresponding fields in the
|
||
// template. Repeated fields are appended. Singular sub-messages and groups
|
||
// are recursively merged.
|
||
string inspect_template_name = 4;
|
||
}
|
||
|
||
// Results of inspecting an item.
|
||
message InspectContentResponse {
|
||
// The findings.
|
||
InspectResult result = 1;
|
||
}
|
||
|
||
// Cloud repository for storing output.
|
||
message OutputStorageConfig {
|
||
// Predefined schemas for storing findings.
|
||
enum OutputSchema {
|
||
OUTPUT_SCHEMA_UNSPECIFIED = 0;
|
||
|
||
// Basic schema including only `info_type`, `quote`, `certainty`, and
|
||
// `timestamp`.
|
||
BASIC_COLUMNS = 1;
|
||
|
||
// Schema tailored to findings from scanning Google Cloud Storage.
|
||
GCS_COLUMNS = 2;
|
||
|
||
// Schema tailored to findings from scanning Google Datastore.
|
||
DATASTORE_COLUMNS = 3;
|
||
|
||
// Schema tailored to findings from scanning Google BigQuery.
|
||
BIG_QUERY_COLUMNS = 4;
|
||
|
||
// Schema containing all columns.
|
||
ALL_COLUMNS = 5;
|
||
}
|
||
|
||
oneof type {
|
||
// Store findings in an existing table or a new table in an existing
|
||
// dataset. If table_id is not set a new one will be generated
|
||
// for you with the following format:
|
||
// dlp_googleapis_yyyy_mm_dd_[dlp_job_id]. Pacific timezone will be used for
|
||
// generating the date details.
|
||
//
|
||
// For Inspect, each column in an existing output table must have the same
|
||
// name, type, and mode of a field in the `Finding` object.
|
||
//
|
||
// For Risk, an existing output table should be the output of a previous
|
||
// Risk analysis job run on the same source table, with the same privacy
|
||
// metric and quasi-identifiers. Risk jobs that analyze the same table but
|
||
// compute a different privacy metric, or use different sets of
|
||
// quasi-identifiers, cannot store their results in the same table.
|
||
BigQueryTable table = 1;
|
||
}
|
||
|
||
// Schema used for writing the findings for Inspect jobs. This field is only
|
||
// used for Inspect and must be unspecified for Risk jobs. Columns are derived
|
||
// from the `Finding` object. If appending to an existing table, any columns
|
||
// from the predefined schema that are missing will be added. No columns in
|
||
// the existing table will be deleted.
|
||
//
|
||
// If unspecified, then all available columns will be used for a new table or
|
||
// an (existing) table with no schema, and no changes will be made to an
|
||
// existing table that has a schema.
|
||
OutputSchema output_schema = 3;
|
||
}
|
||
|
||
// Statistics regarding a specific InfoType.
|
||
message InfoTypeStats {
|
||
// The type of finding this stat is for.
|
||
InfoType info_type = 1;
|
||
|
||
// Number of findings for this infoType.
|
||
int64 count = 2;
|
||
}
|
||
|
||
// The results of an inspect DataSource job.
|
||
message InspectDataSourceDetails {
|
||
message RequestedOptions {
|
||
// If run with an InspectTemplate, a snapshot of its state at the time of
|
||
// this run.
|
||
InspectTemplate snapshot_inspect_template = 1;
|
||
|
||
InspectJobConfig job_config = 3;
|
||
}
|
||
|
||
message Result {
|
||
// Total size in bytes that were processed.
|
||
int64 processed_bytes = 1;
|
||
|
||
// Estimate of the number of bytes to process.
|
||
int64 total_estimated_bytes = 2;
|
||
|
||
// Statistics of how many instances of each info type were found during
|
||
// inspect job.
|
||
repeated InfoTypeStats info_type_stats = 3;
|
||
}
|
||
|
||
// The configuration used for this job.
|
||
RequestedOptions requested_options = 2;
|
||
|
||
// A summary of the outcome of this inspect job.
|
||
Result result = 3;
|
||
}
|
||
|
||
// InfoType description.
|
||
message InfoTypeDescription {
|
||
// Internal name of the infoType.
|
||
string name = 1;
|
||
|
||
// Human readable form of the infoType name.
|
||
string display_name = 2;
|
||
|
||
// Which parts of the API supports this InfoType.
|
||
repeated InfoTypeSupportedBy supported_by = 3;
|
||
|
||
// Description of the infotype. Translated when language is provided in the
|
||
// request.
|
||
string description = 4;
|
||
}
|
||
|
||
// Request for the list of infoTypes.
|
||
message ListInfoTypesRequest {
|
||
// Optional BCP-47 language code for localized infoType friendly
|
||
// names. If omitted, or if localized strings are not available,
|
||
// en-US strings will be returned.
|
||
string language_code = 1;
|
||
|
||
// Optional filter to only return infoTypes supported by certain parts of the
|
||
// API. Defaults to supported_by=INSPECT.
|
||
string filter = 2;
|
||
}
|
||
|
||
// Response to the ListInfoTypes request.
|
||
message ListInfoTypesResponse {
|
||
// Set of sensitive infoTypes.
|
||
repeated InfoTypeDescription info_types = 1;
|
||
}
|
||
|
||
// Configuration for a risk analysis job. See
|
||
// https://cloud.google.com/dlp/docs/concepts-risk-analysis to learn more.
|
||
message RiskAnalysisJobConfig {
|
||
// Privacy metric to compute.
|
||
PrivacyMetric privacy_metric = 1;
|
||
|
||
// Input dataset to compute metrics over.
|
||
BigQueryTable source_table = 2;
|
||
|
||
// Actions to execute at the completion of the job. Are executed in the order
|
||
// provided.
|
||
repeated Action actions = 3;
|
||
}
|
||
|
||
// A column with a semantic tag attached.
|
||
message QuasiId {
|
||
// Identifies the column. [required]
|
||
FieldId field = 1;
|
||
|
||
// Semantic tag that identifies what a column contains, to determine which
|
||
// statistical model to use to estimate the reidentifiability of each
|
||
// value. [required]
|
||
oneof tag {
|
||
// A column can be tagged with a InfoType to use the relevant public
|
||
// dataset as a statistical model of population, if available. We
|
||
// currently support US ZIP codes, region codes, ages and genders.
|
||
// To programmatically obtain the list of supported InfoTypes, use
|
||
// ListInfoTypes with the supported_by=RISK_ANALYSIS filter.
|
||
InfoType info_type = 2;
|
||
|
||
// A column can be tagged with a custom tag. In this case, the user must
|
||
// indicate an auxiliary table that contains statistical information on
|
||
// the possible values of this column (below).
|
||
string custom_tag = 3;
|
||
|
||
// If no semantic tag is indicated, we infer the statistical model from
|
||
// the distribution of values in the input data
|
||
google.protobuf.Empty inferred = 4;
|
||
}
|
||
}
|
||
|
||
// An auxiliary table containing statistical information on the relative
|
||
// frequency of different quasi-identifiers values. It has one or several
|
||
// quasi-identifiers columns, and one column that indicates the relative
|
||
// frequency of each quasi-identifier tuple.
|
||
// If a tuple is present in the data but not in the auxiliary table, the
|
||
// corresponding relative frequency is assumed to be zero (and thus, the
|
||
// tuple is highly reidentifiable).
|
||
message StatisticalTable {
|
||
// A quasi-identifier column has a custom_tag, used to know which column
|
||
// in the data corresponds to which column in the statistical model.
|
||
message QuasiIdentifierField {
|
||
FieldId field = 1;
|
||
|
||
string custom_tag = 2;
|
||
}
|
||
|
||
// Auxiliary table location. [required]
|
||
BigQueryTable table = 3;
|
||
|
||
// Quasi-identifier columns. [required]
|
||
repeated QuasiIdentifierField quasi_ids = 1;
|
||
|
||
// The relative frequency column must contain a floating-point number
|
||
// between 0 and 1 (inclusive). Null values are assumed to be zero.
|
||
// [required]
|
||
FieldId relative_frequency = 2;
|
||
}
|
||
|
||
// Privacy metric to compute for reidentification risk analysis.
|
||
message PrivacyMetric {
|
||
// Compute numerical stats over an individual column, including
|
||
// min, max, and quantiles.
|
||
message NumericalStatsConfig {
|
||
// Field to compute numerical stats on. Supported types are
|
||
// integer, float, date, datetime, timestamp, time.
|
||
FieldId field = 1;
|
||
}
|
||
|
||
// Compute numerical stats over an individual column, including
|
||
// number of distinct values and value count distribution.
|
||
message CategoricalStatsConfig {
|
||
// Field to compute categorical stats on. All column types are
|
||
// supported except for arrays and structs. However, it may be more
|
||
// informative to use NumericalStats when the field type is supported,
|
||
// depending on the data.
|
||
FieldId field = 1;
|
||
}
|
||
|
||
// k-anonymity metric, used for analysis of reidentification risk.
|
||
message KAnonymityConfig {
|
||
// Set of fields to compute k-anonymity over. When multiple fields are
|
||
// specified, they are considered a single composite key. Structs and
|
||
// repeated data types are not supported; however, nested fields are
|
||
// supported so long as they are not structs themselves or nested within
|
||
// a repeated field.
|
||
repeated FieldId quasi_ids = 1;
|
||
|
||
// Optional message indicating that multiple rows might be associated to a
|
||
// single individual. If the same entity_id is associated to multiple
|
||
// quasi-identifier tuples over distinct rows, we consider the entire
|
||
// collection of tuples as the composite quasi-identifier. This collection
|
||
// is a multiset: the order in which the different tuples appear in the
|
||
// dataset is ignored, but their frequency is taken into account.
|
||
//
|
||
// Important note: a maximum of 1000 rows can be associated to a single
|
||
// entity ID. If more rows are associated with the same entity ID, some
|
||
// might be ignored.
|
||
EntityId entity_id = 2;
|
||
}
|
||
|
||
// l-diversity metric, used for analysis of reidentification risk.
|
||
message LDiversityConfig {
|
||
// Set of quasi-identifiers indicating how equivalence classes are
|
||
// defined for the l-diversity computation. When multiple fields are
|
||
// specified, they are considered a single composite key.
|
||
repeated FieldId quasi_ids = 1;
|
||
|
||
// Sensitive field for computing the l-value.
|
||
FieldId sensitive_attribute = 2;
|
||
}
|
||
|
||
// Reidentifiability metric. This corresponds to a risk model similar to what
|
||
// is called "journalist risk" in the literature, except the attack dataset is
|
||
// statistically modeled instead of being perfectly known. This can be done
|
||
// using publicly available data (like the US Census), or using a custom
|
||
// statistical model (indicated as one or several BigQuery tables), or by
|
||
// extrapolating from the distribution of values in the input dataset.
|
||
// A column with a semantic tag attached.
|
||
message KMapEstimationConfig {
|
||
message TaggedField {
|
||
// Identifies the column. [required]
|
||
FieldId field = 1;
|
||
|
||
// Semantic tag that identifies what a column contains, to determine which
|
||
// statistical model to use to estimate the reidentifiability of each
|
||
// value. [required]
|
||
oneof tag {
|
||
// A column can be tagged with a InfoType to use the relevant public
|
||
// dataset as a statistical model of population, if available. We
|
||
// currently support US ZIP codes, region codes, ages and genders.
|
||
// To programmatically obtain the list of supported InfoTypes, use
|
||
// ListInfoTypes with the supported_by=RISK_ANALYSIS filter.
|
||
InfoType info_type = 2;
|
||
|
||
// A column can be tagged with a custom tag. In this case, the user must
|
||
// indicate an auxiliary table that contains statistical information on
|
||
// the possible values of this column (below).
|
||
string custom_tag = 3;
|
||
|
||
// If no semantic tag is indicated, we infer the statistical model from
|
||
// the distribution of values in the input data
|
||
google.protobuf.Empty inferred = 4;
|
||
}
|
||
}
|
||
|
||
// An auxiliary table contains statistical information on the relative
|
||
// frequency of different quasi-identifiers values. It has one or several
|
||
// quasi-identifiers columns, and one column that indicates the relative
|
||
// frequency of each quasi-identifier tuple.
|
||
// If a tuple is present in the data but not in the auxiliary table, the
|
||
// corresponding relative frequency is assumed to be zero (and thus, the
|
||
// tuple is highly reidentifiable).
|
||
message AuxiliaryTable {
|
||
// A quasi-identifier column has a custom_tag, used to know which column
|
||
// in the data corresponds to which column in the statistical model.
|
||
message QuasiIdField {
|
||
FieldId field = 1;
|
||
|
||
string custom_tag = 2;
|
||
}
|
||
|
||
// Auxiliary table location. [required]
|
||
BigQueryTable table = 3;
|
||
|
||
// Quasi-identifier columns. [required]
|
||
repeated QuasiIdField quasi_ids = 1;
|
||
|
||
// The relative frequency column must contain a floating-point number
|
||
// between 0 and 1 (inclusive). Null values are assumed to be zero.
|
||
// [required]
|
||
FieldId relative_frequency = 2;
|
||
}
|
||
|
||
// Fields considered to be quasi-identifiers. No two columns can have the
|
||
// same tag. [required]
|
||
repeated TaggedField quasi_ids = 1;
|
||
|
||
// ISO 3166-1 alpha-2 region code to use in the statistical modeling.
|
||
// Required if no column is tagged with a region-specific InfoType (like
|
||
// US_ZIP_5) or a region code.
|
||
string region_code = 2;
|
||
|
||
// Several auxiliary tables can be used in the analysis. Each custom_tag
|
||
// used to tag a quasi-identifiers column must appear in exactly one column
|
||
// of one auxiliary table.
|
||
repeated AuxiliaryTable auxiliary_tables = 3;
|
||
}
|
||
|
||
// δ-presence metric, used to estimate how likely it is for an attacker to
|
||
// figure out that one given individual appears in a de-identified dataset.
|
||
// Similarly to the k-map metric, we cannot compute δ-presence exactly without
|
||
// knowing the attack dataset, so we use a statistical model instead.
|
||
message DeltaPresenceEstimationConfig {
|
||
// Fields considered to be quasi-identifiers. No two fields can have the
|
||
// same tag. [required]
|
||
repeated QuasiId quasi_ids = 1;
|
||
|
||
// ISO 3166-1 alpha-2 region code to use in the statistical modeling.
|
||
// Required if no column is tagged with a region-specific InfoType (like
|
||
// US_ZIP_5) or a region code.
|
||
string region_code = 2;
|
||
|
||
// Several auxiliary tables can be used in the analysis. Each custom_tag
|
||
// used to tag a quasi-identifiers field must appear in exactly one
|
||
// field of one auxiliary table.
|
||
repeated StatisticalTable auxiliary_tables = 3;
|
||
}
|
||
|
||
oneof type {
|
||
NumericalStatsConfig numerical_stats_config = 1;
|
||
|
||
CategoricalStatsConfig categorical_stats_config = 2;
|
||
|
||
KAnonymityConfig k_anonymity_config = 3;
|
||
|
||
LDiversityConfig l_diversity_config = 4;
|
||
|
||
KMapEstimationConfig k_map_estimation_config = 5;
|
||
|
||
DeltaPresenceEstimationConfig delta_presence_estimation_config = 6;
|
||
}
|
||
}
|
||
|
||
// Result of a risk analysis operation request.
|
||
message AnalyzeDataSourceRiskDetails {
|
||
// Result of the numerical stats computation.
|
||
message NumericalStatsResult {
|
||
// Minimum value appearing in the column.
|
||
Value min_value = 1;
|
||
|
||
// Maximum value appearing in the column.
|
||
Value max_value = 2;
|
||
|
||
// List of 99 values that partition the set of field values into 100 equal
|
||
// sized buckets.
|
||
repeated Value quantile_values = 4;
|
||
}
|
||
|
||
// Result of the categorical stats computation.
|
||
message CategoricalStatsResult {
|
||
message CategoricalStatsHistogramBucket {
|
||
// Lower bound on the value frequency of the values in this bucket.
|
||
int64 value_frequency_lower_bound = 1;
|
||
|
||
// Upper bound on the value frequency of the values in this bucket.
|
||
int64 value_frequency_upper_bound = 2;
|
||
|
||
// Total number of values in this bucket.
|
||
int64 bucket_size = 3;
|
||
|
||
// Sample of value frequencies in this bucket. The total number of
|
||
// values returned per bucket is capped at 20.
|
||
repeated ValueFrequency bucket_values = 4;
|
||
|
||
// Total number of distinct values in this bucket.
|
||
int64 bucket_value_count = 5;
|
||
}
|
||
|
||
// Histogram of value frequencies in the column.
|
||
repeated CategoricalStatsHistogramBucket value_frequency_histogram_buckets =
|
||
5;
|
||
}
|
||
|
||
// Result of the k-anonymity computation.
|
||
message KAnonymityResult {
|
||
// The set of columns' values that share the same ldiversity value
|
||
message KAnonymityEquivalenceClass {
|
||
// Set of values defining the equivalence class. One value per
|
||
// quasi-identifier column in the original KAnonymity metric message.
|
||
// The order is always the same as the original request.
|
||
repeated Value quasi_ids_values = 1;
|
||
|
||
// Size of the equivalence class, for example number of rows with the
|
||
// above set of values.
|
||
int64 equivalence_class_size = 2;
|
||
}
|
||
|
||
message KAnonymityHistogramBucket {
|
||
// Lower bound on the size of the equivalence classes in this bucket.
|
||
int64 equivalence_class_size_lower_bound = 1;
|
||
|
||
// Upper bound on the size of the equivalence classes in this bucket.
|
||
int64 equivalence_class_size_upper_bound = 2;
|
||
|
||
// Total number of equivalence classes in this bucket.
|
||
int64 bucket_size = 3;
|
||
|
||
// Sample of equivalence classes in this bucket. The total number of
|
||
// classes returned per bucket is capped at 20.
|
||
repeated KAnonymityEquivalenceClass bucket_values = 4;
|
||
|
||
// Total number of distinct equivalence classes in this bucket.
|
||
int64 bucket_value_count = 5;
|
||
}
|
||
|
||
// Histogram of k-anonymity equivalence classes.
|
||
repeated KAnonymityHistogramBucket equivalence_class_histogram_buckets = 5;
|
||
}
|
||
|
||
// Result of the l-diversity computation.
|
||
message LDiversityResult {
|
||
// The set of columns' values that share the same ldiversity value.
|
||
message LDiversityEquivalenceClass {
|
||
// Quasi-identifier values defining the k-anonymity equivalence
|
||
// class. The order is always the same as the original request.
|
||
repeated Value quasi_ids_values = 1;
|
||
|
||
// Size of the k-anonymity equivalence class.
|
||
int64 equivalence_class_size = 2;
|
||
|
||
// Number of distinct sensitive values in this equivalence class.
|
||
int64 num_distinct_sensitive_values = 3;
|
||
|
||
// Estimated frequencies of top sensitive values.
|
||
repeated ValueFrequency top_sensitive_values = 4;
|
||
}
|
||
|
||
message LDiversityHistogramBucket {
|
||
// Lower bound on the sensitive value frequencies of the equivalence
|
||
// classes in this bucket.
|
||
int64 sensitive_value_frequency_lower_bound = 1;
|
||
|
||
// Upper bound on the sensitive value frequencies of the equivalence
|
||
// classes in this bucket.
|
||
int64 sensitive_value_frequency_upper_bound = 2;
|
||
|
||
// Total number of equivalence classes in this bucket.
|
||
int64 bucket_size = 3;
|
||
|
||
// Sample of equivalence classes in this bucket. The total number of
|
||
// classes returned per bucket is capped at 20.
|
||
repeated LDiversityEquivalenceClass bucket_values = 4;
|
||
|
||
// Total number of distinct equivalence classes in this bucket.
|
||
int64 bucket_value_count = 5;
|
||
}
|
||
|
||
// Histogram of l-diversity equivalence class sensitive value frequencies.
|
||
repeated LDiversityHistogramBucket
|
||
sensitive_value_frequency_histogram_buckets = 5;
|
||
}
|
||
|
||
// Result of the reidentifiability analysis. Note that these results are an
|
||
// estimation, not exact values.
|
||
message KMapEstimationResult {
|
||
// A tuple of values for the quasi-identifier columns.
|
||
message KMapEstimationQuasiIdValues {
|
||
// The quasi-identifier values.
|
||
repeated Value quasi_ids_values = 1;
|
||
|
||
// The estimated anonymity for these quasi-identifier values.
|
||
int64 estimated_anonymity = 2;
|
||
}
|
||
|
||
// A KMapEstimationHistogramBucket message with the following values:
|
||
// min_anonymity: 3
|
||
// max_anonymity: 5
|
||
// frequency: 42
|
||
// means that there are 42 records whose quasi-identifier values correspond
|
||
// to 3, 4 or 5 people in the overlying population. An important particular
|
||
// case is when min_anonymity = max_anonymity = 1: the frequency field then
|
||
// corresponds to the number of uniquely identifiable records.
|
||
message KMapEstimationHistogramBucket {
|
||
// Always positive.
|
||
int64 min_anonymity = 1;
|
||
|
||
// Always greater than or equal to min_anonymity.
|
||
int64 max_anonymity = 2;
|
||
|
||
// Number of records within these anonymity bounds.
|
||
int64 bucket_size = 5;
|
||
|
||
// Sample of quasi-identifier tuple values in this bucket. The total
|
||
// number of classes returned per bucket is capped at 20.
|
||
repeated KMapEstimationQuasiIdValues bucket_values = 6;
|
||
|
||
// Total number of distinct quasi-identifier tuple values in this bucket.
|
||
int64 bucket_value_count = 7;
|
||
}
|
||
|
||
// The intervals [min_anonymity, max_anonymity] do not overlap. If a value
|
||
// doesn't correspond to any such interval, the associated frequency is
|
||
// zero. For example, the following records:
|
||
// {min_anonymity: 1, max_anonymity: 1, frequency: 17}
|
||
// {min_anonymity: 2, max_anonymity: 3, frequency: 42}
|
||
// {min_anonymity: 5, max_anonymity: 10, frequency: 99}
|
||
// mean that there are no record with an estimated anonymity of 4, 5, or
|
||
// larger than 10.
|
||
repeated KMapEstimationHistogramBucket k_map_estimation_histogram = 1;
|
||
}
|
||
|
||
// Result of the δ-presence computation. Note that these results are an
|
||
// estimation, not exact values.
|
||
message DeltaPresenceEstimationResult {
|
||
// A tuple of values for the quasi-identifier columns.
|
||
message DeltaPresenceEstimationQuasiIdValues {
|
||
// The quasi-identifier values.
|
||
repeated Value quasi_ids_values = 1;
|
||
|
||
// The estimated probability that a given individual sharing these
|
||
// quasi-identifier values is in the dataset. This value, typically called
|
||
// δ, is the ratio between the number of records in the dataset with these
|
||
// quasi-identifier values, and the total number of individuals (inside
|
||
// *and* outside the dataset) with these quasi-identifier values.
|
||
// For example, if there are 15 individuals in the dataset who share the
|
||
// same quasi-identifier values, and an estimated 100 people in the entire
|
||
// population with these values, then δ is 0.15.
|
||
double estimated_probability = 2;
|
||
}
|
||
|
||
// A DeltaPresenceEstimationHistogramBucket message with the following
|
||
// values:
|
||
// min_probability: 0.1
|
||
// max_probability: 0.2
|
||
// frequency: 42
|
||
// means that there are 42 records for which δ is in [0.1, 0.2). An
|
||
// important particular case is when min_probability = max_probability = 1:
|
||
// then, every individual who shares this quasi-identifier combination is in
|
||
// the dataset.
|
||
message DeltaPresenceEstimationHistogramBucket {
|
||
// Between 0 and 1.
|
||
double min_probability = 1;
|
||
|
||
// Always greater than or equal to min_probability.
|
||
double max_probability = 2;
|
||
|
||
// Number of records within these probability bounds.
|
||
int64 bucket_size = 5;
|
||
|
||
// Sample of quasi-identifier tuple values in this bucket. The total
|
||
// number of classes returned per bucket is capped at 20.
|
||
repeated DeltaPresenceEstimationQuasiIdValues bucket_values = 6;
|
||
|
||
// Total number of distinct quasi-identifier tuple values in this bucket.
|
||
int64 bucket_value_count = 7;
|
||
}
|
||
|
||
// The intervals [min_probability, max_probability) do not overlap. If a
|
||
// value doesn't correspond to any such interval, the associated frequency
|
||
// is zero. For example, the following records:
|
||
// {min_probability: 0, max_probability: 0.1, frequency: 17}
|
||
// {min_probability: 0.2, max_probability: 0.3, frequency: 42}
|
||
// {min_probability: 0.3, max_probability: 0.4, frequency: 99}
|
||
// mean that there are no record with an estimated probability in [0.1, 0.2)
|
||
// nor larger or equal to 0.4.
|
||
repeated DeltaPresenceEstimationHistogramBucket
|
||
delta_presence_estimation_histogram = 1;
|
||
}
|
||
|
||
// Privacy metric to compute.
|
||
PrivacyMetric requested_privacy_metric = 1;
|
||
|
||
// Input dataset to compute metrics over.
|
||
BigQueryTable requested_source_table = 2;
|
||
|
||
// Values associated with this metric.
|
||
oneof result {
|
||
NumericalStatsResult numerical_stats_result = 3;
|
||
|
||
CategoricalStatsResult categorical_stats_result = 4;
|
||
|
||
KAnonymityResult k_anonymity_result = 5;
|
||
|
||
LDiversityResult l_diversity_result = 6;
|
||
|
||
KMapEstimationResult k_map_estimation_result = 7;
|
||
|
||
DeltaPresenceEstimationResult delta_presence_estimation_result = 9;
|
||
}
|
||
}
|
||
|
||
// A value of a field, including its frequency.
|
||
message ValueFrequency {
|
||
// A value contained in the field in question.
|
||
Value value = 1;
|
||
|
||
// How many times the value is contained in the field.
|
||
int64 count = 2;
|
||
}
|
||
|
||
// Set of primitive values supported by the system.
|
||
// Note that for the purposes of inspection or transformation, the number
|
||
// of bytes considered to comprise a 'Value' is based on its representation
|
||
// as a UTF-8 encoded string. For example, if 'integer_value' is set to
|
||
// 123456789, the number of bytes would be counted as 9, even though an
|
||
// int64 only holds up to 8 bytes of data.
|
||
message Value {
|
||
oneof type {
|
||
int64 integer_value = 1;
|
||
|
||
double float_value = 2;
|
||
|
||
string string_value = 3;
|
||
|
||
bool boolean_value = 4;
|
||
|
||
google.protobuf.Timestamp timestamp_value = 5;
|
||
|
||
google.type.TimeOfDay time_value = 6;
|
||
|
||
google.type.Date date_value = 7;
|
||
|
||
google.type.DayOfWeek day_of_week_value = 8;
|
||
}
|
||
}
|
||
|
||
// Message for infoType-dependent details parsed from quote.
|
||
message QuoteInfo {
|
||
// Object representation of the quote.
|
||
oneof parsed_quote {
|
||
// The date time indicated by the quote.
|
||
DateTime date_time = 2;
|
||
}
|
||
}
|
||
|
||
// Message for a date time object.
|
||
// e.g. 2018-01-01, 5th August.
|
||
message DateTime {
|
||
message TimeZone {
|
||
// Set only if the offset can be determined. Positive for time ahead of UTC.
|
||
// E.g. For "UTC-9", this value is -540.
|
||
int32 offset_minutes = 1;
|
||
}
|
||
|
||
// One or more of the following must be set. All fields are optional, but
|
||
// when set must be valid date or time values.
|
||
google.type.Date date = 1;
|
||
|
||
google.type.DayOfWeek day_of_week = 2;
|
||
|
||
google.type.TimeOfDay time = 3;
|
||
|
||
TimeZone time_zone = 4;
|
||
}
|
||
|
||
// The configuration that controls how the data will change.
|
||
message DeidentifyConfig {
|
||
oneof transformation {
|
||
// Treat the dataset as free-form text and apply the same free text
|
||
// transformation everywhere.
|
||
InfoTypeTransformations info_type_transformations = 1;
|
||
|
||
// Treat the dataset as structured. Transformations can be applied to
|
||
// specific locations within structured datasets, such as transforming
|
||
// a column within a table.
|
||
RecordTransformations record_transformations = 2;
|
||
}
|
||
}
|
||
|
||
// A rule for transforming a value.
|
||
message PrimitiveTransformation {
|
||
oneof transformation {
|
||
ReplaceValueConfig replace_config = 1;
|
||
|
||
RedactConfig redact_config = 2;
|
||
|
||
CharacterMaskConfig character_mask_config = 3;
|
||
|
||
CryptoReplaceFfxFpeConfig crypto_replace_ffx_fpe_config = 4;
|
||
|
||
FixedSizeBucketingConfig fixed_size_bucketing_config = 5;
|
||
|
||
BucketingConfig bucketing_config = 6;
|
||
|
||
ReplaceWithInfoTypeConfig replace_with_info_type_config = 7;
|
||
|
||
TimePartConfig time_part_config = 8;
|
||
|
||
CryptoHashConfig crypto_hash_config = 9;
|
||
|
||
DateShiftConfig date_shift_config = 11;
|
||
}
|
||
}
|
||
|
||
// For use with `Date`, `Timestamp`, and `TimeOfDay`, extract or preserve a
|
||
// portion of the value.
|
||
message TimePartConfig {
|
||
enum TimePart {
|
||
TIME_PART_UNSPECIFIED = 0;
|
||
|
||
// [0-9999]
|
||
YEAR = 1;
|
||
|
||
// [1-12]
|
||
MONTH = 2;
|
||
|
||
// [1-31]
|
||
DAY_OF_MONTH = 3;
|
||
|
||
// [1-7]
|
||
DAY_OF_WEEK = 4;
|
||
|
||
// [1-52]
|
||
WEEK_OF_YEAR = 5;
|
||
|
||
// [0-23]
|
||
HOUR_OF_DAY = 6;
|
||
}
|
||
|
||
TimePart part_to_extract = 1;
|
||
}
|
||
|
||
// Pseudonymization method that generates surrogates via cryptographic hashing.
|
||
// Uses SHA-256.
|
||
// The key size must be either 32 or 64 bytes.
|
||
// Outputs a base64 encoded representation of the hashed output
|
||
// (for example, L7k0BHmF1ha5U3NfGykjro4xWi1MPVQPjhMAZbSV9mM=).
|
||
// Currently, only string and integer values can be hashed.
|
||
// See https://cloud.google.com/dlp/docs/pseudonymization to learn more.
|
||
message CryptoHashConfig {
|
||
// The key used by the hash function.
|
||
CryptoKey crypto_key = 1;
|
||
}
|
||
|
||
// Replace each input value with a given `Value`.
|
||
message ReplaceValueConfig {
|
||
// Value to replace it with.
|
||
Value new_value = 1;
|
||
}
|
||
|
||
// Replace each matching finding with the name of the info_type.
|
||
message ReplaceWithInfoTypeConfig {}
|
||
|
||
// Redact a given value. For example, if used with an `InfoTypeTransformation`
|
||
// transforming PHONE_NUMBER, and input 'My phone number is 206-555-0123', the
|
||
// output would be 'My phone number is '.
|
||
message RedactConfig {}
|
||
|
||
// Characters to skip when doing deidentification of a value. These will be left
|
||
// alone and skipped.
|
||
message CharsToIgnore {
|
||
enum CommonCharsToIgnore {
|
||
COMMON_CHARS_TO_IGNORE_UNSPECIFIED = 0;
|
||
|
||
// 0-9
|
||
NUMERIC = 1;
|
||
|
||
// A-Z
|
||
ALPHA_UPPER_CASE = 2;
|
||
|
||
// a-z
|
||
ALPHA_LOWER_CASE = 3;
|
||
|
||
// US Punctuation, one of !"#$%&'()*+,-./:;<=>?@[\]^_`{|}~
|
||
PUNCTUATION = 4;
|
||
|
||
// Whitespace character, one of [ \t\n\x0B\f\r]
|
||
WHITESPACE = 5;
|
||
}
|
||
|
||
oneof characters {
|
||
string characters_to_skip = 1;
|
||
|
||
CommonCharsToIgnore common_characters_to_ignore = 2;
|
||
}
|
||
}
|
||
|
||
// Partially mask a string by replacing a given number of characters with a
|
||
// fixed character. Masking can start from the beginning or end of the string.
|
||
// This can be used on data of any type (numbers, longs, and so on) and when
|
||
// de-identifying structured data we'll attempt to preserve the original data's
|
||
// type. (This allows you to take a long like 123 and modify it to a string like
|
||
// **3.
|
||
message CharacterMaskConfig {
|
||
// Character to mask the sensitive values—for example, "*" for an
|
||
// alphabetic string such as name, or "0" for a numeric string such as ZIP
|
||
// code or credit card number. String must have length 1. If not supplied, we
|
||
// will default to "*" for strings, 0 for digits.
|
||
string masking_character = 1;
|
||
|
||
// Number of characters to mask. If not set, all matching chars will be
|
||
// masked. Skipped characters do not count towards this tally.
|
||
int32 number_to_mask = 2;
|
||
|
||
// Mask characters in reverse order. For example, if `masking_character` is
|
||
// '0', number_to_mask is 14, and `reverse_order` is false, then
|
||
// 1234-5678-9012-3456 -> 00000000000000-3456
|
||
// If `masking_character` is '*', `number_to_mask` is 3, and `reverse_order`
|
||
// is true, then 12345 -> 12***
|
||
bool reverse_order = 3;
|
||
|
||
// When masking a string, items in this list will be skipped when replacing.
|
||
// For example, if your string is 555-555-5555 and you ask us to skip `-` and
|
||
// mask 5 chars with * we would produce ***-*55-5555.
|
||
repeated CharsToIgnore characters_to_ignore = 4;
|
||
}
|
||
|
||
// Buckets values based on fixed size ranges. The
|
||
// Bucketing transformation can provide all of this functionality,
|
||
// but requires more configuration. This message is provided as a convenience to
|
||
// the user for simple bucketing strategies.
|
||
//
|
||
// The transformed value will be a hyphenated string of
|
||
// <lower_bound>-<upper_bound>, i.e if lower_bound = 10 and upper_bound = 20
|
||
// all values that are within this bucket will be replaced with "10-20".
|
||
//
|
||
// This can be used on data of type: double, long.
|
||
//
|
||
// If the bound Value type differs from the type of data
|
||
// being transformed, we will first attempt converting the type of the data to
|
||
// be transformed to match the type of the bound before comparing.
|
||
//
|
||
// See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
|
||
message FixedSizeBucketingConfig {
|
||
// Lower bound value of buckets. All values less than `lower_bound` are
|
||
// grouped together into a single bucket; for example if `lower_bound` = 10,
|
||
// then all values less than 10 are replaced with the value “-10”. [Required].
|
||
Value lower_bound = 1;
|
||
|
||
// Upper bound value of buckets. All values greater than upper_bound are
|
||
// grouped together into a single bucket; for example if `upper_bound` = 89,
|
||
// then all values greater than 89 are replaced with the value “89+”.
|
||
// [Required].
|
||
Value upper_bound = 2;
|
||
|
||
// Size of each bucket (except for minimum and maximum buckets). So if
|
||
// `lower_bound` = 10, `upper_bound` = 89, and `bucket_size` = 10, then the
|
||
// following buckets would be used: -10, 10-20, 20-30, 30-40, 40-50, 50-60,
|
||
// 60-70, 70-80, 80-89, 89+. Precision up to 2 decimals works. [Required].
|
||
double bucket_size = 3;
|
||
}
|
||
|
||
// Generalization function that buckets values based on ranges. The ranges and
|
||
// replacement values are dynamically provided by the user for custom behavior,
|
||
// such as 1-30 -> LOW 31-65 -> MEDIUM 66-100 -> HIGH
|
||
// This can be used on
|
||
// data of type: number, long, string, timestamp.
|
||
// If the bound `Value` type differs from the type of data being transformed, we
|
||
// will first attempt converting the type of the data to be transformed to match
|
||
// the type of the bound before comparing.
|
||
// See https://cloud.google.com/dlp/docs/concepts-bucketing to learn more.
|
||
message BucketingConfig {
|
||
// Bucket is represented as a range, along with replacement values.
|
||
message Bucket {
|
||
// Lower bound of the range, inclusive. Type should be the same as max if
|
||
// used.
|
||
Value min = 1;
|
||
|
||
// Upper bound of the range, exclusive; type must match min.
|
||
Value max = 2;
|
||
|
||
// Replacement value for this bucket. If not provided
|
||
// the default behavior will be to hyphenate the min-max range.
|
||
Value replacement_value = 3;
|
||
}
|
||
|
||
// Set of buckets. Ranges must be non-overlapping.
|
||
repeated Bucket buckets = 1;
|
||
}
|
||
|
||
// Replaces an identifier with a surrogate using FPE with the FFX
|
||
// mode of operation; however when used in the `ReidentifyContent` API method,
|
||
// it serves the opposite function by reversing the surrogate back into
|
||
// the original identifier.
|
||
// The identifier must be encoded as ASCII.
|
||
// For a given crypto key and context, the same identifier will be
|
||
// replaced with the same surrogate.
|
||
// Identifiers must be at least two characters long.
|
||
// In the case that the identifier is the empty string, it will be skipped.
|
||
// See https://cloud.google.com/dlp/docs/pseudonymization to learn more.
|
||
message CryptoReplaceFfxFpeConfig {
|
||
// These are commonly used subsets of the alphabet that the FFX mode
|
||
// natively supports. In the algorithm, the alphabet is selected using
|
||
// the "radix". Therefore each corresponds to particular radix.
|
||
enum FfxCommonNativeAlphabet {
|
||
FFX_COMMON_NATIVE_ALPHABET_UNSPECIFIED = 0;
|
||
|
||
// [0-9] (radix of 10)
|
||
NUMERIC = 1;
|
||
|
||
// [0-9A-F] (radix of 16)
|
||
HEXADECIMAL = 2;
|
||
|
||
// [0-9A-Z] (radix of 36)
|
||
UPPER_CASE_ALPHA_NUMERIC = 3;
|
||
|
||
// [0-9A-Za-z] (radix of 62)
|
||
ALPHA_NUMERIC = 4;
|
||
}
|
||
|
||
// The key used by the encryption algorithm. [required]
|
||
CryptoKey crypto_key = 1;
|
||
|
||
// The 'tweak', a context may be used for higher security since the same
|
||
// identifier in two different contexts won't be given the same surrogate. If
|
||
// the context is not set, a default tweak will be used.
|
||
//
|
||
// If the context is set but:
|
||
//
|
||
// 1. there is no record present when transforming a given value or
|
||
// 1. the field is not present when transforming a given value,
|
||
//
|
||
// a default tweak will be used.
|
||
//
|
||
// Note that case (1) is expected when an `InfoTypeTransformation` is
|
||
// applied to both structured and non-structured `ContentItem`s.
|
||
// Currently, the referenced field may be of value type integer or string.
|
||
//
|
||
// The tweak is constructed as a sequence of bytes in big endian byte order
|
||
// such that:
|
||
//
|
||
// - a 64 bit integer is encoded followed by a single byte of value 1
|
||
// - a string is encoded in UTF-8 format followed by a single byte of value 2
|
||
FieldId context = 2;
|
||
|
||
oneof alphabet {
|
||
FfxCommonNativeAlphabet common_alphabet = 4;
|
||
|
||
// This is supported by mapping these to the alphanumeric characters
|
||
// that the FFX mode natively supports. This happens before/after
|
||
// encryption/decryption.
|
||
// Each character listed must appear only once.
|
||
// Number of characters must be in the range [2, 62].
|
||
// This must be encoded as ASCII.
|
||
// The order of characters does not matter.
|
||
string custom_alphabet = 5;
|
||
|
||
// The native way to select the alphabet. Must be in the range [2, 62].
|
||
int32 radix = 6;
|
||
}
|
||
|
||
// The custom infoType to annotate the surrogate with.
|
||
// This annotation will be applied to the surrogate by prefixing it with
|
||
// the name of the custom infoType followed by the number of
|
||
// characters comprising the surrogate. The following scheme defines the
|
||
// format: info_type_name(surrogate_character_count):surrogate
|
||
//
|
||
// For example, if the name of custom infoType is 'MY_TOKEN_INFO_TYPE' and
|
||
// the surrogate is 'abc', the full replacement value
|
||
// will be: 'MY_TOKEN_INFO_TYPE(3):abc'
|
||
//
|
||
// This annotation identifies the surrogate when inspecting content using the
|
||
// custom infoType
|
||
// [`SurrogateType`](/dlp/docs/reference/rest/v2/InspectConfig#surrogatetype).
|
||
// This facilitates reversal of the surrogate when it occurs in free text.
|
||
//
|
||
// In order for inspection to work properly, the name of this infoType must
|
||
// not occur naturally anywhere in your data; otherwise, inspection may
|
||
// find a surrogate that does not correspond to an actual identifier.
|
||
// Therefore, choose your custom infoType name carefully after considering
|
||
// what your data looks like. One way to select a name that has a high chance
|
||
// of yielding reliable detection is to include one or more unicode characters
|
||
// that are highly improbable to exist in your data.
|
||
// For example, assuming your data is entered from a regular ASCII keyboard,
|
||
// the symbol with the hex code point 29DD might be used like so:
|
||
// ⧝MY_TOKEN_TYPE
|
||
InfoType surrogate_info_type = 8;
|
||
}
|
||
|
||
// This is a data encryption key (DEK) (as opposed to
|
||
// a key encryption key (KEK) stored by KMS).
|
||
// When using KMS to wrap/unwrap DEKs, be sure to set an appropriate
|
||
// IAM policy on the KMS CryptoKey (KEK) to ensure an attacker cannot
|
||
// unwrap the data crypto key.
|
||
message CryptoKey {
|
||
oneof source {
|
||
TransientCryptoKey transient = 1;
|
||
|
||
UnwrappedCryptoKey unwrapped = 2;
|
||
|
||
KmsWrappedCryptoKey kms_wrapped = 3;
|
||
}
|
||
}
|
||
|
||
// Use this to have a random data crypto key generated.
|
||
// It will be discarded after the request finishes.
|
||
message TransientCryptoKey {
|
||
// Name of the key. [required]
|
||
// This is an arbitrary string used to differentiate different keys.
|
||
// A unique key is generated per name: two separate `TransientCryptoKey`
|
||
// protos share the same generated key if their names are the same.
|
||
// When the data crypto key is generated, this name is not used in any way
|
||
// (repeating the api call will result in a different key being generated).
|
||
string name = 1;
|
||
}
|
||
|
||
// Using raw keys is prone to security risks due to accidentally
|
||
// leaking the key. Choose another type of key if possible.
|
||
message UnwrappedCryptoKey {
|
||
// The AES 128/192/256 bit key. [required]
|
||
bytes key = 1;
|
||
}
|
||
|
||
// Parts of the APIs which use certain infoTypes.
|
||
enum InfoTypeSupportedBy {
|
||
ENUM_TYPE_UNSPECIFIED = 0;
|
||
|
||
// Supported by the inspect operations.
|
||
INSPECT = 1;
|
||
|
||
// Supported by the risk analysis operations.
|
||
RISK_ANALYSIS = 2;
|
||
}
|
||
|
||
// Include to use an existing data crypto key wrapped by KMS.
|
||
// Authorization requires the following IAM permissions when sending a request
|
||
// to perform a crypto transformation using a kms-wrapped crypto key:
|
||
// dlp.kms.encrypt
|
||
message KmsWrappedCryptoKey {
|
||
// The wrapped data crypto key. [required]
|
||
bytes wrapped_key = 1;
|
||
|
||
// The resource name of the KMS CryptoKey to use for unwrapping. [required]
|
||
string crypto_key_name = 2;
|
||
}
|
||
|
||
// Shifts dates by random number of days, with option to be consistent for the
|
||
// same context. See https://cloud.google.com/dlp/docs/concepts-date-shifting
|
||
// to learn more.
|
||
message DateShiftConfig {
|
||
// Range of shift in days. Actual shift will be selected at random within this
|
||
// range (inclusive ends). Negative means shift to earlier in time. Must not
|
||
// be more than 365250 days (1000 years) each direction.
|
||
//
|
||
// For example, 3 means shift date to at most 3 days into the future.
|
||
// [Required]
|
||
int32 upper_bound_days = 1;
|
||
|
||
// For example, -5 means shift date to at most 5 days back in the past.
|
||
// [Required]
|
||
int32 lower_bound_days = 2;
|
||
|
||
// Points to the field that contains the context, for example, an entity id.
|
||
// If set, must also set method. If set, shift will be consistent for the
|
||
// given context.
|
||
FieldId context = 3;
|
||
|
||
// Method for calculating shift that takes context into consideration. If
|
||
// set, must also set context. Can only be applied to table items.
|
||
oneof method {
|
||
// Causes the shift to be computed based on this key and the context. This
|
||
// results in the same shift for the same context and crypto_key.
|
||
CryptoKey crypto_key = 4;
|
||
}
|
||
}
|
||
|
||
// A type of transformation that will scan unstructured text and
|
||
// apply various `PrimitiveTransformation`s to each finding, where the
|
||
// transformation is applied to only values that were identified as a specific
|
||
// info_type.
|
||
message InfoTypeTransformations {
|
||
// A transformation to apply to text that is identified as a specific
|
||
// info_type.
|
||
message InfoTypeTransformation {
|
||
// InfoTypes to apply the transformation to. An empty list will cause
|
||
// this transformation to apply to all findings that correspond to
|
||
// infoTypes that were requested in `InspectConfig`.
|
||
repeated InfoType info_types = 1;
|
||
|
||
// Primitive transformation to apply to the infoType. [required]
|
||
PrimitiveTransformation primitive_transformation = 2;
|
||
}
|
||
|
||
// Transformation for each infoType. Cannot specify more than one
|
||
// for a given infoType. [required]
|
||
repeated InfoTypeTransformation transformations = 1;
|
||
}
|
||
|
||
// The transformation to apply to the field.
|
||
message FieldTransformation {
|
||
// Input field(s) to apply the transformation to. [required]
|
||
repeated FieldId fields = 1;
|
||
|
||
// Only apply the transformation if the condition evaluates to true for the
|
||
// given `RecordCondition`. The conditions are allowed to reference fields
|
||
// that are not used in the actual transformation. [optional]
|
||
//
|
||
// Example Use Cases:
|
||
//
|
||
// - Apply a different bucket transformation to an age column if the zip code
|
||
// column for the same record is within a specific range.
|
||
// - Redact a field if the date of birth field is greater than 85.
|
||
RecordCondition condition = 3;
|
||
|
||
// Transformation to apply. [required]
|
||
oneof transformation {
|
||
// Apply the transformation to the entire field.
|
||
PrimitiveTransformation primitive_transformation = 4;
|
||
|
||
// Treat the contents of the field as free text, and selectively
|
||
// transform content that matches an `InfoType`.
|
||
InfoTypeTransformations info_type_transformations = 5;
|
||
}
|
||
}
|
||
|
||
// A type of transformation that is applied over structured data such as a
|
||
// table.
|
||
message RecordTransformations {
|
||
// Transform the record by applying various field transformations.
|
||
repeated FieldTransformation field_transformations = 1;
|
||
|
||
// Configuration defining which records get suppressed entirely. Records that
|
||
// match any suppression rule are omitted from the output [optional].
|
||
repeated RecordSuppression record_suppressions = 2;
|
||
}
|
||
|
||
// Configuration to suppress records whose suppression conditions evaluate to
|
||
// true.
|
||
message RecordSuppression {
|
||
// A condition that when it evaluates to true will result in the record being
|
||
// evaluated to be suppressed from the transformed content.
|
||
RecordCondition condition = 1;
|
||
}
|
||
|
||
// A condition for determining whether a transformation should be applied to
|
||
// a field.
|
||
message RecordCondition {
|
||
// The field type of `value` and `field` do not need to match to be
|
||
// considered equal, but not all comparisons are possible.
|
||
// EQUAL_TO and NOT_EQUAL_TO attempt to compare even with incompatible types,
|
||
// but all other comparisons are invalid with incompatible types.
|
||
// A `value` of type:
|
||
//
|
||
// - `string` can be compared against all other types
|
||
// - `boolean` can only be compared against other booleans
|
||
// - `integer` can be compared against doubles or a string if the string value
|
||
// can be parsed as an integer.
|
||
// - `double` can be compared against integers or a string if the string can
|
||
// be parsed as a double.
|
||
// - `Timestamp` can be compared against strings in RFC 3339 date string
|
||
// format.
|
||
// - `TimeOfDay` can be compared against timestamps and strings in the format
|
||
// of 'HH:mm:ss'.
|
||
//
|
||
// If we fail to compare do to type mismatch, a warning will be given and
|
||
// the condition will evaluate to false.
|
||
message Condition {
|
||
// Field within the record this condition is evaluated against. [required]
|
||
FieldId field = 1;
|
||
|
||
// Operator used to compare the field or infoType to the value. [required]
|
||
RelationalOperator operator = 3;
|
||
|
||
// Value to compare against. [Required, except for `EXISTS` tests.]
|
||
Value value = 4;
|
||
}
|
||
|
||
// A collection of conditions.
|
||
message Conditions {
|
||
repeated Condition conditions = 1;
|
||
}
|
||
|
||
// An expression, consisting or an operator and conditions.
|
||
message Expressions {
|
||
enum LogicalOperator {
|
||
LOGICAL_OPERATOR_UNSPECIFIED = 0;
|
||
|
||
AND = 1;
|
||
}
|
||
|
||
// The operator to apply to the result of conditions. Default and currently
|
||
// only supported value is `AND`.
|
||
LogicalOperator logical_operator = 1;
|
||
|
||
oneof type {
|
||
Conditions conditions = 3;
|
||
}
|
||
}
|
||
|
||
// An expression.
|
||
Expressions expressions = 3;
|
||
}
|
||
|
||
// Overview of the modifications that occurred.
|
||
message TransformationOverview {
|
||
// Total size in bytes that were transformed in some way.
|
||
int64 transformed_bytes = 2;
|
||
|
||
// Transformations applied to the dataset.
|
||
repeated TransformationSummary transformation_summaries = 3;
|
||
}
|
||
|
||
// Summary of a single tranformation.
|
||
// Only one of 'transformation', 'field_transformation', or 'record_suppress'
|
||
// will be set.
|
||
message TransformationSummary {
|
||
// A collection that informs the user the number of times a particular
|
||
// `TransformationResultCode` and error details occurred.
|
||
message SummaryResult {
|
||
int64 count = 1;
|
||
|
||
TransformationResultCode code = 2;
|
||
|
||
// A place for warnings or errors to show up if a transformation didn't
|
||
// work as expected.
|
||
string details = 3;
|
||
}
|
||
|
||
// Possible outcomes of transformations.
|
||
enum TransformationResultCode {
|
||
TRANSFORMATION_RESULT_CODE_UNSPECIFIED = 0;
|
||
|
||
SUCCESS = 1;
|
||
|
||
ERROR = 2;
|
||
}
|
||
|
||
// Set if the transformation was limited to a specific InfoType.
|
||
InfoType info_type = 1;
|
||
|
||
// Set if the transformation was limited to a specific FieldId.
|
||
FieldId field = 2;
|
||
|
||
// The specific transformation these stats apply to.
|
||
PrimitiveTransformation transformation = 3;
|
||
|
||
// The field transformation that was applied.
|
||
// If multiple field transformations are requested for a single field,
|
||
// this list will contain all of them; otherwise, only one is supplied.
|
||
repeated FieldTransformation field_transformations = 5;
|
||
|
||
// The specific suppression option these stats apply to.
|
||
RecordSuppression record_suppress = 6;
|
||
|
||
repeated SummaryResult results = 4;
|
||
|
||
// Total size in bytes that were transformed in some way.
|
||
int64 transformed_bytes = 7;
|
||
}
|
||
|
||
// Schedule for triggeredJobs.
|
||
message Schedule {
|
||
oneof option {
|
||
// With this option a job is started a regular periodic basis. For
|
||
// example: every day (86400 seconds).
|
||
//
|
||
// A scheduled start time will be skipped if the previous
|
||
// execution has not ended when its scheduled time occurs.
|
||
//
|
||
// This value must be set to a time duration greater than or equal
|
||
// to 1 day and can be no longer than 60 days.
|
||
google.protobuf.Duration recurrence_period_duration = 1;
|
||
}
|
||
}
|
||
|
||
// The inspectTemplate contains a configuration (set of types of sensitive data
|
||
// to be detected) to be used anywhere you otherwise would normally specify
|
||
// InspectConfig. See https://cloud.google.com/dlp/docs/concepts-templates
|
||
// to learn more.
|
||
message InspectTemplate {
|
||
// The template name. Output only.
|
||
//
|
||
// The template will have one of the following formats:
|
||
// `projects/PROJECT_ID/inspectTemplates/TEMPLATE_ID` OR
|
||
// `organizations/ORGANIZATION_ID/inspectTemplates/TEMPLATE_ID`
|
||
string name = 1;
|
||
|
||
// Display name (max 256 chars).
|
||
string display_name = 2;
|
||
|
||
// Short description (max 256 chars).
|
||
string description = 3;
|
||
|
||
// The creation timestamp of a inspectTemplate, output only field.
|
||
google.protobuf.Timestamp create_time = 4;
|
||
|
||
// The last update timestamp of a inspectTemplate, output only field.
|
||
google.protobuf.Timestamp update_time = 5;
|
||
|
||
// The core content of the template. Configuration of the scanning process.
|
||
InspectConfig inspect_config = 6;
|
||
}
|
||
|
||
// The DeidentifyTemplates contains instructions on how to deidentify content.
|
||
// See https://cloud.google.com/dlp/docs/concepts-templates to learn more.
|
||
message DeidentifyTemplate {
|
||
// The template name. Output only.
|
||
//
|
||
// The template will have one of the following formats:
|
||
// `projects/PROJECT_ID/deidentifyTemplates/TEMPLATE_ID` OR
|
||
// `organizations/ORGANIZATION_ID/deidentifyTemplates/TEMPLATE_ID`
|
||
string name = 1;
|
||
|
||
// Display name (max 256 chars).
|
||
string display_name = 2;
|
||
|
||
// Short description (max 256 chars).
|
||
string description = 3;
|
||
|
||
// The creation timestamp of a inspectTemplate, output only field.
|
||
google.protobuf.Timestamp create_time = 4;
|
||
|
||
// The last update timestamp of a inspectTemplate, output only field.
|
||
google.protobuf.Timestamp update_time = 5;
|
||
|
||
// ///////////// // The core content of the template // ///////////////
|
||
DeidentifyConfig deidentify_config = 6;
|
||
}
|
||
|
||
// Details information about an error encountered during job execution or
|
||
// the results of an unsuccessful activation of the JobTrigger.
|
||
// Output only field.
|
||
message Error {
|
||
google.rpc.Status details = 1;
|
||
|
||
// The times the error occurred.
|
||
repeated google.protobuf.Timestamp timestamps = 2;
|
||
}
|
||
|
||
// Contains a configuration to make dlp api calls on a repeating basis.
|
||
// See https://cloud.google.com/dlp/docs/concepts-job-triggers to learn more.
|
||
message JobTrigger {
|
||
// What event needs to occur for a new job to be started.
|
||
message Trigger {
|
||
oneof trigger {
|
||
// Create a job on a repeating basis based on the elapse of time.
|
||
Schedule schedule = 1;
|
||
}
|
||
}
|
||
|
||
// Whether the trigger is currently active. If PAUSED or CANCELLED, no jobs
|
||
// will be created with this configuration. The service may automatically
|
||
// pause triggers experiencing frequent errors. To restart a job, set the
|
||
// status to HEALTHY after correcting user errors.
|
||
enum Status {
|
||
STATUS_UNSPECIFIED = 0;
|
||
|
||
// Trigger is healthy.
|
||
HEALTHY = 1;
|
||
|
||
// Trigger is temporarily paused.
|
||
PAUSED = 2;
|
||
|
||
// Trigger is cancelled and can not be resumed.
|
||
CANCELLED = 3;
|
||
}
|
||
|
||
// Unique resource name for the triggeredJob, assigned by the service when the
|
||
// triggeredJob is created, for example
|
||
// `projects/dlp-test-project/triggeredJobs/53234423`.
|
||
string name = 1;
|
||
|
||
// Display name (max 100 chars)
|
||
string display_name = 2;
|
||
|
||
// User provided description (max 256 chars)
|
||
string description = 3;
|
||
|
||
// The configuration details for the specific type of job to run.
|
||
oneof job {
|
||
InspectJobConfig inspect_job = 4;
|
||
}
|
||
|
||
// A list of triggers which will be OR'ed together. Only one in the list
|
||
// needs to trigger for a job to be started. The list may contain only
|
||
// a single Schedule trigger and must have at least one object.
|
||
repeated Trigger triggers = 5;
|
||
|
||
// A stream of errors encountered when the trigger was activated. Repeated
|
||
// errors may result in the JobTrigger automatically being paused.
|
||
// Will return the last 100 errors. Whenever the JobTrigger is modified
|
||
// this list will be cleared. Output only field.
|
||
repeated Error errors = 6;
|
||
|
||
// The creation timestamp of a triggeredJob, output only field.
|
||
google.protobuf.Timestamp create_time = 7;
|
||
|
||
// The last update timestamp of a triggeredJob, output only field.
|
||
google.protobuf.Timestamp update_time = 8;
|
||
|
||
// The timestamp of the last time this trigger executed, output only field.
|
||
google.protobuf.Timestamp last_run_time = 9;
|
||
|
||
// A status for this trigger. [required]
|
||
Status status = 10;
|
||
}
|
||
|
||
// A task to execute on the completion of a job.
|
||
// See https://cloud.google.com/dlp/docs/concepts-actions to learn more.
|
||
message Action {
|
||
// If set, the detailed findings will be persisted to the specified
|
||
// OutputStorageConfig. Only a single instance of this action can be
|
||
// specified.
|
||
// Compatible with: Inspect, Risk
|
||
message SaveFindings {
|
||
OutputStorageConfig output_config = 1;
|
||
}
|
||
|
||
// Publish the results of a DlpJob to a pub sub channel.
|
||
// Compatible with: Inspect, Risk
|
||
message PublishToPubSub {
|
||
// Cloud Pub/Sub topic to send notifications to. The topic must have given
|
||
// publishing access rights to the DLP API service account executing
|
||
// the long running DlpJob sending the notifications.
|
||
// Format is projects/{project}/topics/{topic}.
|
||
string topic = 1;
|
||
}
|
||
|
||
// Publish the result summary of a DlpJob to the Cloud Security
|
||
// Command Center (CSCC Alpha).
|
||
// This action is only available for projects which are parts of
|
||
// an organization and whitelisted for the alpha Cloud Security Command
|
||
// Center.
|
||
// The action will publish count of finding instances and their info types.
|
||
// The summary of findings will be persisted in CSCC and are governed by CSCC
|
||
// service-specific policy, see https://cloud.google.com/terms/service-terms
|
||
// Only a single instance of this action can be specified.
|
||
// Compatible with: Inspect
|
||
message PublishSummaryToCscc {}
|
||
|
||
// Enable email notification to project owners and editors on jobs's
|
||
// completion/failure.
|
||
message JobNotificationEmails {}
|
||
|
||
oneof action {
|
||
// Save resulting findings in a provided location.
|
||
SaveFindings save_findings = 1;
|
||
|
||
// Publish a notification to a pubsub topic.
|
||
PublishToPubSub pub_sub = 2;
|
||
|
||
// Publish summary to Cloud Security Command Center (Alpha).
|
||
PublishSummaryToCscc publish_summary_to_cscc = 3;
|
||
|
||
// Enable email notification to project owners and editors on job‘s
|
||
// completion/failure.
|
||
JobNotificationEmails job_notification_emails = 8;
|
||
}
|
||
}
|
||
|
||
// Request message for CreateInspectTemplate.
|
||
message CreateInspectTemplateRequest {
|
||
// The parent resource name, for example projects/my-project-id or
|
||
// organizations/my-org-id.
|
||
string parent = 1;
|
||
|
||
// The InspectTemplate to create.
|
||
InspectTemplate inspect_template = 2;
|
||
|
||
// The template id can contain uppercase and lowercase letters,
|
||
// numbers, and hyphens; that is, it must match the regular
|
||
// expression: `[a-zA-Z\\d-]+`. The maximum length is 100
|
||
// characters. Can be empty to allow the system to generate one.
|
||
string template_id = 3;
|
||
}
|
||
|
||
// Request message for UpdateInspectTemplate.
|
||
message UpdateInspectTemplateRequest {
|
||
// Resource name of organization and inspectTemplate to be updated, for
|
||
// example `organizations/433245324/inspectTemplates/432452342` or
|
||
// projects/project-id/inspectTemplates/432452342.
|
||
string name = 1;
|
||
|
||
// New InspectTemplate value.
|
||
InspectTemplate inspect_template = 2;
|
||
|
||
// Mask to control which fields get updated.
|
||
google.protobuf.FieldMask update_mask = 3;
|
||
}
|
||
|
||
// Request message for GetInspectTemplate.
|
||
message GetInspectTemplateRequest {
|
||
// Resource name of the organization and inspectTemplate to be read, for
|
||
// example `organizations/433245324/inspectTemplates/432452342` or
|
||
// projects/project-id/inspectTemplates/432452342.
|
||
string name = 1;
|
||
}
|
||
|
||
// Request message for ListInspectTemplates.
|
||
message ListInspectTemplatesRequest {
|
||
// The parent resource name, for example projects/my-project-id or
|
||
// organizations/my-org-id.
|
||
string parent = 1;
|
||
|
||
// Optional page token to continue retrieval. Comes from previous call
|
||
// to `ListInspectTemplates`.
|
||
string page_token = 2;
|
||
|
||
// Optional size of the page, can be limited by server. If zero server returns
|
||
// a page of max size 100.
|
||
int32 page_size = 3;
|
||
|
||
// Optional comma separated list of fields to order by,
|
||
// followed by `asc` or `desc` postfix. This list is case-insensitive,
|
||
// default sorting order is ascending, redundant space characters are
|
||
// insignificant.
|
||
//
|
||
// Example: `name asc,update_time, create_time desc`
|
||
//
|
||
// Supported fields are:
|
||
//
|
||
// - `create_time`: corresponds to time the template was created.
|
||
// - `update_time`: corresponds to time the template was last updated.
|
||
// - `name`: corresponds to template's name.
|
||
// - `display_name`: corresponds to template's display name.
|
||
string order_by = 4;
|
||
}
|
||
|
||
// Response message for ListInspectTemplates.
|
||
message ListInspectTemplatesResponse {
|
||
// List of inspectTemplates, up to page_size in ListInspectTemplatesRequest.
|
||
repeated InspectTemplate inspect_templates = 1;
|
||
|
||
// If the next page is available then the next page token to be used
|
||
// in following ListInspectTemplates request.
|
||
string next_page_token = 2;
|
||
}
|
||
|
||
// Request message for DeleteInspectTemplate.
|
||
message DeleteInspectTemplateRequest {
|
||
// Resource name of the organization and inspectTemplate to be deleted, for
|
||
// example `organizations/433245324/inspectTemplates/432452342` or
|
||
// projects/project-id/inspectTemplates/432452342.
|
||
string name = 1;
|
||
}
|
||
|
||
// Request message for CreateJobTrigger.
|
||
message CreateJobTriggerRequest {
|
||
// The parent resource name, for example projects/my-project-id.
|
||
string parent = 1;
|
||
|
||
// The JobTrigger to create.
|
||
JobTrigger job_trigger = 2;
|
||
|
||
// The trigger id can contain uppercase and lowercase letters,
|
||
// numbers, and hyphens; that is, it must match the regular
|
||
// expression: `[a-zA-Z\\d-]+`. The maximum length is 100
|
||
// characters. Can be empty to allow the system to generate one.
|
||
string trigger_id = 3;
|
||
}
|
||
|
||
// Request message for ActivateJobTrigger.
|
||
message ActivateJobTriggerRequest {
|
||
// Resource name of the trigger to activate, for example
|
||
// `projects/dlp-test-project/jobTriggers/53234423`.
|
||
string name = 1;
|
||
}
|
||
|
||
// Request message for UpdateJobTrigger.
|
||
message UpdateJobTriggerRequest {
|
||
// Resource name of the project and the triggeredJob, for example
|
||
// `projects/dlp-test-project/jobTriggers/53234423`.
|
||
string name = 1;
|
||
|
||
// New JobTrigger value.
|
||
JobTrigger job_trigger = 2;
|
||
|
||
// Mask to control which fields get updated.
|
||
google.protobuf.FieldMask update_mask = 3;
|
||
}
|
||
|
||
// Request message for GetJobTrigger.
|
||
message GetJobTriggerRequest {
|
||
// Resource name of the project and the triggeredJob, for example
|
||
// `projects/dlp-test-project/jobTriggers/53234423`.
|
||
string name = 1;
|
||
}
|
||
|
||
// Request message for CreateDlpJobRequest. Used to initiate long running
|
||
// jobs such as calculating risk metrics or inspecting Google Cloud
|
||
// Storage.
|
||
message CreateDlpJobRequest {
|
||
// The parent resource name, for example projects/my-project-id.
|
||
string parent = 1;
|
||
|
||
// The configuration details for the specific type of job to run.
|
||
oneof job {
|
||
InspectJobConfig inspect_job = 2;
|
||
|
||
RiskAnalysisJobConfig risk_job = 3;
|
||
}
|
||
|
||
// The job id can contain uppercase and lowercase letters,
|
||
// numbers, and hyphens; that is, it must match the regular
|
||
// expression: `[a-zA-Z\\d-]+`. The maximum length is 100
|
||
// characters. Can be empty to allow the system to generate one.
|
||
string job_id = 4;
|
||
}
|
||
|
||
// Request message for ListJobTriggers.
|
||
message ListJobTriggersRequest {
|
||
// The parent resource name, for example `projects/my-project-id`.
|
||
string parent = 1;
|
||
|
||
// Optional page token to continue retrieval. Comes from previous call
|
||
// to ListJobTriggers. `order_by` field must not
|
||
// change for subsequent calls.
|
||
string page_token = 2;
|
||
|
||
// Optional size of the page, can be limited by a server.
|
||
int32 page_size = 3;
|
||
|
||
// Optional comma separated list of triggeredJob fields to order by,
|
||
// followed by `asc` or `desc` postfix. This list is case-insensitive,
|
||
// default sorting order is ascending, redundant space characters are
|
||
// insignificant.
|
||
//
|
||
// Example: `name asc,update_time, create_time desc`
|
||
//
|
||
// Supported fields are:
|
||
//
|
||
// - `create_time`: corresponds to time the JobTrigger was created.
|
||
// - `update_time`: corresponds to time the JobTrigger was last updated.
|
||
// - `last_run_time`: corresponds to the last time the JobTrigger ran.
|
||
// - `name`: corresponds to JobTrigger's name.
|
||
// - `display_name`: corresponds to JobTrigger's display name.
|
||
// - `status`: corresponds to JobTrigger's status.
|
||
string order_by = 4;
|
||
|
||
// Optional. Allows filtering.
|
||
//
|
||
// Supported syntax:
|
||
//
|
||
// * Filter expressions are made up of one or more restrictions.
|
||
// * Restrictions can be combined by `AND` or `OR` logical operators. A
|
||
// sequence of restrictions implicitly uses `AND`.
|
||
// * A restriction has the form of `<field> <operator> <value>`.
|
||
// * Supported fields/values for inspect jobs:
|
||
// - `status` - HEALTHY|PAUSED|CANCELLED
|
||
// - `inspected_storage` - DATASTORE|CLOUD_STORAGE|BIGQUERY
|
||
// - 'last_run_time` - RFC 3339 formatted timestamp, surrounded by
|
||
// quotation marks. Nanoseconds are ignored.
|
||
// - 'error_count' - Number of errors that have occurred while running.
|
||
// * The operator must be `=` or `!=` for status and inspected_storage.
|
||
//
|
||
// Examples:
|
||
//
|
||
// * inspected_storage = cloud_storage AND status = HEALTHY
|
||
// * inspected_storage = cloud_storage OR inspected_storage = bigquery
|
||
// * inspected_storage = cloud_storage AND (state = PAUSED OR state = HEALTHY)
|
||
// * last_run_time > \"2017-12-12T00:00:00+00:00\"
|
||
//
|
||
// The length of this field should be no more than 500 characters.
|
||
string filter = 5;
|
||
}
|
||
|
||
// Response message for ListJobTriggers.
|
||
message ListJobTriggersResponse {
|
||
// List of triggeredJobs, up to page_size in ListJobTriggersRequest.
|
||
repeated JobTrigger job_triggers = 1;
|
||
|
||
// If the next page is available then the next page token to be used
|
||
// in following ListJobTriggers request.
|
||
string next_page_token = 2;
|
||
}
|
||
|
||
// Request message for DeleteJobTrigger.
|
||
message DeleteJobTriggerRequest {
|
||
// Resource name of the project and the triggeredJob, for example
|
||
// `projects/dlp-test-project/jobTriggers/53234423`.
|
||
string name = 1;
|
||
}
|
||
|
||
message InspectJobConfig {
|
||
// The data to scan.
|
||
StorageConfig storage_config = 1;
|
||
|
||
// How and what to scan for.
|
||
InspectConfig inspect_config = 2;
|
||
|
||
// If provided, will be used as the default for all values in InspectConfig.
|
||
// `inspect_config` will be merged into the values persisted as part of the
|
||
// template.
|
||
string inspect_template_name = 3;
|
||
|
||
// Actions to execute at the completion of the job. Are executed in the order
|
||
// provided.
|
||
repeated Action actions = 4;
|
||
}
|
||
|
||
// Combines all of the information about a DLP job.
|
||
message DlpJob {
|
||
enum JobState {
|
||
JOB_STATE_UNSPECIFIED = 0;
|
||
|
||
// The job has not yet started.
|
||
PENDING = 1;
|
||
|
||
// The job is currently running.
|
||
RUNNING = 2;
|
||
|
||
// The job is no longer running.
|
||
DONE = 3;
|
||
|
||
// The job was canceled before it could complete.
|
||
CANCELED = 4;
|
||
|
||
// The job had an error and did not complete.
|
||
FAILED = 5;
|
||
}
|
||
|
||
// The server-assigned name.
|
||
string name = 1;
|
||
|
||
// The type of job.
|
||
DlpJobType type = 2;
|
||
|
||
// State of a job.
|
||
JobState state = 3;
|
||
|
||
oneof details {
|
||
// Results from analyzing risk of a data source.
|
||
AnalyzeDataSourceRiskDetails risk_details = 4;
|
||
|
||
// Results from inspecting a data source.
|
||
InspectDataSourceDetails inspect_details = 5;
|
||
}
|
||
|
||
// Time when the job was created.
|
||
google.protobuf.Timestamp create_time = 6;
|
||
|
||
// Time when the job started.
|
||
google.protobuf.Timestamp start_time = 7;
|
||
|
||
// Time when the job finished.
|
||
google.protobuf.Timestamp end_time = 8;
|
||
|
||
// If created by a job trigger, the resource name of the trigger that
|
||
// instantiated the job.
|
||
string job_trigger_name = 10;
|
||
|
||
// A stream of errors encountered running the job.
|
||
repeated Error errors = 11;
|
||
}
|
||
|
||
// The request message for [DlpJobs.GetDlpJob][].
|
||
message GetDlpJobRequest {
|
||
// The name of the DlpJob resource.
|
||
string name = 1;
|
||
}
|
||
|
||
// Operators available for comparing the value of fields.
|
||
enum RelationalOperator {
|
||
RELATIONAL_OPERATOR_UNSPECIFIED = 0;
|
||
|
||
// Equal. Attempts to match even with incompatible types.
|
||
EQUAL_TO = 1;
|
||
|
||
// Not equal to. Attempts to match even with incompatible types.
|
||
NOT_EQUAL_TO = 2;
|
||
|
||
// Greater than.
|
||
GREATER_THAN = 3;
|
||
|
||
// Less than.
|
||
LESS_THAN = 4;
|
||
|
||
// Greater than or equals.
|
||
GREATER_THAN_OR_EQUALS = 5;
|
||
|
||
// Less than or equals.
|
||
LESS_THAN_OR_EQUALS = 6;
|
||
|
||
// Exists
|
||
EXISTS = 7;
|
||
}
|
||
|
||
// The request message for listing DLP jobs.
|
||
message ListDlpJobsRequest {
|
||
// The parent resource name, for example projects/my-project-id.
|
||
string parent = 4;
|
||
|
||
// Optional. Allows filtering.
|
||
//
|
||
// Supported syntax:
|
||
//
|
||
// * Filter expressions are made up of one or more restrictions.
|
||
// * Restrictions can be combined by `AND` or `OR` logical operators. A
|
||
// sequence of restrictions implicitly uses `AND`.
|
||
// * A restriction has the form of `<field> <operator> <value>`.
|
||
// * Supported fields/values for inspect jobs:
|
||
// - `state` - PENDING|RUNNING|CANCELED|FINISHED|FAILED
|
||
// - `inspected_storage` - DATASTORE|CLOUD_STORAGE|BIGQUERY
|
||
// - `trigger_name` - The resource name of the trigger that created job.
|
||
// * Supported fields for risk analysis jobs:
|
||
// - `state` - RUNNING|CANCELED|FINISHED|FAILED
|
||
// * The operator must be `=` or `!=`.
|
||
//
|
||
// Examples:
|
||
//
|
||
// * inspected_storage = cloud_storage AND state = done
|
||
// * inspected_storage = cloud_storage OR inspected_storage = bigquery
|
||
// * inspected_storage = cloud_storage AND (state = done OR state = canceled)
|
||
//
|
||
// The length of this field should be no more than 500 characters.
|
||
string filter = 1;
|
||
|
||
// The standard list page size.
|
||
int32 page_size = 2;
|
||
|
||
// The standard list page token.
|
||
string page_token = 3;
|
||
|
||
// The type of job. Defaults to `DlpJobType.INSPECT`
|
||
DlpJobType type = 5;
|
||
|
||
// Optional comma separated list of fields to order by,
|
||
// followed by `asc` or `desc` postfix. This list is case-insensitive,
|
||
// default sorting order is ascending, redundant space characters are
|
||
// insignificant.
|
||
//
|
||
// Example: `name asc, end_time asc, create_time desc`
|
||
//
|
||
// Supported fields are:
|
||
//
|
||
// - `create_time`: corresponds to time the job was created.
|
||
// - `end_time`: corresponds to time the job ended.
|
||
// - `name`: corresponds to job's name.
|
||
// - `state`: corresponds to `state`
|
||
string order_by = 6;
|
||
}
|
||
|
||
// The response message for listing DLP jobs.
|
||
message ListDlpJobsResponse {
|
||
// A list of DlpJobs that matches the specified filter in the request.
|
||
repeated DlpJob jobs = 1;
|
||
|
||
// The standard List next-page token.
|
||
string next_page_token = 2;
|
||
}
|
||
|
||
// The request message for canceling a DLP job.
|
||
message CancelDlpJobRequest {
|
||
// The name of the DlpJob resource to be cancelled.
|
||
string name = 1;
|
||
}
|
||
|
||
// The request message for deleting a DLP job.
|
||
message DeleteDlpJobRequest {
|
||
// The name of the DlpJob resource to be deleted.
|
||
string name = 1;
|
||
}
|
||
|
||
// Request message for CreateDeidentifyTemplate.
|
||
message CreateDeidentifyTemplateRequest {
|
||
// The parent resource name, for example projects/my-project-id or
|
||
// organizations/my-org-id.
|
||
string parent = 1;
|
||
|
||
// The DeidentifyTemplate to create.
|
||
DeidentifyTemplate deidentify_template = 2;
|
||
|
||
// The template id can contain uppercase and lowercase letters,
|
||
// numbers, and hyphens; that is, it must match the regular
|
||
// expression: `[a-zA-Z\\d-]+`. The maximum length is 100
|
||
// characters. Can be empty to allow the system to generate one.
|
||
string template_id = 3;
|
||
}
|
||
|
||
// Request message for UpdateDeidentifyTemplate.
|
||
message UpdateDeidentifyTemplateRequest {
|
||
// Resource name of organization and deidentify template to be updated, for
|
||
// example `organizations/433245324/deidentifyTemplates/432452342` or
|
||
// projects/project-id/deidentifyTemplates/432452342.
|
||
string name = 1;
|
||
|
||
// New DeidentifyTemplate value.
|
||
DeidentifyTemplate deidentify_template = 2;
|
||
|
||
// Mask to control which fields get updated.
|
||
google.protobuf.FieldMask update_mask = 3;
|
||
}
|
||
|
||
// Request message for GetDeidentifyTemplate.
|
||
message GetDeidentifyTemplateRequest {
|
||
// Resource name of the organization and deidentify template to be read, for
|
||
// example `organizations/433245324/deidentifyTemplates/432452342` or
|
||
// projects/project-id/deidentifyTemplates/432452342.
|
||
string name = 1;
|
||
}
|
||
|
||
// Request message for ListDeidentifyTemplates.
|
||
message ListDeidentifyTemplatesRequest {
|
||
// The parent resource name, for example projects/my-project-id or
|
||
// organizations/my-org-id.
|
||
string parent = 1;
|
||
|
||
// Optional page token to continue retrieval. Comes from previous call
|
||
// to `ListDeidentifyTemplates`.
|
||
string page_token = 2;
|
||
|
||
// Optional size of the page, can be limited by server. If zero server returns
|
||
// a page of max size 100.
|
||
int32 page_size = 3;
|
||
|
||
// Optional comma separated list of fields to order by,
|
||
// followed by `asc` or `desc` postfix. This list is case-insensitive,
|
||
// default sorting order is ascending, redundant space characters are
|
||
// insignificant.
|
||
//
|
||
// Example: `name asc,update_time, create_time desc`
|
||
//
|
||
// Supported fields are:
|
||
//
|
||
// - `create_time`: corresponds to time the template was created.
|
||
// - `update_time`: corresponds to time the template was last updated.
|
||
// - `name`: corresponds to template's name.
|
||
// - `display_name`: corresponds to template's display name.
|
||
string order_by = 4;
|
||
}
|
||
|
||
// Response message for ListDeidentifyTemplates.
|
||
message ListDeidentifyTemplatesResponse {
|
||
// List of deidentify templates, up to page_size in
|
||
// ListDeidentifyTemplatesRequest.
|
||
repeated DeidentifyTemplate deidentify_templates = 1;
|
||
|
||
// If the next page is available then the next page token to be used
|
||
// in following ListDeidentifyTemplates request.
|
||
string next_page_token = 2;
|
||
}
|
||
|
||
// Request message for DeleteDeidentifyTemplate.
|
||
message DeleteDeidentifyTemplateRequest {
|
||
// Resource name of the organization and deidentify template to be deleted,
|
||
// for example `organizations/433245324/deidentifyTemplates/432452342` or
|
||
// projects/project-id/deidentifyTemplates/432452342.
|
||
string name = 1;
|
||
}
|
||
|
||
// Configuration for a custom dictionary created from a data source of any size
|
||
// up to the maximum size defined in the
|
||
// [limits](https://cloud.google.com/dlp/limits) page. The artifacts of
|
||
// dictionary creation are stored in the specified Google Cloud Storage
|
||
// location. Consider using `CustomInfoType.Dictionary` for smaller dictionaries
|
||
// that satisfy the size requirements.
|
||
message LargeCustomDictionaryConfig {
|
||
// Location to store dictionary artifacts in Google Cloud Storage. These files
|
||
// will only be accessible by project owners and the DLP API. If any of these
|
||
// artifacts are modified, the dictionary is considered invalid and can no
|
||
// longer be used.
|
||
CloudStoragePath output_path = 1;
|
||
|
||
oneof source {
|
||
// Set of files containing newline-delimited lists of dictionary phrases.
|
||
CloudStorageFileSet cloud_storage_file_set = 2;
|
||
|
||
// Field in a BigQuery table where each cell represents a dictionary phrase.
|
||
BigQueryField big_query_field = 3;
|
||
}
|
||
}
|
||
|
||
// Configuration for a StoredInfoType.
|
||
message StoredInfoTypeConfig {
|
||
// Display name of the StoredInfoType (max 256 characters).
|
||
string display_name = 1;
|
||
|
||
// Description of the StoredInfoType (max 256 characters).
|
||
string description = 2;
|
||
|
||
oneof type {
|
||
// StoredInfoType where findings are defined by a dictionary of phrases.
|
||
LargeCustomDictionaryConfig large_custom_dictionary = 3;
|
||
}
|
||
}
|
||
|
||
// Version of a StoredInfoType, including the configuration used to build it,
|
||
// create timestamp, and current state.
|
||
message StoredInfoTypeVersion {
|
||
// StoredInfoType configuration.
|
||
StoredInfoTypeConfig config = 1;
|
||
|
||
// Create timestamp of the version. Read-only, determined by the system
|
||
// when the version is created.
|
||
google.protobuf.Timestamp create_time = 2;
|
||
|
||
// Stored info type version state. Read-only, updated by the system
|
||
// during dictionary creation.
|
||
StoredInfoTypeState state = 3;
|
||
|
||
// Errors that occurred when creating this storedInfoType version, or
|
||
// anomalies detected in the storedInfoType data that render it unusable. Only
|
||
// the five most recent errors will be displayed, with the most recent error
|
||
// appearing first.
|
||
// <p>For example, some of the data for stored custom dictionaries is put in
|
||
// the user's Google Cloud Storage bucket, and if this data is modified or
|
||
// deleted by the user or another system, the dictionary becomes invalid.
|
||
// <p>If any errors occur, fix the problem indicated by the error message and
|
||
// use the UpdateStoredInfoType API method to create another version of the
|
||
// storedInfoType to continue using it, reusing the same `config` if it was
|
||
// not the source of the error.
|
||
repeated Error errors = 4;
|
||
}
|
||
|
||
// StoredInfoType resource message that contains information about the current
|
||
// version and any pending updates.
|
||
message StoredInfoType {
|
||
// Resource name.
|
||
string name = 1;
|
||
|
||
// Current version of the stored info type.
|
||
StoredInfoTypeVersion current_version = 2;
|
||
|
||
// Pending versions of the stored info type. Empty if no versions are
|
||
// pending.
|
||
repeated StoredInfoTypeVersion pending_versions = 3;
|
||
}
|
||
|
||
// Request message for CreateStoredInfoType.
|
||
message CreateStoredInfoTypeRequest {
|
||
// The parent resource name, for example projects/my-project-id or
|
||
// organizations/my-org-id.
|
||
string parent = 1;
|
||
|
||
// Configuration of the storedInfoType to create.
|
||
StoredInfoTypeConfig config = 2;
|
||
|
||
// The storedInfoType ID can contain uppercase and lowercase letters,
|
||
// numbers, and hyphens; that is, it must match the regular
|
||
// expression: `[a-zA-Z\\d-]+`. The maximum length is 100
|
||
// characters. Can be empty to allow the system to generate one.
|
||
string stored_info_type_id = 3;
|
||
}
|
||
|
||
// Request message for UpdateStoredInfoType.
|
||
message UpdateStoredInfoTypeRequest {
|
||
// Resource name of organization and storedInfoType to be updated, for
|
||
// example `organizations/433245324/storedInfoTypes/432452342` or
|
||
// projects/project-id/storedInfoTypes/432452342.
|
||
string name = 1;
|
||
|
||
// Updated configuration for the storedInfoType. If not provided, a new
|
||
// version of the storedInfoType will be created with the existing
|
||
// configuration.
|
||
StoredInfoTypeConfig config = 2;
|
||
|
||
// Mask to control which fields get updated.
|
||
google.protobuf.FieldMask update_mask = 3;
|
||
}
|
||
|
||
// Request message for GetStoredInfoType.
|
||
message GetStoredInfoTypeRequest {
|
||
// Resource name of the organization and storedInfoType to be read, for
|
||
// example `organizations/433245324/storedInfoTypes/432452342` or
|
||
// projects/project-id/storedInfoTypes/432452342.
|
||
string name = 1;
|
||
}
|
||
|
||
// Request message for ListStoredInfoTypes.
|
||
message ListStoredInfoTypesRequest {
|
||
// The parent resource name, for example projects/my-project-id or
|
||
// organizations/my-org-id.
|
||
string parent = 1;
|
||
|
||
// Optional page token to continue retrieval. Comes from previous call
|
||
// to `ListStoredInfoTypes`.
|
||
string page_token = 2;
|
||
|
||
// Optional size of the page, can be limited by server. If zero server returns
|
||
// a page of max size 100.
|
||
int32 page_size = 3;
|
||
|
||
// Optional comma separated list of fields to order by,
|
||
// followed by `asc` or `desc` postfix. This list is case-insensitive,
|
||
// default sorting order is ascending, redundant space characters are
|
||
// insignificant.
|
||
//
|
||
// Example: `name asc, display_name, create_time desc`
|
||
//
|
||
// Supported fields are:
|
||
//
|
||
// - `create_time`: corresponds to time the most recent version of the
|
||
// resource was created.
|
||
// - `state`: corresponds to the state of the resource.
|
||
// - `name`: corresponds to resource name.
|
||
// - `display_name`: corresponds to info type's display name.
|
||
string order_by = 4;
|
||
}
|
||
|
||
// Response message for ListStoredInfoTypes.
|
||
message ListStoredInfoTypesResponse {
|
||
// List of storedInfoTypes, up to page_size in ListStoredInfoTypesRequest.
|
||
repeated StoredInfoType stored_info_types = 1;
|
||
|
||
// If the next page is available then the next page token to be used
|
||
// in following ListStoredInfoTypes request.
|
||
string next_page_token = 2;
|
||
}
|
||
|
||
// Request message for DeleteStoredInfoType.
|
||
message DeleteStoredInfoTypeRequest {
|
||
// Resource name of the organization and storedInfoType to be deleted, for
|
||
// example `organizations/433245324/storedInfoTypes/432452342` or
|
||
// projects/project-id/storedInfoTypes/432452342.
|
||
string name = 1;
|
||
}
|
||
|
||
// An enum to represent the various type of DLP jobs.
|
||
enum DlpJobType {
|
||
DLP_JOB_TYPE_UNSPECIFIED = 0;
|
||
|
||
// The job inspected Google Cloud for sensitive data.
|
||
INSPECT_JOB = 1;
|
||
|
||
// The job executed a Risk Analysis computation.
|
||
RISK_ANALYSIS_JOB = 2;
|
||
}
|
||
|
||
// State of a StoredInfoType version.
|
||
enum StoredInfoTypeState {
|
||
STORED_INFO_TYPE_STATE_UNSPECIFIED = 0;
|
||
|
||
// StoredInfoType version is being created.
|
||
PENDING = 1;
|
||
|
||
// StoredInfoType version is ready for use.
|
||
READY = 2;
|
||
|
||
// StoredInfoType creation failed. All relevant error messages are returned in
|
||
// the `StoredInfoTypeVersion` message.
|
||
FAILED = 3;
|
||
|
||
// StoredInfoType is no longer valid because artifacts stored in
|
||
// user-controlled storage were modified. To fix an invalid StoredInfoType,
|
||
// use the `UpdateStoredInfoType` method to create a new version.
|
||
INVALID = 4;
|
||
}
|