Skip to main content
GET
Get Data Masking Rule

Path Parameters

id
string
required

The unique identifier of the resource

Response

OK

name
string
required

The unique name of the data masking rule, it's immutable after creation

Example:

"mask-email"

attributes
string[]

Attributes associated with this data masking rule

Example:
connection_ids
string[]

The connections that this rule applies to

Example:
custom_entity_types
object[]

The custom entity types that this rule applies to

description
string

The description of the data masking rule

Example:

"Mask email addresses in the data"

id
string<uuid>

The unique identifier of the data masking rule

Example:

"15B5A2FD-0706-4A47-B1CF-B93CCFC5B3D7"

managed_by
string
read-only

Managed By is a read only field that indicates who manages this rule. When set (e.g. "hoop" for protection profiles), the rule cannot be modified or deleted directly.

Example:

"hoop"

score_threshold
number

The minimal detection score threshold for the entities to be masked.

Example:

0.6

sidecar_spec
object

SidecarSpec is this rule in the SIDECAR's own vocabulary, which the gateway's fields above do not share: entities OR column names, a strategy (redact, mask, partial, hash) and a keep_last. It holds the mask block the listener receives: {"rules": [...]}.

A control plane field. A gateway has no sidecars and refuses it.

sidecar_targets
object[]

SidecarTargets names the sidecar LISTENERS that must apply this rule. A listener's mask block REPLACES the sidecar defaults rather than adding to them, which is why the binding is per listener.

A POINTER because absent and empty are different instructions: absent leaves the bindings exactly as they are, and [] unbinds the rule from every sidecar. Without that distinction any write that did not mention the field -- a script fixing a typo, the gateway's own UI, an MCP call -- would silently unbind a rule from the whole fleet.

supported_entity_types
object[]

The registered entity types that this rule applies to

updated_at
string
read-only

The timestamp when the rule was updated

Example:

"2023-08-15T14:30:45Z"