enterprise_ai.dlp

Source: sdks/python/src/enterprise_ai/dlp/__init__.py. Back to the Python SDK reference index.

note

This page is generated by tools/docs/gen_sdk_reference.py from the SDK sources and the OpenAPI text folders. Do not edit it by hand: change the source and regenerate.

Model Finding

One local DLP match.

Fields:

Name	Type	Required	Description
type	str	yes	Kind of data found: email, iban, credit_card, fr_nir, phone, ipv4 or secret.
start	int	yes	Start the services once installed. Default true.
end	int	yes	End offset of the match in the text (exclusive).
value	str	yes	Matched text, in clear.

Finding.to_dict

to_dict(reveal: bool = False) -> dict[str, Any]

The finding as a {type, start, end, value} dict, value masked unless reveal.

Name	Type	Default	Required	Description
reveal	bool	False	no	Keep the matched value in clear (default False: masked by mask_value).

Returns: dict[str, Any]. Dict {type, start, end, value}.

Class DlpClient

/v1/dlp.

Resource

DlpClient.create_rule

create_rule(name: str, pattern: str, action: str = 'mask', **extra: Any) -> Any

Create or update a DLP rule. Creates the rule, or replaces the rule of the same name. A rule needs an entity_type or a pattern (a valid regular expression); errors answer 400 invalid_request (unknown action, invalid pattern or classification). Needs tenant_admin or security_officer. Writes the audit event dlp.rule.upsert. Answers 201 with the rule.

Route: /v1/dlp/rules (POST).

Name	Type	Default	Required	Description
name	str		yes	Unique name of the rule, 1 to 120 characters.
pattern	str		yes	Regular expression of a custom entity, at most 500 characters.
action	str	'mask'	no	Action on a finding: allow, detect, mask (default), tokenize or block; it overrides the mode of the request.
**extra	Any		no	Extra fields merged into the request body.

Returns: Any. Decoded JSON answer of the operation "Create or update a DLP rule".

Raises: the typed errors of the transport (Errors).

DlpClient.inspect

inspect(text: str, **extra: Any) -> Any

Inspect a text for sensitive data. Runs DLP on the text with the tenant rules, in mode detect unless mode says otherwise. The answer gives text, findings (type, position, score, classification, short preview, action, rule), action (strongest action applied), classification, mode, engine (builtin or presidio), blocked and count. An unknown mode answers 400. Open to any member of the tenant. Writes the audit event dlp.inspect (counts and types only).

Route: /v1/dlp/inspect (POST).

Name	Type	Default	Required	Description
text	str		yes	Text to inspect or redact.
**extra	Any		no	Extra fields merged into the request body.

Returns: Any. Decoded JSON answer of the operation "Inspect a text for sensitive data".

Raises: the typed errors of the transport (Errors).

DlpClient.list_rules

list_rules() -> Any

List the DLP rules. Lists the DLP rules of the tenant ordered by name. Open to any member of the tenant. next_cursor is always null.

Route: /v1/dlp/rules (GET).

This element takes no parameter.

Returns: Any. Decoded JSON answer of the operation "List the DLP rules".

Raises: the typed errors of the transport (Errors).

DlpClient.prescan

prescan(text: str) -> list[dict[str, Any]]

Local regex pre-scan, values masked.

Name	Type	Default	Required	Description
text	str		yes	Text to scan locally before it leaves the process.

Returns: list[dict[str, Any]]. One {type, start, end, value} dict per finding, value masked by mask_value.

DlpClient.redact

redact(text: str, mode: str = 'mask', **extra: Any) -> Any

Redact sensitive data from a text. Same as inspect, in mode mask by default: each finding is replaced by [TYPE] (for example [EMAIL]), or tokenized or blocked when a tenant rule or mode says so; a blocked text comes back empty with blocked: true. Open to any member of the tenant. Writes the audit event dlp.redact.

Route: /v1/dlp/redact (POST).

Name	Type	Default	Required	Description
text	str		yes	Text to inspect or redact.
mode	str	'mask'	no	detect, mask, tokenize or block. Default: detect for inspect, mask for redact.
**extra	Any		no	Extra fields merged into the request body.

Returns: Any. Decoded JSON answer of the operation "Redact sensitive data from a text".

Raises: ValueError, the typed errors of the transport (Errors).

Class TokenizationClient

/v1/tokenization (policy checked and audited server side).

Resource

TokenizationClient.detokenize

detokenize(tokens: list[str], purpose: str, **extra: Any) -> Any

Detokenize values. Returns the original values of tokens given in tokens or found in text.

Route: /v1/tokenization/detokenize (POST).

Name	Type	Default	Required	Description
tokens	list[str]		yes	Tokens to resolve, tok_<type>_<hex>.
purpose	str		yes	Why the values are needed, passed to the policy as context.purpose and written to the audit trail.
**extra	Any		no	Extra fields merged into the request body.

Returns: Any. Decoded JSON answer of the operation "Detokenize values".

Raises: the typed errors of the transport (Errors).

TokenizationClient.tokenize

tokenize(values: list[dict[str, str]] | None = None, text: str | None = None, **extra: Any) -> Any

Tokenize values. Replaces sensitive values by deterministic tokens tok_<type>_<hex> of the tenant (the same value always gives the same token), the values being stored encrypted in the vault. With values, returns tokens; with text, detects the entities and returns the tokenized text, findings and classification. One of the two is required (400 invalid_request). Open to any member of the tenant. Writes the audit event tokenization.tokenize (count only).

Route: /v1/tokenization/tokenize (POST).

Name	Type	Default	Required	Description
values	list[dict[str, str]] | None	None	no	Values to tokenize, each with its type.
text	str | None	None	no	Text whose detected entities are replaced by tokens.
**extra	Any		no	Extra fields merged into the request body.

Returns: Any. Decoded JSON answer of the operation "Tokenize values".

Raises: the typed errors of the transport (Errors).

Functions

luhn_ok

luhn_ok(number: str) -> bool

Luhn checksum of a digit string.

Name	Type	Default	Required	Description
number	str		yes	Card number; characters other than digits are ignored.

Returns: bool. True when the number has at least 13 digits and passes the Luhn check.

mask_value

mask_value(value: str) -> str

Keep the last 2 characters, mask the rest.

Name	Type	Default	Required	Description
value	str		yes	Value to mask.

Returns: str. The value with * in place of every character but the last 2; fully masked when 4 characters or fewer.

scan

scan(text: str, types: list[str] | None = None) -> list[Finding]

Find personal data and secrets in text (overlaps resolved by first, longest match).

Name	Type	Default	Required	Description
text	str		yes	Text to scan.
types	list[str] | None	None	no	Kinds of data to look for (email, iban, credit_card, fr_nir, phone, ipv4, secret); default all.

Returns: list[Finding]. A Finding: One local DLP match.

classify_text

classify_text(text: str) -> str

Highest classification implied by local findings (internal when nothing is found).

Name	Type	Default	Required	Description
text	str		yes	Text to scan and classify.

Returns: str. internal, confidential or restricted (secrets, cards and NIR are restricted; email, phone and IBAN confidential).

redact

redact(text: str, mode: str = 'mask', types: list[str] | None = None) -> str

Replace findings with [TYPE] placeholders (mask) or raise on block.

Name	Type	Default	Required	Description
text	str		yes	Text to redact.
mode	str	'mask'	no	detect (text unchanged), mask or tokenize (findings replaced by [TYPE]), block (raises PolicyDenied dlp_blocked); default mask.
types	list[str] | None	None	no	Kinds of data to look for (email, iban, ...); default all.

Returns: str. The redacted text, or the text unchanged when nothing is found.

Raises: PolicyDenied, ValueError.