Copy page

Transforms

Mask

Replace field values with a fixed mask or deterministic keyed hash.

Overview

The Mask transformation replaces the value at a given key so the original is no longer present in the record. It supports two modes:

• Simple (simple) — replaces the value with a fixed mask (*****). Use this to redact a field entirely.
• Deterministic (deterministic) — replaces the value with a keyed HMAC-SHA256 hash. The same input and key always produce the same output, so masked values remain correlatable across records without exposing the plaintext.

Configuration

Argument	Type	Required	Default	Description
key	string	Yes	—	Path to the field whose value will be masked
mode	object	Yes	—	Masking mode configuration
mode.type	string	Yes	simple	Masking mode: simple or deterministic
mode.deterministic.hash_key	secret	Yes (for deterministic)	—	HMAC key material, at least 16 bytes

Example

Redact the user.email field with a fixed mask:

Code
{
  "operation": "mask",
  "arguments": {
    "key": "user.email",
    "mode": {
      "type": "simple",
      "simple": {}
    }
  }
}

Given the input record:

Code
{
  "user": {
    "name": "Alice",
    "email": "alice@example.com"
  }
}

The output record replaces the value with the fixed mask:

Code
{
  "user": {
    "name": "Alice",
    "email": "*****"
  }
}

To produce a stable, correlatable value instead, use deterministic mode with an HMAC key:

Code
{
  "operation": "mask",
  "arguments": {
    "key": "user.email",
    "mode": {
      "type": "deterministic",
      "deterministic": {
        "hash_key": "<hmac-key-material>"
      }
    }
  }
}

The value is replaced with a hex-encoded HMAC-SHA256 digest, e.g.:

Code
{
  "user": {
    "name": "Alice",
    "email": "3f9a1c...hmac-digest..."
  }
}

Notes

1. The value is replaced in place; no new field is created.
2. Simple mode always uses the fixed mask *****.
3. Deterministic mode requires hash_key, provided as a secret, and it must be at least 16 bytes.
4. Deterministic output is stable: identical inputs masked with the same key produce identical digests, enabling correlation without revealing the original value.