- PrivaceraCloud Release 7.4
- Enhancements and updates in PrivaceraCloud release 7.4
- Known Issues in PrivaceraCloud 7.4
- PrivaceraCloud User Guide
- Overview of PrivaceraCloud
- Connect applications with the setup wizard
- Connect applications
- About applications
- Connect Azure Data Lake Storage Gen 2 (ADLS) to PrivaceraCloud
- Connect Amazon Textract to PrivaceraCloud
- Athena
- Privacera Discovery with Cassandra
- Connect Databricks to PrivaceraCloud
- Databricks SQL
- Databricks SQL Overview and Configuration
- Planning and general process
- Prerequisites
- Databricks SQL with Privacera Hive
- Connect Databricks SQL application
- Grant Databricks SQL permissions to PrivaceraCloud users
- Define a resource policy
- Test the policy
- Databricks SQL PolicySync fields
- Configuring column-level access control
- View-based masking functions and row-level filtering
- Create an endpoint in Databricks SQL
- Databricks SQL Fields
- Databricks SQL Hive Service Definition
- Databricks SQL Masking Functions
- Databricks SQL Encryption
- Use a custom policy repository with Databricks
- Connect Databricks SQL to Hive policy repository on PrivaceraCloud
- Databricks SQL Overview and Configuration
- Connect Databricks Unity Catalog to PrivaceraCloud
- Connect S3 to PrivaceraCloud
- Prerequisites in AWS console
- Connect S3 application to PrivaceraCloud
- Enable Privacera Access Management for S3
- Enable Data Discovery for S3
- S3 AWS Commands - Ranger Permission Mapping
- S3
- AWS Access with IAM
- Access AWS S3 buckets from multiple AWS accounts
- Add UserInfo in S3 Requests sent via Dataserver
- Control access to S3 buckets with AWS Lambda function on PrivaceraCloud
- Dremio Plugin
- DynamoDB
- Connect Elastic MapReduce from Amazon application to PrivaceraCloud
- Connect EMR application
- EMR Spark access control types
- PrivaceraCloud configuration
- AWS IAM roles using CloudFormation setup
- Create a security configuration
- Create EMR cluster
- How to configure multiple JSON Web Tokens (JWTs) for EMR
- EMR Native Ranger Integration with PrivaceraCloud
- Connect EMRFS S3 to PrivaceraCloud
- Files
- GBQ
- Google Cloud Storage
- Connect Glue to PrivaceraCloud
- Google BigQuery for PolicySync
- Connect Kinesis to PrivaceraCloud
- Connect Lambda to PrivaceraCloud
- Microsoft SQL Server
- MySQL for Discovery
- Open Source Apache Spark
- Oracle for Discovery
- PostgreSQL
- Connect Power BI to PrivaceraCloud
- Presto
- Redshift
- Snowflake
- Starburst Enterprise with PrivaceraCloud
- Starburst Enterprise Presto
- Trino
- Connect users
- Data access Users, Groups, and Roles
- UserSync
- Portal user LDAP/AD
- Datasource
- Okta Setup for SAML-SSO
- Azure AD setup
- SCIM Server User-Provisioning
- User Management
- Identity
- Access Manager
- Access Manager
- Resource Policies
- Tag Policies
- Scheme Policies
- Service Explorer
- Reports
- Audit
- About data access users, groups, and roles resource policies
- Security zones
- Discovery
- Classifications via random sampling
- Privacera Discovery scan targets
- Propagate Privacera Discovery Tags to Ranger
- Enable offline scanning on Azure Data Lake Storage Gen 2 (ADLS)
- Enable Real-time Scanning of S3 Buckets
- Enable Real-time Scanning on Azure Data Lake Storage Gen 2 (ADLS)
- Enable Discovery Realtime Scanning Using IAM Role
- Encryption
- Overview of Privacera Encryption
- Encryption schemes
- Presentation schemes
- Masking schemes
- Create scheme policies
- Privacera-supplied encryption schemes for the Privacera API
- Privacera-supplied encryption schemes for the Bouncy Castle API
- API date input formats
- Deprecated encryption formats, algorithms, and scopes
- Privacera Encryption REST API
- PEG API endpoint
- PEG REST API encryption endpoints
- Prerequisites
- Common PEG REST API fields
- Construct the datalist for the /protect endpoint
- Deconstruct the response from the /unprotect endpoint
- Example data transformation with the /unprotect endpoint and presentation scheme
- Example PEG API endpoints
- Make encryption API calls on behalf of another user
- Privacera Encryption UDF for masking in Databricks on PrivaceraCloud
- Privacera Encryption UDFs for Trino on PrivaceraCloud
- Syntax of Privacera Encryption UDFs for Trino
- Prerequisites for installing Privacera Crypto plug-in for Trino
- Download and install Privacera Crypto jar
- Set variables in Trino etc/crypto.properties
- Restart Trino to register the Privacera encryption and masking UDFs for Trino
- Example queries to verify Privacera-supplied UDFs
- Privacera Encryption UDF for masking in Trino on PrivaceraCloud
- Encryption UDFs for Apache Spark on PrivaceraCloud
- Launch Pad
- Settings
- Dashboard
- Usage statistics
- Operational status of PrivaceraCloud and RSS feed
- How to Get Support
- Coordinated Vulnerability Disclosure (CVD) Program of Privacera
- Shared Security Model
- PrivaceraCloud Previews
- Preview: File Explorer for S3
- Preview: File Explorer for Azure
- Preview: File Explorer for GCS
- Preview: Scan Generic Records with NER Model
- Preview: Scan Electronic Health Records with NER Model
- Preview: OneLogin setup for SAML-SSO
- Preview: Azure Active Directory SCIM Server UserSync
- Preview: OneLogin UserSync
- Preview: PingFederate UserSync
- Quickstart for Databricks Unity Catalog on PrivaceraCloud
- What do I need to do in my Databricks Workspace?
- Where is the sample dataset in my Databricks Workspace?
- What should I do in the PrivaceraCloud web portal?
- Access use-case - How do I give a user access to a table or restrict from running a SQL select query?
- Access use-case - How do I restrict a user from seeing contents of a column in the result of a SQL select query?
- Column masking use-case - How do I restrict a user from seeing contents of a column by masking the values in the result of a SQL select query?
- Access use-case - How do I disallow a user from seeing certain rows of a table?
- PrivaceraCloud documentation changelog
Privacera Encryption REST API
PEG API endpoint
The PEG API endpoint is obtained using the Copy Url link in Settings > Api Key.
In the examples here, we call this endpoint <cloud_peg_api_endpoint>
.
PEG REST API encryption endpoints
The PEG REST API consists of the following endpoints:
/protect
- Encrypts the data./unprotect
- Decrypts the data.
Prerequisites
API Key
For the REST API requests protect
and /unprotect
, you need an API key. See API Key.
Scheme policy required for protect and unprotect API endpoints
For the REST API endpoints /protect
and /unprotect
, you must create a scheme policy that grants these permissions to the user. See ???.
Common PEG REST API fields
This example of the /protect
endpoint illustrates some common fields of the PEG REST API on PrivaceraCloud. The example is split across separate lines for clarity but in actual use is a single line.
curl -il --request POST https://<cloud_peg_api_endpoint>/api/<api-key>/api/peg/public/protect -u <service_user>:<password> --header "Accept: application/json" --header 'Content-Type: application/json' --data-raw '{"schemelist":["<encryption_scheme>,..."], \ "datalist":[["<data_to_encrypt>",...]], \ "maskSchemelist": ["<masking_scheme>",...], \ "maskDatalist": [[data_to_mask,...], \ "user":"<application_user>"}'
The following table displays common PEG REST API fields with descriptions of each:
Line | Description |
---|---|
| Your API endpoint as described in PEG REST API encryption endpoints. |
| Your API key, as described in API Key. |
| List of <encryption_schemes>. |
| One or more <encryption_schemes> to encrypt or decrypt data in |
| List of data elements, one for each scheme in the |
| A data element to be encrypted with |
| List of data elements for masking, with at least one for each masking scheme in |
| One or more <masking_schemes> to mask the data in |
| List of data elements for masking, with at least one for each masking scheme in |
| The application user or end-user that connects to a service, such as Snowflake, UDF, or ODBC application. By way of scheme policies, the permission to use Privacera Encryption of this user is verified. |
| Not shown here, the
|
Construct the datalist for the /protect endpoint
Suppose you want to encrypt two database fields tagged with Privacera metadata PERSON_NAME
and EMAIL
. The value of your API datalist
to encrypt can be constructed by doing the following:
Extract from the database the unencrypted values of the tagged fields.
Format a JSON array of those values.
Make an API
/protect
request to encrypt the values in that array.Reformat the returned JSON array of the encrypted values to update the fields in your database.
Deconstruct the response from the /unprotect endpoint
Suppose you want to decrypt two database fields tagged with Privacera metadata PERSON_NAME
and EMAIL
. The value of your API datalist
to decrypt can be constructed by doing the following:
Extract from the database the encrypted values of the tagged fields.
Format a JSON array of those values.
Make an API
/unprotect
request to decrypt the values in that array.Reformat the returned JSON array of the decrypted values to update the fields in your database.
Example data transformation with the /unprotect endpoint and presentation scheme
This example shows some original input data, its representation when encrypted, and its obfuscated result after decryption with /unprotect
and an optional presentation scheme.
Original value:
sally@gmail.com
Encrypted value:
xy12zb@1mno2.rtz
Value after decryption and presentation scheme. The domain portion has been obfuscated:
sally@ymxof.1dg
Example PEG API endpoints
These examples do not show the curl
or authentication or the PrivaceraCloud PEG API endpoint. Only the JSON bodies for the requests (with the curl --data-raw
option) and responses are shown.
If you are testing with a self-signed certificate, to bypass the certificate validation check, add the curl -k
option.
/protect with encryption scheme
The two elements in the input datalist
array are encrypted with the encryption schemes PERSON_NAME
and EMAIL
.
--data-raw '{"schemelist":["PERSON_NAME", "EMAIL"], "datalist": [["Mark", "Jonathan","Christopher"], ["mark@example.com", "jonathan@test.com", "christopher@google.com"]], "user":"jimmybob@BigCo.com"}'
Response
"datalist":[["WjM5", "5vpJF9zT", "1EbplEYVBjy"], ["i0bD@WKbMYpr.CvE", "?9aqS8zV@YUym.hkd", "d501shhJEO&@YpvfOc.VYH"]], "data":"", "responseStatus:"SUCCESS"}
/protect with masking scheme
The element in the input maskDataList
array is masked by the masking scheme MASKING_SCHEME
.
This example uses the authentication token retrieved with /authenticate
.
--data-raw '{ "maskSchemelist": [ "MASKING_SCHEME" ], "maskDatalist": [ [ "",null,"12-12-2012","12/12/2025T09:01:02" ] "user":"<application_user>"}'
Response
{ "maskDatalist": [ [ "", null, "**-**-****", "**/**/*******:**:**" ] }
/protect with both encryption and masking schemes
The element in the input datalist
array is encrypted with the encryption scheme SYSTEM_EMAIL
and at the same time the data in the input maskDataList
is masked with the masking scheme MASKING_SCHEME
.
--data-raw '{"schemelist":["SYSTEM_EMAIL"], \ "datalist":[ ["sally@gmail.com"] ], \ "maskSchemelist":["DATE_MASKING_SCHEME"], \ "maskDatalist":[ ["",null,"12-12-2012","12/12/2025T09:01:02"] ], \ "user":"padmin" }'
Response
{ "datalist": [ [ "mNM-^@RUWqb.qRK" ] ], "data": "", "maskDatalist": [ [ "", null, "**-**-****", "**/**/*******:**:**" ] ], "responseStatus": "SUCCESS" }
/unprotect without presentation scheme
The two elements in the input datalist
array are decrypted with the encryption schemes PERSON_NAME
and EMAIL
.
--data-raw '{"schemelist":["PERSON_NAME", "EMAIL"], "datalist": [["WjM5","5vpJF9zT", "1EbplEYVBjy"], ["i0bD@WKbMYpr.CvE", "?9aqS8zV@YUym.hkd", "d501shhJEO&@YpvfOc.VYH"]], "user":"<application_user>"}'
Response
{"datalist": [["Mark", "Jonathan","Christopher"], ["mark@example.com", "jonathan@test.com", "christopher@google.com"]], "data":"", "responseStatus":"SUCCESS"}
/unprotect with presentation scheme
The input in the datalist
array is decrypted with the encryption scheme EMAIL2
and then obfuscated with the presentation scheme EMAIL2_P
.
This example uses the authentication token retrieved with /authenticate
.
--data-raw '{"datalist":[["8283a@QhbpH.yOs","5fGP@RyZBO.UZE"]], "schemelist":["EMAIL2"], "presentationSchemelist":["EMAIL2_P"] "user":"jimmybob@BigCo.com"}'
/unprotect with masking scheme
Masking schemes must not be used with /unprotect
, which returns an error because the masked data cannot be unmasked.
Audit details for PEG REST API accesses
Privacera records access to the PEG REST API encryption keys and schemes. For details, see Audit.