Configure transformations

Every transformation configuration requires a default strategy.

{
  "default": { "strategy": "redact" }
}

scan_and_transform wraps this configuration under transform and keeps detection settings under scan:

{
  "scan": { "locale": "en-US" },
  "transform": {
    "default": { "strategy": "redact" }
  }
}

Select entity types

Omitting entities selects all supplied findings. A non-empty list selects only exact, case-sensitive entity names.

{
  "default": { "strategy": "redact" },
  "entities": ["EMAIL", "PHONE"]
}

An empty entities list is invalid.

Override a strategy

Overrides are exact and case-sensitive. Findings without an override use the default strategy.

{
  "default": { "strategy": "redact" },
  "overrides": {
    "PHONE": {
      "strategy": "mask",
      "reveal": { "direction": "last", "count": 4 }
    }
  }
}

Exempt exact values

Exact allowlists are scoped to an entity type and compare exact Unicode values without normalization.

{
  "default": { "strategy": "redact" },
  "allow": {
    "exact": {
      "EMAIL": ["support@example.com"]
    }
  }
}

Exempt values with regular expressions

Regex allowlist patterns must match the full finding value. Matching is case-sensitive by default.

{
  "default": { "strategy": "redact" },
  "allow": {
    "regex": {
      "EMAIL": [
        { "pattern": ".+@example\\.org" },
        { "pattern": ".+@example\\.com", "case_sensitive": false }
      ]
    }
  }
}

Evaluation order

DataFog Core processes a request in this order:

Validate the complete configuration.
Select entity types.
Apply exact and regex allowlists.
Resolve duplicates and overlaps.
Choose the per-entity override or default strategy.
Transform selected findings in document order.

Valid configuration for an unselected entity remains dormant. Invalid fields are rejected even when their entity is not selected.

Strict input

Unknown fields and explicit null values are rejected. Empty structural maps are treated as omission, but empty semantic values such as an empty entity selection, key reference, or token reference are invalid.

German scan locale

scan(text, {"locale":"de"}) activates all seven German entity types. de, de-DE, and de_DE are recognized after trimming and ASCII case-insensitive comparison. The stored locale is preserved. Recognized en-US and fr aliases run the base detectors; omitted locale does not activate German detectors. In Core 0.4.0, unsupported explicit locales are configuration errors, as are empty, whitespace-only, non-string values and unknown configuration fields. Query the runtime capabilities for the recognized aliases. Structured scans use the same locale routing within each string value. For German-only transformations, specify both routing and selection:

{
  "scan": { "locale": "de" },
  "transform": {
    "default": { "strategy": "redact" },
    "entities": ["DE_IBAN"]
  }
}

Transformation selection never activates detection. Explicit German findings passed to transform require no locale. All seven labels support existing strategies, overrides and exact/full-match regex allowlists; exact allowlists compare original casing and separators. Provider-backed strategies remain unavailable in WASM. Scans retain generic overlaps, while transformations use existing containment/length and lexical tie-breaking rules.

UUID detection

Use {"detect_uuid":true} in a text or structured scan configuration to enable canonical UUID detection. The default is false; locale does not change it. The option accepts only booleans, including an explicit false. For scan-and-transform, place it under scan and use transform.entities to select UUID replacements. Selection alone never enables scanning.

Get started

Core concepts

Guides

Reference

Project

Configure transformations

Select entity types

Override a strategy

Exempt exact values

Exempt values with regular expressions

Evaluation order

Strict input

German scan locale

UUID detection

​Select entity types

​Override a strategy

​Exempt exact values

​Exempt values with regular expressions

​Evaluation order

​Strict input

​German scan locale

​UUID detection

Select entity types

Override a strategy

Exempt exact values

Exempt values with regular expressions

Evaluation order

Strict input

German scan locale

UUID detection