Built-in transformations

Discover a list of the built-in transformations

Mask transformations

Vault provide these built-in mask transformations:

Data type	Transformation name	Transformed example	Details
EMAIL	mask	j**********@gmail.com
EMAIL_STRICT	mask	j**********@gmail.com
SSN	mask	***-**-4357
BAN	mask	*******7917
PHONE_NUMBER	mask	***-****-2795
ZIP_CODE_US	mask	123**"	3-digit zip codes transform to 000
TIMESTAMP	mask	2024-11-08T15:**:**Z	The hour is masked
DATE	mask	2024-**-**	The month and day are masked
DATE_OF_BIRTH	mask	2024-**-**	The month and day are masked
NAME	mask	J*** D**
GENDER	mask	**********	Same for all values
ADDRESS	mask	*** **** *** *** ***** ** ***...
CC_NUMBER	mask	************9573
CC_HOLDER_NAME	mask	J*** D**	Same as NAME
CC_EXPIRATION_STRING	mask	**/****
CC_CVV	mask	***	Same for 3- and 4-digit values
US_BANK_ROUTING	mask	******789
US_BANK_ACCOUNT_NUMBER	mask	*****6789
INTEGER	mask	*****	Each digit transform to *
DOUBLE	mask	-***.**	Each digit transform to *
BOOLEAN	mask	*	Same for true and false
STRING	mask	**** ***
LONG_TEXT	mask	***** ***** ***** *** ***** *...	Same as STRING
JSON	mask	{"first_name":"****","last_name":"***"}
URL	mask	https://****domain.com********
BLOB	mask	<BLOB>	Same for all values
TENANT_ID	mask	*****************************...	Same as STRING

More transformations

Vault provide these built-in transformations:

Data type	Transformation name	Transformed example
BLOB	size	1024
DATE_OF_BIRTH	age	35
DATE_OF_BIRTH	age_frac	35.8

Token transformations

Vault provides a token transformation for all built-in data types. This transformation retrieves the pci token for the property, if one exists for the default scope.

You create a token for SSN using the CLI like this:

pvault token create --props ssn --type pci --collection customers --object-id 05161167-344d-4229-b3f8-5d44daf6780f

And get a response similar to this:

+--------------------------------------+
|               token_id               |
+--------------------------------------+
| c37e7da2-1f87-4693-8002-e50bcc5fd9ef |
+--------------------------------------+

You can then access the token of SSN using the token transformation like this:

pvault object get --id 05161167-344d-4229-b3f8-5d44daf6780f --collection customers --props id,ssn.token

And get a response similar to this:

Displaying 1 result.
+--------------------------------------+--------------------------------------+
|                  id                  |              ssn.token               |
+--------------------------------------+--------------------------------------+
| c5f7f35e-b3a0-4857-8a8f-a5c83e87d488 | c37e7da2-1f87-4693-8002-e50bcc5fd9ef |
+--------------------------------------+--------------------------------------+

See Tokenize personal data for more information about tokenization.