Privacy Management

It keeps records of message traffic (request and response) flowing through Apinizer.

Any part of the messages (header, parameter, body) may contain sensitive or personal data such as credit card information, password, phone number.

In cases where it is not desired to openly access these data in the log records, the following operations can be applied to the sensitive/confidential fields in the log records with the Apinizer "Privacy Management" settings, preventing the data from being displayed as it is:

• Masking: A mask with * is applied to the value of the field.
• Delete: The value of the field is deleted while logging.
• Encryption: The value of the field is encrypted with the pure code generated on the basis of the application.
• Hashing: The value of the field is hashed and logged.

Sensitive Data Management is only about storing the data in the log records kept on Apinizer. It is not related in any way to data going to the Backend API or data returning to the Client! You can use policies to act on this data.

Users in the System Admin or Security Manager role can perform Privacy Management operations.

These settings are not managed on a Project basis, they are defined and managed for all API Proxies under the management menu.

Implementation of Privacy Management

At the time of creation of the log record, element names defined as general and API Proxy-specific and "header, parameter and body" fields of request and response messages are scanned. For the element names found, the operation (masking, deletion, encryption, hashing) defined specifically for the element name is applied.

To search for the element name on the request or response body, the body value must be XML, JSON or Form data (form-data, x-www-form-urlencoded).

If the data is XML or JSON (recursive), the value of "sensitive data element name" is searched in all element names, if it is form data, in all keywords. The suffix "-PA" is added to the end of the relevant element/key name on the data to indicate that the operation is also performed. PA: stands for Privacy Applied.

In order to apply "Privacy Management" per a defined area, all the following areas are scanned:

• Header, Query Parameter and Body of the Message From the Client
• Header, Query Parameter and Body of Message Outgoing to Backend
• Header and Body of Message Returned from Backend
• Header and Body of the Message Returned to the Client

As can be seen from the scanned areas, Privacy Management is a costly process in terms of performance.

Since logging operations are performed asynchronously, although it does not have an effect on API Traffic, if it will be used intensively, system configuration should be done considering its effect on processor power.

Privacy Management Screen

To enable "Privacy Management", the Enabled option must be enabled.

The picture below shows the screen that appears when Privacy Management is activated:

What is the Salt?

One of the Sensitive Data Management processes is hashing.

When the hashing method is selected, it is ensured that the data is hashed with an algorithm in a way that is not reversible. The hashed data is one-way and cannot be retrieved. Only hash data can be reproduced.

By choosing the hash algorithm with Salt, the output that would normally be formed is created differently, thus preventing the hash value from being found by comparison.

When Sensitive Data Management is first activated, Apinizer creates a pure value and hash the data with it.

Normally, it seems more correct to hash each value with different salts, but in some cases, it may be necessary to find the data by searching or to know that the value of the data is correct, so this salt is kept secretly without being changed by Apinizer. The user is allowed to create the same hash data on the screen by entering a value.

Definitions tab

In the Definitions tab, the "element name" and what to do with that description ("operation" information) binaries are defined. It is added to the definition list with the Add button.

An element name and related operation defined in the Definitions tab applies to all API Proxies.

When a definition is created it is automatically added to all API Proxies. When a definition is deleted, this setting is removed from all API Proxies.

If an API Proxy is not available, all "global definitions" are applied to incoming requests.

API Proxy Settings Tab

On the API Proxy Settings tab, there are definitions and settings made when API Proxy-based customization (making API Proxy specific definition, disabling the general definition, ensuring the operation of the log on a region-based basis, etc.) is required.

In the API Proxy Settings tab, operations are performed in two different contexts.

1. Applying settings in general
2. Managing selected API Proxy definitions

Applying settings in general

All API Proxies are managed whether sensitive data management is implemented. Privacy management can be disabled for the desired API Proxies.

The picture below shows the list of all API Proxies:

The buttons and links in the API Proxy Settings tab are shown in the table below.

Managing selected API Proxy definitions

By going to the advanced settings of the relevant API Proxy, it is possible to choose whether or not the definition will be applied to which part of the message and which field.

The picture below shows the Advanced Settings dialog:

Buttons and links used for Advanced Settings configuration are shown in the table below.

Tanım Ekleme ve Düzenleme

This action edits the detail of the selected sensitive data management definition in API Proxy. A setting is made whether or not the definition will be applied to which message zones and which message items.

The picture below shows the Create/Edit Privacy Definition dialog:

The buttons and links used in the Create/Edit Privacy Management Definition dialog are shown in the table below.