It keeps records of message traffic (request and response) flowing through Apinizer.
Any part of the messages (header, parameter, body) may contain sensitive or personal data such as credit card information, password, phone number.
In cases where it is not desired to openly access these data in the log records, the following operations can be applied to the sensitive/confidential fields in the log records with the Apinizer "Privacy Management" settings, preventing the data from being displayed as it is:
- Masking: A mask with * is applied to the value of the field.
- Delete: The value of the field is deleted while logging.
- Encryption: The value of the field is encrypted with the pure code generated on the basis of the application.
- Hashing: The value of the field is hashed and logged.
Sensitive Data Management is only about storing the data in the log records kept on Apinizer. It is not related in any way to data going to the Backend API or data returning to the Client! You can use policies to act on this data.
Users in the System Admin or Security Manager role can perform Privacy Management operations.
These settings are not managed on a Project basis, they are defined and managed for all API Proxies under the management menu.
Implementation of Privacy Management
At the time of creation of the log record, element names defined as general and API Proxy-specific and "header, parameter and body" fields of request and response messages are scanned. For the element names found, the operation (masking, deletion, encryption, hashing) defined specifically for the element name is applied.
To search for the element name on the request or response body, the body value must be XML, JSON or Form data (form-data, x-www-form-urlencoded).
If the data is XML or JSON (recursive), the value of "sensitive data element name" is searched in all element names, if it is form data, in all keywords. The suffix "-PA" is added to the end of the relevant element/key name on the data to indicate that the operation is also performed. PA: stands for Privacy Applied.
In order to apply "Privacy Management" per a defined area, all the following areas are scanned:
- Header, Query Parameter and Body of the Message From the Client
- Header, Query Parameter and Body of Message Outgoing to Backend
- Header and Body of Message Returned from Backend
- Header and Body of the Message Returned to the Client
As can be seen from the scanned areas, Privacy Management is a costly process in terms of performance.
Since logging operations are performed asynchronously, although it does not have an effect on API Traffic, if it will be used intensively, system configuration should be done considering its effect on processor power.
Privacy Management Screen
To enable "Privacy Management", the Enabled option must be enabled.
The picture below shows the screen that appears when Privacy Management is activated:
What is the Salt?
One of the Sensitive Data Management processes is hashing.
When the hashing method is selected, it is ensured that the data is hashed with an algorithm in a way that is not reversible. The hashed data is one-way and cannot be retrieved. Only hash data can be reproduced.
By choosing the hash algorithm with Salt, the output that would normally be formed is created differently, thus preventing the hash value from being found by comparison.
When Sensitive Data Management is first activated, Apinizer creates a pure value and hash the data with it.
Normally, it seems more correct to hash each value with different salts, but in some cases, it may be necessary to find the data by searching or to know that the value of the data is correct, so this salt is kept secretly without being changed by Apinizer. The user is allowed to create the same hash data on the screen by entering a value.
In the Definitions tab, the "element name" and what to do with that description ("operation" information) binaries are defined. It is added to the definition list with the Add button.
An element name and related operation defined in the Definitions tab applies to all API Proxies.
When a definition is created it is automatically added to all API Proxies. When a definition is deleted, this setting is removed from all API Proxies.
If an API Proxy is not available, all "global definitions" are applied to incoming requests.
API Proxy Settings Tab
On the API Proxy Settings tab, there are definitions and settings made when API Proxy-based customization (making API Proxy specific definition, disabling the general definition, ensuring the operation of the log on a region-based basis, etc.) is required.
In the API Proxy Settings tab, operations are performed in two different contexts.
- Applying settings in general
- Managing selected API Proxy definitions
Applying settings in general
All API Proxies are managed whether sensitive data management is implemented. Privacy management can be disabled for the desired API Proxies.
The picture below shows the list of all API Proxies:
The buttons and links in the API Proxy Settings tab are shown in the table below.
Enable All & Deploy
|Enables sensitive data management of all API Proxies. If filtering is applied, the API Proxies that come as a result of the filter are processed.|
Disable All & Deploy
|It disables sensitive data management of all API Proxies. If filtering is applied, the API Proxies that come as a result of the filter are processed.|
|It can be decided whether to apply sensitive data management for the relevant API Proxy.|
|Opens the screen where detailed sensitive data management is performed on API Proxy.|
Managing selected API Proxy definitions
By going to the advanced settings of the relevant API Proxy, it is possible to choose whether or not the definition will be applied to which part of the message and which field.
The picture below shows the Advanced Settings dialog:
Buttons and links used for Advanced Settings configuration are shown in the table below.
Enable All & Deploy
|Enables all sensitive data management definitions in API Proxy.|
Disable All & Deploy
|Disables all sensitive data management definitions in API Proxy.|
|Add||It allows to create a new definition of sensitive data management which is only in this API Proxy.|
|Detail||Allows you to edit the corresponding definition.|
Tanım Ekleme ve Düzenleme
This action edits the detail of the selected sensitive data management definition in API Proxy. A setting is made whether or not the definition will be applied to which message zones and which message items.
The picture below shows the Create/Edit Privacy Definition dialog:
The buttons and links used in the Create/Edit Privacy Management Definition dialog are shown in the table below.
|Tells whether the corresponding definition should be applied to the API Proxy.|
|If a new definition is to be created, the field name is entered, if the definition is edited, the element name is displayed.|
|The action to be applied to the element is selected.|
|It is decided whether the definition will be applied in the 4 regions where the message is located and the message elements (header, parameter, body) in the region.|