# Configure Data Masking The [`data-mask`](https://docs.api7.ai/hub/data-mask.md) plugin sanitizes request data that is recorded in access logs and logger plugin output. It lets you strip or redact sensitive values from query parameters, request headers, and request bodies so that personally identifiable information (PII), credentials, and other regulated data do not land in your log pipelines. Use this guide for common masking workflows. For the full plugin field reference, supported combinations, and additional examples, see [`data-mask`](https://docs.api7.ai/hub/data-mask.md). note `data-mask` runs in the gateway log phase. It changes what loggers and access logs see, but it does not change what the upstream service receives or what the client gets back. ## Prerequisites[​](#prerequisites "Direct link to Prerequisites") * An API7 Enterprise instance is running. * A Gateway Group is created and a Gateway instance is running. * A [token from the Dashboard](https://docs.api7.ai/api7-gateway/reference/obtain-dashboard-token.md). ## Configure Data Masking[​](#configure-data-masking "Direct link to Configure Data Masking") The following example masks sensitive fields in a URL-encoded request body and writes the masked request body to a local log file with `file-logger`. ### Step 1: Create a Service with an Upstream[​](#step-1-create-a-service-with-an-upstream "Direct link to Step 1: Create a Service with an Upstream") * Admin API * ADC ``` curl -k "https://localhost:7443/apisix/admin/services/data-mask-httpbin-service?gateway_group_id={gateway_group_id}" -X PUT \ -H "X-API-KEY: ${API_KEY}" \ -H "Content-Type: application/json" \ -d '{ "name": "data-mask-httpbin-service", "upstream": { "type": "roundrobin", "scheme": "http", "nodes": [ { "host": "httpbin.org", "port": 80, "weight": 100 } ] } }' ``` adc.yaml ``` services: - name: data-mask-httpbin-service upstream: name: default scheme: http nodes: - host: httpbin.org port: 80 weight: 100 routes: - name: data-mask-route uris: - /anything/data-mask methods: - POST plugins: data-mask: request: - action: remove body_format: urlencoded name: password type: body - action: replace body_format: urlencoded name: token type: body value: "*****" - action: regex body_format: urlencoded name: card regex: "(\\d+)\\-\\d+\\-\\d+\\-(\\d+)" type: body value: "$1-****-****-$2" file-logger: include_req_body: true path: /tmp/mask-urlencoded-body.log labels: docs-example: data-mask-httpbin-service ``` Preview the changes owned by this example and confirm that the diff contains no unintended updates or deletions: ``` adc diff -f adc.yaml \ --include-resource-type service \ --label-selector docs-example=data-mask-httpbin-service ``` Synchronize the reviewed configuration: ``` adc sync -f adc.yaml \ --include-resource-type service \ --label-selector docs-example=data-mask-httpbin-service ``` ### Step 2: Create a Route and Enable `data-mask`[​](#step-2-create-a-route-and-enable-data-mask "Direct link to step-2-create-a-route-and-enable-data-mask") Create a route that enables both `data-mask` and `file-logger`. * Admin API * ADC ``` curl -k "https://localhost:7443/apisix/admin/routes/data-mask-route?gateway_group_id={gateway_group_id}" -X PUT \ -H "X-API-KEY: ${API_KEY}" \ -H "Content-Type: application/json" \ -d '{ "name": "data-mask-route", "paths": ["/anything/data-mask"], "methods": ["POST"], "service_id": "data-mask-httpbin-service", "plugins": { "data-mask": { "request": [ { "type": "body", "body_format": "urlencoded", "name": "password", "action": "remove" }, { "type": "body", "body_format": "urlencoded", "name": "token", "action": "replace", "value": "*****" }, { "type": "body", "body_format": "urlencoded", "name": "card", "action": "regex", "regex": "(\\d+)\\-\\d+\\-\\d+\\-(\\d+)", "value": "$1-****-****-$2" } ] }, "file-logger": { "include_req_body": true, "path": "/tmp/mask-urlencoded-body.log" } } }' ``` The route is already included in the previous `adc.yaml` example. ## Validate the Configuration[​](#validate-the-configuration "Direct link to Validate the Configuration") Send a request to the route: ``` curl -i "http://127.0.0.1:9080/anything/data-mask" \ --data-urlencode "password=abc" \ --data-urlencode "token=xyz" \ --data-urlencode "card=1234-1234-1234-1234" ``` You should receive `200 OK`. The upstream still receives the original values. Then inspect the gateway log file. If you are running the gateway in Docker, first find the container name: ``` docker ps --format '{{.Names}}' ``` Then read the log file from the gateway container: ``` docker exec sh -lc 'cat /tmp/mask-urlencoded-body.log' ``` You should see a masked log entry similar to the following: ``` { "request": { "uri": "/anything/data-mask", "body": "token=*****&card=1234-****-****-1234", "method": "POST", "url": "http://127.0.0.1:9080/anything/data-mask" } } ``` The `password` field is removed, `token` is replaced, and the middle digits of `card` are masked in the log output. If the route returns `404` immediately after you apply the configuration, wait a few seconds for the latest configuration to reach the gateway and retry. ## Next Steps[​](#next-steps "Direct link to Next Steps") * [Configure Logging](https://docs.api7.ai/api7-gateway/observability/logging.md) - attach other logger plugins to capture masked request data. * [Rate Limiting](https://docs.api7.ai/api7-gateway/how-to-guides/traffic-management/rate-limiting.md) - protect APIs from abuse. * [Secure Credentials](https://docs.api7.ai/api7-gateway/security-and-compliance/secure-credentials.md) - protect sensitive configuration data.