APIgator Protect Endpoint

The api/protect endpoint is the core of APIgator's Data Privacy as a Service. it allows you to apply various Privacy Enhancing Techniques (PETs) to your data payloads dynamically.

Overview

This endpoint accepts JSON or XML data and applies privacy rules based on a predefined Manifest. A manifest defines which fields in your data should be protected and which technique should be applied.

Supported Data Types

• JSON: Standard JSON objects or arrays.
• XML: XML documents.
• SQL: SQL queries (various dialects supported).

Key Privacy Techniques

Beyond simple encryption, APIgator supports several sophisticated techniques:

• Anonymise: Irreversibly strip or modify data so individuals cannot be re-identified.
• Pseudonymise: Replace sensitive data with realistic but fake values (e.g., replacing a real name with a random name). This can be reversed using the Reconstruct job type if authorized.
• Restrict: Completely remove the field from the output payload.
• Mask: Replace parts of the data (e.g., showing only the last four digits of a credit card).
• Encrypt/Decrypt: Standard cryptographic protection.

Request Configuration

Essential Headers

Header	Description	Required
X-Resource-Token	Your authentication token.	Yes
X-Data-Set-Type	JSON, XML, or SQL. Defaults to JSON.	Yes
X-Body-Encoding	utf-8 or base64. Use base64 if your payload contains binary data or special characters that might be corrupted in transit.	No

Request Body Fields

The request body should be a JSON object containing:

Field	Description
manifestName	The name of the privacy manifest to apply.
jobType	The action to perform: Anonymise, Pseudonymise, Restrict, Mask, Encrypt, Decrypt, Reconstruct.
dataSet	The actual data payload to be protected.
countryCode	The destination country code (used for cross-border data logic).
dataOwningCountryCode	The country where the data originated.

Practical Example: Pseudonymising Employee Data

If you want to share employee data with a third party but need to hide their real names:

Request:

POST /api/protect
X-Resource-Token: <your_token>
X-Data-Set-Type: JSON

{
  "manifestName": "Employee_Privacy_Policy",
  "jobType": "Pseudonymise",
  "countryCode": "US",
  "dataOwningCountryCode": "GB",
  "dataSet": {
    "employees": [
      { "id": "101", "name": "John Doe", "email": "john.doe@company.com" }
    ]
  }
}

Response: The dataSet in the response will contain the protected data:

{
  "dataSet": {
    "employees": [
      { "id": "101", "name": "Fake Name", "email": "protected@example.com" }
    ]
  },
  ...
}

Best Practices

1. Use Base64 for Complex Data: If your dataSet contains complex XML or nested structures, consider encoding the dataSet string as base64 and setting the X-Body-Encoding: base64 header to avoid JSON parsing issues.
2. Job Type Alignment: Ensure the jobType matches the intent of your manifest. For example, if your manifest only defines masking rules, using Decrypt will not have the desired effect.