Enforcing PII constraints (Beta)
To help you secure personally identifiable information (PII) in your traffic, our network inspects your API request and response payloads for values that look like PII. The network needs to know how deeply to look in your API data as well as how to respond to any PII it finds.
When PII constraint enforcement is enabled, the network doesn't trip the firewall action for any parameters containing PII that you defined as part of your API definition. If you decline the recommendation, the next time PII is found in that parameter, the firewall will trip.
What if there is a false positive?
You can exclude parameters you don't want the network to inspect for PII. You may choose to exclude parameters that contain a string of numbers that look like a credit card number but aren't actually a credit card number.
The following settings let you tell the network where in your API to look for unexpected PII.
|Enforcement options||Definition||What happens?|
|None||Do not enforce any constraints.||Lets all traffic through as if this feature is not in use.|
|API level||Inspect and enforce constraints for every resource and method in an API.||The action you set in your security policy applies.|
|Resource and method level||Inspect only specific resources per method in an API.||If triggered, the action you set in your security policy applies.|
|Request and response||Inspect both request and response parameters for PII.|
|Request only||Inspect only parameters in request payloads for PII.|
|Response only||Inspect only parameters in response payloads for PII.|
|All||Look in API payloads for all supported PII types.|
|Specific||Designate which PII types to look for specifically.||Currently only email and credit card numbers are supported.|
|Action when detected||This is the action you set in your security policy. For example, Alert or Deny.|
Updated 10 months ago