FieldMaskingRules
Which fields are hidden from which roles, and how they are obscured.
Preview a masking strategy
Shows what a value would look like once masked, so you can choose a strategy by seeing its output rather than by its name. Nothing is stored. Requires `field-masking-rule.read`.
Create a field masking rule
Hides a sensitive value from the roles that must not see it. Masking is applied when the response is generated rather than per endpoint, so one rule covers every surface the value can reach — the record view, search results, match comparison and audit entries alike. Requires `field-masking-rule.create`.
List field masking rules
Returns the masking rules in force, with the field each hides and the roles it hides it from. Requires `field-masking-rule.read`.
Get a field masking rule
Returns one masking rule. Requires `field-masking-rule.read`.
Update a field masking rule
Changes which roles are exempt or how the value is masked. Takes effect on the next response. Requires `field-masking-rule.update`.
Delete a field masking rule
Soft-deletes the rule, so the value stops being masked. Requires `field-masking-rule.delete`.
Restore a deleted masking rule
Reinstates a soft-deleted masking rule. Requires `field-masking-rule.restore`.