PII Mask Node

Quick Reference

• Field Path: Target Fields; repeatable input, with an accessible Field Path label.
• Email: Built-in Detectors.
• Phone Number: Built-in Detectors.
• SSN: Built-in Detectors.
• Credit Card: Built-in Detectors.
• IPv4 Address: Built-in Detectors.
• IPv6 Address: Built-in Detectors.
• Name: Custom Patterns; repeatable rows.
• Regex Pattern: Custom Patterns.
• Replacement Token: Custom Patterns.

Configuration

Configuration keys below are relative to the node configuration. Use the field name in the panel when following instructions in the builder; required markers such as an asterisk are not part of the name.

Field in the panel	Configuration key	Where to edit / when shown
Field Path	targets[]	Target Fields; repeatable input, with an accessible Field Path label
Email	detectors.email	Built-in Detectors
Phone Number	detectors.phone	Built-in Detectors
SSN	detectors.ssn	Built-in Detectors
Credit Card	detectors.creditCard	Built-in Detectors
IPv4 Address	detectors.ipv4	Built-in Detectors
IPv6 Address	detectors.ipv6	Built-in Detectors
Name	customPatterns[].name	Custom Patterns; repeatable rows — Identifier used in logs and error messages (e.g. api_key). Required: Yes.
Regex Pattern	customPatterns[].pattern	Custom Patterns — The regular expression to search for. Required: Yes.
Replacement Token	customPatterns[].replacement	Custom Patterns — The literal string used to replace each match (e.g. [API_KEY]). Required: Yes.

Built-in detector JSON

Each built-in detector entry is an object or null, not a boolean. In the builder, checking a detector stores { "replacement": null }; unchecking it stores null. Omitting the detector also disables it. There is no enabled property.

A null replacement uses the detector's default token:

Detector key	Default token
email	[EMAIL]
phone	[PHONE]
ssn	[SSN]
creditCard	[CC]
ipv4	[IPV4]
ipv6	[IPV6]

At least one built-in detector or custom pattern must be configured. This complete node configuration enables email and IPv4 masking with default tokens and leaves the other detectors disabled:

{
  "targets": ["$.actor_email", "$.src_ip"],
  "detectors": {
    "email": { "replacement": null },
    "ipv4": { "replacement": null },
    "phone": null
  },
  "customPatterns": []
}

When authoring JSON, set replacement to a string to use a custom token. The built-in-detector panel exposes checkboxes; it does not have a replacement input. The Replacement Token input above belongs to Custom Patterns. For example:

{
  "targets": ["$.actor_email"],
  "detectors": {
    "email": { "replacement": "[REDACTED_EMAIL]" }
  },
  "customPatterns": []
}

A wildcard target scans every string in a subtree. This configuration masks emails, phone numbers, SSNs and credit card numbers anywhere under the user object:

{
  "targets": ["$.user.*"],
  "detectors": {
    "email": { "replacement": null },
    "phone": { "replacement": null },
    "ssn": { "replacement": null },
    "creditCard": { "replacement": null }
  },
  "customPatterns": []
}

This configuration scans every string in the record for emails and for 32-character API keys, which a custom pattern replaces with [API_KEY]:

{
  "targets": ["$.*"],
  "detectors": {
    "email": { "replacement": null }
  },
  "customPatterns": [
    {
      "name": "api_key",
      "pattern": "[A-Za-z0-9]{32}",
      "replacement": "[API_KEY]"
    }
  ]
}

Overview

The PII Mask node detects and masks sensitive substrings inside the fields you select. Built-in detectors cover common PII categories (email, phone, SSN, credit card, IPv4, IPv6), and you can add custom regex patterns for anything else — for example, API keys or internal IDs. Only the matched substring is replaced; the rest of the field value is left intact.

Setting behavior

Behavior

For each record, the node walks every Field Path listed under Target Fields and rewrites matched substrings in place:

• Explicit path ($.field, $.parent.child): if the value is a string, all detectors and custom patterns run against it. If the value is an array, each string element is scanned individually. Non-string values and missing paths are skipped silently.
• Wildcard path ($.*, $.parent.*): the node navigates to the named prefix object, then recursively descends depth-first through all nested objects and arrays, scanning every string value it finds. Only the terminal .* is supported — wildcards in the middle of a path (e.g., $.*.field) are invalid.

Each named path segment must start with a letter or underscore, followed by letters, digits or underscores ([A-Za-z_][A-Za-z0-9_]*). Segments with other characters, such as hyphens or spaces, and bracket or array-index syntax are not valid target paths.

Every matched substring is replaced with the corresponding replacement token. The rest of the value is left intact.

• Credit card: a candidate number is masked only if it has 13 to 19 digits (spaces and hyphens ignored) and passes the Luhn checksum. Numbers that match the pattern but fail the checksum are left unchanged.
• IPv4 address: each of the four octets must be between 0 and 255. Values such as 999.1.1.1 are left unchanged.

Related Nodes

• Eval: Transform fields with FEEL expressions
• Enrichment: Add data from external lookup sources