Anonymize sensitive data in responses
Configure the AI Sanitizer policy to use your sanitizer service to anonymize all sensitive data and credentials in LLM responses before they reach the client.
Prerequisites
- An existing AI Model.
ai_gateway_policies:
- ref: anonymize-response-data
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: anonymize-response-data
display_name: Anonymize sensitive data in responses
type: ai-sanitizer
enabled: true
config:
anonymize:
- all_and_credentials
sanitization_mode: OUTPUT
port: 8080
host: example.service.com
redact_type: placeholder
recover_redacted: false
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "anonymize-response-data",
"display_name": "Anonymize sensitive data in responses",
"type": "ai-sanitizer",
"enabled": true,
"config": {
"anonymize": [
"all_and_credentials"
],
"sanitization_mode": "OUTPUT",
"port": 8080,
"host": "example.service.com",
"redact_type": "placeholder",
"recover_redacted": false
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "anonymize-response-data"
display_name = "Anonymize sensitive data in responses"
type = "ai-sanitizer"
enabled = true
global = false
config = jsonencode({
anonymize = ["all_and_credentials"]
sanitization_mode = "OUTPUT"
port = 8080
host = "example.service.com"
redact_type = "placeholder"
recover_redacted = false
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}ai_gateway_policies:
- ref: anonymize-response-data
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: anonymize-response-data
display_name: Anonymize sensitive data in responses
type: ai-sanitizer
enabled: true
config:
anonymize:
- all_and_credentials
sanitization_mode: OUTPUT
port: 8080
host: example.service.com
redact_type: placeholder
recover_redacted: false
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "anonymize-response-data",
"display_name": "Anonymize sensitive data in responses",
"type": "ai-sanitizer",
"enabled": true,
"config": {
"anonymize": [
"all_and_credentials"
],
"sanitization_mode": "OUTPUT",
"port": 8080,
"host": "example.service.com",
"redact_type": "placeholder",
"recover_redacted": false
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "anonymize-response-data"
display_name = "Anonymize sensitive data in responses"
type = "ai-sanitizer"
enabled = true
global = false
config = jsonencode({
anonymize = ["all_and_credentials"]
sanitization_mode = "OUTPUT"
port = 8080
host = "example.service.com"
redact_type = "placeholder"
recover_redacted = false
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}ai_gateway_policies:
- ref: anonymize-response-data
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: anonymize-response-data
display_name: Anonymize sensitive data in responses
type: ai-sanitizer
enabled: true
config:
anonymize:
- all_and_credentials
sanitization_mode: OUTPUT
port: 8080
host: example.service.com
redact_type: placeholder
recover_redacted: false
global: falseMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "anonymize-response-data",
"display_name": "Anonymize sensitive data in responses",
"type": "ai-sanitizer",
"enabled": true,
"config": {
"anonymize": [
"all_and_credentials"
],
"sanitization_mode": "OUTPUT",
"port": 8080,
"host": "example.service.com",
"redact_type": "placeholder",
"recover_redacted": false
},
"global": false
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "anonymize-response-data"
display_name = "Anonymize sensitive data in responses"
type = "ai-sanitizer"
enabled = true
global = false
config = jsonencode({
anonymize = ["all_and_credentials"]
sanitization_mode = "OUTPUT"
port = 8080
host = "example.service.com"
redact_type = "placeholder"
recover_redacted = false
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}ai_gateway_policies:
- ref: anonymize-response-data
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
name: anonymize-response-data
display_name: Anonymize sensitive data in responses
type: ai-sanitizer
enabled: true
config:
anonymize:
- all_and_credentials
sanitization_mode: OUTPUT
port: 8080
host: example.service.com
redact_type: placeholder
recover_redacted: false
global: trueMake sure to replace the following placeholders with your own values:
AI_GATEWAY_ID: Theidof your AI Gateway.
curl -X POST https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/policies \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "anonymize-response-data",
"display_name": "Anonymize sensitive data in responses",
"type": "ai-sanitizer",
"enabled": true,
"config": {
"anonymize": [
"all_and_credentials"
],
"sanitization_mode": "OUTPUT",
"port": 8080,
"host": "example.service.com",
"redact_type": "placeholder",
"recover_redacted": false
},
"global": true
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
AIGatewayId: Theidof the AI Gateway.
See the Konnect AI Gateway API reference to learn about region-specific URLs and personal access tokens.
Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration:
resource "konnect_ai_gateway_policy" "my_policy" {
name = "anonymize-response-data"
display_name = "Anonymize sensitive data in responses"
type = "ai-sanitizer"
enabled = true
global = true
config = jsonencode({
anonymize = ["all_and_credentials"]
sanitization_mode = "OUTPUT"
port = 8080
host = "example.service.com"
redact_type = "placeholder"
recover_redacted = false
})
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}After creating the policy, add anonymize-response-data to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
ai_gateway_models:
- ref: my-gpt-4o
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: my-gpt-4o
name: my-gpt-4o
type: model
capabilities:
- generate
formats:
- type: openai
targets:
- name: gpt-4o
provider: my-openai-account
config:
type: openai
config:
route:
paths:
- "/v1"
model:
body_param: model
values:
- my-gpt-4o
logging:
payloads: false
policies:
- !ref anonymize-response-data#nameAfter creating the policy, add anonymize-response-data to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/models/my-gpt-4o \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "my-gpt-4o",
"name": "my-gpt-4o",
"type": "model",
"capabilities": [
"generate"
],
"formats": [
{
"type": "openai"
}
],
"policies": [
"anonymize-response-data"
],
"targets": [
{
"name": "gpt-4o",
"provider": "my-openai-account",
"config": {
"type": "openai"
}
}
],
"config": {
"route": {
"paths": [
"/v1"
],
"model": {
"body_param": "model",
"values": [
"my-gpt-4o"
]
}
},
"logging": {
"payloads": false
}
}
}
'After creating the policy, add anonymize-response-data to the policies array of your AI Model. The tool examples update an existing AI Model with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Model.
resource "konnect_ai_gateway_model" "my_model" {
display_name = "my-gpt-4o"
name = "my-gpt-4o"
type = "model"
capabilities = ["generate"]
formats = [
{
type = "openai"
} ]
targets = [
{
name = "gpt-4o"
provider = "my-openai-account"
config = {
type = "openai"
}
} ]
config = jsonencode({
route = {
paths = ["/v1"]
model = {
body_param = "model"
values = ["my-gpt-4o"]
}
}
logging = {
payloads = false
}
})
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}After creating the policy, add anonymize-response-data to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
ai_gateway_consumers:
- ref: mobile-app-production
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Mobile App - Production
name: mobile-app-production
type: api-key
policies:
- !ref anonymize-response-data#nameAfter creating the policy, add anonymize-response-data to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumers/mobile-app-production \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Mobile App - Production",
"name": "mobile-app-production",
"type": "api-key",
"policies": [
"anonymize-response-data"
]
}
'After creating the policy, add anonymize-response-data to the policies array of your AI Consumer. The tool examples update an existing AI Consumer with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer.
resource "konnect_ai_gateway_consumer" "my_consumer" {
display_name = "Mobile App - Production"
name = "mobile-app-production"
type = "api-key"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}After creating the policy, add anonymize-response-data to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
ai_gateway_consumer_groups:
- ref: internal-teams
ai_gateway: !lookup {id: !env AI_GATEWAY_ID}
display_name: Internal Teams
name: internal-teams
policies:
- !ref anonymize-response-data#nameAfter creating the policy, add anonymize-response-data to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
curl -X PUT https://{region}.api.konghq.com/v1/ai-gateways/{AIGatewayId}/consumer-groups/internal-teams \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"display_name": "Internal Teams",
"name": "internal-teams",
"policies": [
"anonymize-response-data"
]
}
'After creating the policy, add anonymize-response-data to the policies array of your AI Consumer Group. The tool examples update an existing AI Consumer Group with the policy attached: replace the entity configuration in the example with your own, as the update replaces the entire AI Consumer Group.
resource "konnect_ai_gateway_consumer_group" "my_consumer_group" {
display_name = "Internal Teams"
name = "internal-teams"
policies = [konnect_ai_gateway_policy.my_policy.name]
gateway_id = konnect_ai_gateway.my_ai_gateway.id
}