De-identify and re-identifyv3.15+
Enable the Skyflow De-identify plugin with re-identification turned on.
In this configuration, Kong Gateway tokenizes outbound request bodies before proxying them upstream, and restores original values in the response before returning it to the caller. The upstream provider only ever sees tokens; the caller sees real values.
The sts credential method requires no stored Skyflow secret.
Kong Gateway exchanges each caller’s own identity provider (IdP) token for a short-lived Skyflow bearer
token using RFC 8693 token exchange.
The max_spans limit sets a fail-closed ceiling on how many text spans a single
request may carry. Agent traffic may need a higher value because a short message can
arrive alongside many resent tool definitions.
Prerequisites
-
The Skyflow De-identify plugin is installed.
-
You have a Skyflow account with a Detect vault. From the vault’s page in the Skyflow admin console, copy the Vault ID and Vault URL.
-
The credential’s Skyflow role permits both the de-identify and re-identify operations.
Environment variables
-
SKYFLOW_VAULT_ID: The ID of your Skyflow Detect vault. -
SKYFLOW_VAULT_URL: The full URL of your Skyflow vault. For example:https://{cluster}.vault.skyflowapis.com. Sandbox vaults use.skyflowapis.tech. -
SKYFLOW_SERVICE_ACCOUNT_ID: Your Skyflow service account ID, used for STS token exchange.
Add this section to your kong.yaml configuration file:
_format_version: "3.0"
plugins:
- name: skyflow-ai-data-control
config:
skyflow:
vault_configuration:
vault_id: ${{ env "DECK_SKYFLOW_VAULT_ID" }}
vault_url: ${{ env "DECK_SKYFLOW_VAULT_URL" }}
credentials:
method: sts
sts:
service_account_id: ${{ env "DECK_SKYFLOW_SERVICE_ACCOUNT_ID" }}
deidentify:
entities:
- NAME
- EMAIL_ADDRESS
- PHONE_NUMBER
- SSN
- CREDIT_CARD
token_format: VAULT_TOKEN
operations:
limits:
max_spans: 512Make the following request:
curl -i -X POST http://localhost:8001/plugins/ \
--header "Accept: application/json" \
--header "Content-Type: application/json" \
--data '
{
"name": "skyflow-ai-data-control",
"config": {
"skyflow": {
"vault_configuration": {
"vault_id": "'$SKYFLOW_VAULT_ID'",
"vault_url": "'$SKYFLOW_VAULT_URL'"
},
"credentials": {
"method": "sts",
"sts": {
"service_account_id": "'$SKYFLOW_SERVICE_ACCOUNT_ID'"
}
},
"deidentify": {
"entities": [
"NAME",
"EMAIL_ADDRESS",
"PHONE_NUMBER",
"SSN",
"CREDIT_CARD"
],
"token_format": "VAULT_TOKEN"
}
},
"operations": {
"limits": {
"max_spans": 512
}
}
}
}
'Make the following request:
curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/plugins/ \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "skyflow-ai-data-control",
"config": {
"skyflow": {
"vault_configuration": {
"vault_id": "'$SKYFLOW_VAULT_ID'",
"vault_url": "'$SKYFLOW_VAULT_URL'"
},
"credentials": {
"method": "sts",
"sts": {
"service_account_id": "'$SKYFLOW_SERVICE_ACCOUNT_ID'"
}
},
"deidentify": {
"entities": [
"NAME",
"EMAIL_ADDRESS",
"PHONE_NUMBER",
"SSN",
"CREDIT_CARD"
],
"token_format": "VAULT_TOKEN"
}
},
"operations": {
"limits": {
"max_spans": 512
}
}
}
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
controlPlaneId: Theidof the control plane.
See the Konnect API reference to learn about region-specific URLs and personal access tokens.
echo "
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
name: skyflow-ai-data-control
namespace: kong
annotations:
kubernetes.io/ingress.class: kong
labels:
global: 'true'
config:
skyflow:
vault_configuration:
vault_id: '$SKYFLOW_VAULT_ID'
vault_url: '$SKYFLOW_VAULT_URL'
credentials:
method: sts
sts:
service_account_id: '$SKYFLOW_SERVICE_ACCOUNT_ID'
deidentify:
entities:
- NAME
- EMAIL_ADDRESS
- PHONE_NUMBER
- SSN
- CREDIT_CARD
token_format: VAULT_TOKEN
operations:
limits:
max_spans: 512
plugin: skyflow-ai-data-control
" | kubectl apply -f -Prerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration to create a Konnect Gateway Plugin:
resource "konnect_gateway_plugin_skyflow_ai_data_control" "my_skyflow_ai_data_control" {
enabled = true
config = {
skyflow = {
vault_configuration = {
vault_id = var.skyflow_vault_id
vault_url = var.skyflow_vault_url
}
credentials = {
method = "sts"
sts = {
service_account_id = var.skyflow_service_account_id
}
}
deidentify = {
entities = ["NAME", "EMAIL_ADDRESS", "PHONE_NUMBER", "SSN", "CREDIT_CARD"]
token_format = "VAULT_TOKEN"
}
}
operations = {
limits = {
max_spans = 512
}
}
}
control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "skyflow_service_account_id" {
type = string
}Add this section to your kong.yaml configuration file:
_format_version: "3.0"
plugins:
- name: skyflow-ai-data-control
service: serviceName|Id
config:
skyflow:
vault_configuration:
vault_id: ${{ env "DECK_SKYFLOW_VAULT_ID" }}
vault_url: ${{ env "DECK_SKYFLOW_VAULT_URL" }}
credentials:
method: sts
sts:
service_account_id: ${{ env "DECK_SKYFLOW_SERVICE_ACCOUNT_ID" }}
deidentify:
entities:
- NAME
- EMAIL_ADDRESS
- PHONE_NUMBER
- SSN
- CREDIT_CARD
token_format: VAULT_TOKEN
operations:
limits:
max_spans: 512Make sure to replace the following placeholders with your own values:
-
serviceName|Id: Theidornameof the service the plugin configuration will target.
Make the following request:
curl -i -X POST http://localhost:8001/services/{serviceName|Id}/plugins/ \
--header "Accept: application/json" \
--header "Content-Type: application/json" \
--data '
{
"name": "skyflow-ai-data-control",
"config": {
"skyflow": {
"vault_configuration": {
"vault_id": "'$SKYFLOW_VAULT_ID'",
"vault_url": "'$SKYFLOW_VAULT_URL'"
},
"credentials": {
"method": "sts",
"sts": {
"service_account_id": "'$SKYFLOW_SERVICE_ACCOUNT_ID'"
}
},
"deidentify": {
"entities": [
"NAME",
"EMAIL_ADDRESS",
"PHONE_NUMBER",
"SSN",
"CREDIT_CARD"
],
"token_format": "VAULT_TOKEN"
}
},
"operations": {
"limits": {
"max_spans": 512
}
}
}
}
'Make sure to replace the following placeholders with your own values:
-
serviceName|Id: Theidornameof the service the plugin configuration will target.
Make the following request:
curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/services/{serviceId}/plugins/ \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "skyflow-ai-data-control",
"config": {
"skyflow": {
"vault_configuration": {
"vault_id": "'$SKYFLOW_VAULT_ID'",
"vault_url": "'$SKYFLOW_VAULT_URL'"
},
"credentials": {
"method": "sts",
"sts": {
"service_account_id": "'$SKYFLOW_SERVICE_ACCOUNT_ID'"
}
},
"deidentify": {
"entities": [
"NAME",
"EMAIL_ADDRESS",
"PHONE_NUMBER",
"SSN",
"CREDIT_CARD"
],
"token_format": "VAULT_TOKEN"
}
},
"operations": {
"limits": {
"max_spans": 512
}
}
}
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
controlPlaneId: Theidof the control plane. -
serviceId: Theidof the service the plugin configuration will target.
See the Konnect API reference to learn about region-specific URLs and personal access tokens.
echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
name: skyflow-ai-data-control
namespace: kong
annotations:
kubernetes.io/ingress.class: kong
config:
skyflow:
vault_configuration:
vault_id: '$SKYFLOW_VAULT_ID'
vault_url: '$SKYFLOW_VAULT_URL'
credentials:
method: sts
sts:
service_account_id: '$SKYFLOW_SERVICE_ACCOUNT_ID'
deidentify:
entities:
- NAME
- EMAIL_ADDRESS
- PHONE_NUMBER
- SSN
- CREDIT_CARD
token_format: VAULT_TOKEN
operations:
limits:
max_spans: 512
plugin: skyflow-ai-data-control
" | kubectl apply -f -Next, apply the KongPlugin resource by annotating the service resource:
kubectl annotate -n kong service SERVICE_NAME konghq.com/plugins=skyflow-ai-data-controlPrerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration to create a Konnect Gateway Plugin:
resource "konnect_gateway_plugin_skyflow_ai_data_control" "my_skyflow_ai_data_control" {
enabled = true
config = {
skyflow = {
vault_configuration = {
vault_id = var.skyflow_vault_id
vault_url = var.skyflow_vault_url
}
credentials = {
method = "sts"
sts = {
service_account_id = var.skyflow_service_account_id
}
}
deidentify = {
entities = ["NAME", "EMAIL_ADDRESS", "PHONE_NUMBER", "SSN", "CREDIT_CARD"]
token_format = "VAULT_TOKEN"
}
}
operations = {
limits = {
max_spans = 512
}
}
}
control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
service = {
id = konnect_gateway_service.my_service.id
}
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "skyflow_service_account_id" {
type = string
}Add this section to your kong.yaml configuration file:
_format_version: "3.0"
plugins:
- name: skyflow-ai-data-control
route: routeName|Id
config:
skyflow:
vault_configuration:
vault_id: ${{ env "DECK_SKYFLOW_VAULT_ID" }}
vault_url: ${{ env "DECK_SKYFLOW_VAULT_URL" }}
credentials:
method: sts
sts:
service_account_id: ${{ env "DECK_SKYFLOW_SERVICE_ACCOUNT_ID" }}
deidentify:
entities:
- NAME
- EMAIL_ADDRESS
- PHONE_NUMBER
- SSN
- CREDIT_CARD
token_format: VAULT_TOKEN
operations:
limits:
max_spans: 512Make sure to replace the following placeholders with your own values:
-
routeName|Id: Theidornameof the route the plugin configuration will target.
Make the following request:
curl -i -X POST http://localhost:8001/routes/{routeName|Id}/plugins/ \
--header "Accept: application/json" \
--header "Content-Type: application/json" \
--data '
{
"name": "skyflow-ai-data-control",
"config": {
"skyflow": {
"vault_configuration": {
"vault_id": "'$SKYFLOW_VAULT_ID'",
"vault_url": "'$SKYFLOW_VAULT_URL'"
},
"credentials": {
"method": "sts",
"sts": {
"service_account_id": "'$SKYFLOW_SERVICE_ACCOUNT_ID'"
}
},
"deidentify": {
"entities": [
"NAME",
"EMAIL_ADDRESS",
"PHONE_NUMBER",
"SSN",
"CREDIT_CARD"
],
"token_format": "VAULT_TOKEN"
}
},
"operations": {
"limits": {
"max_spans": 512
}
}
}
}
'Make sure to replace the following placeholders with your own values:
-
routeName|Id: Theidornameof the route the plugin configuration will target.
Make the following request:
curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/routes/{routeId}/plugins/ \
--header "accept: application/json" \
--header "Content-Type: application/json" \
--header "Authorization: Bearer $KONNECT_TOKEN" \
--data '
{
"name": "skyflow-ai-data-control",
"config": {
"skyflow": {
"vault_configuration": {
"vault_id": "'$SKYFLOW_VAULT_ID'",
"vault_url": "'$SKYFLOW_VAULT_URL'"
},
"credentials": {
"method": "sts",
"sts": {
"service_account_id": "'$SKYFLOW_SERVICE_ACCOUNT_ID'"
}
},
"deidentify": {
"entities": [
"NAME",
"EMAIL_ADDRESS",
"PHONE_NUMBER",
"SSN",
"CREDIT_CARD"
],
"token_format": "VAULT_TOKEN"
}
},
"operations": {
"limits": {
"max_spans": 512
}
}
}
}
'Make sure to replace the following placeholders with your own values:
-
region: Geographic region where your Kong Konnect is hosted and operates. -
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account. -
controlPlaneId: Theidof the control plane. -
routeId: Theidof the route the plugin configuration will target.
See the Konnect API reference to learn about region-specific URLs and personal access tokens.
echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
name: skyflow-ai-data-control
namespace: kong
annotations:
kubernetes.io/ingress.class: kong
config:
skyflow:
vault_configuration:
vault_id: '$SKYFLOW_VAULT_ID'
vault_url: '$SKYFLOW_VAULT_URL'
credentials:
method: sts
sts:
service_account_id: '$SKYFLOW_SERVICE_ACCOUNT_ID'
deidentify:
entities:
- NAME
- EMAIL_ADDRESS
- PHONE_NUMBER
- SSN
- CREDIT_CARD
token_format: VAULT_TOKEN
operations:
limits:
max_spans: 512
plugin: skyflow-ai-data-control
" | kubectl apply -f -Next, apply the KongPlugin resource by annotating the httproute or ingress resource:
kubectl annotate -n kong httproute konghq.com/plugins=skyflow-ai-data-controlkubectl annotate -n kong ingress konghq.com/plugins=skyflow-ai-data-controlPrerequisite: Configure your Personal Access Token
terraform {
required_providers {
konnect = {
source = "kong/konnect"
}
}
}
provider "konnect" {
personal_access_token = "$KONNECT_TOKEN"
server_url = "https://us.api.konghq.com/"
}Add the following to your Terraform configuration to create a Konnect Gateway Plugin:
resource "konnect_gateway_plugin_skyflow_ai_data_control" "my_skyflow_ai_data_control" {
enabled = true
config = {
skyflow = {
vault_configuration = {
vault_id = var.skyflow_vault_id
vault_url = var.skyflow_vault_url
}
credentials = {
method = "sts"
sts = {
service_account_id = var.skyflow_service_account_id
}
}
deidentify = {
entities = ["NAME", "EMAIL_ADDRESS", "PHONE_NUMBER", "SSN", "CREDIT_CARD"]
token_format = "VAULT_TOKEN"
}
}
operations = {
limits = {
max_spans = 512
}
}
}
control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
route = {
id = konnect_gateway_route.my_route.id
}
}This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.
variable "skyflow_service_account_id" {
type = string
}