Skyflow De-identify: De-identify only - Plugin

De-identify onlyv3.15+

Enable the Skyflow De-identify plugin with re-identification disabled.

In this configuration, the plugin tokenizes outbound request bodies before Kong Gateway proxies them upstream. Re-identification is off, so the caller also receives tokens rather than restored values. Use this configuration for a strict egress posture where no original values should leave your trust boundary.

The sts credential method requires no stored Skyflow secret. Kong Gateway exchanges each caller’s own identity provider (IdP) token for a short-lived Skyflow bearer token using RFC 8693 token exchange.

Prerequisites

The Skyflow De-identify plugin is installed.
You have a Skyflow account with a Detect vault. From the vault’s page in the Skyflow admin console, copy the Vault ID, Vault URL, and Account ID.
The credential’s Skyflow role permits the de-identify operation.

Environment variables

SKYFLOW_VAULT_ID: The ID of your Skyflow Detect vault.
SKYFLOW_VAULT_URL: The full URL of your Skyflow vault. For example: https://{cluster}.vault.skyflowapis.com. Sandbox vaults use .skyflowapis.tech.
SKYFLOW_ACCOUNT_ID: Your Skyflow account ID.
SKYFLOW_SERVICE_ACCOUNT_ID: Your Skyflow service account ID, used for STS token exchange.
SKYFLOW_EXPECTED_ISSUER: The issuer URL of your IdP. For example: https://login.microsoftonline.com/{tenant}/v2.0.
SKYFLOW_EXPECTED_AUDIENCE: The expected audience value in the caller’s IdP token. Typically the client ID of your IdP application.

Set up the plugin

Add this section to your kong.yaml configuration file:

kong.yaml

Copied!

_format_version: "3.0"
plugins:
  - name: skyflow-ai-data-control
    config:
      skyflow:
        vault_configuration:
          vault_id: ${{ env "DECK_SKYFLOW_VAULT_ID" }}
          vault_url: ${{ env "DECK_SKYFLOW_VAULT_URL" }}
          account_id: ${{ env "DECK_SKYFLOW_ACCOUNT_ID" }}
        credentials:
          method: sts
          sts:
            service_account_id: ${{ env "DECK_SKYFLOW_SERVICE_ACCOUNT_ID" }}
            expected_issuer: ${{ env "DECK_SKYFLOW_EXPECTED_ISSUER" }}
            expected_audience: ${{ env "DECK_SKYFLOW_EXPECTED_AUDIENCE" }}
        deidentify:
          entities:
          - NAME
          - EMAIL_ADDRESS
          - PHONE_NUMBER
          - SSN
          - CREDIT_CARD
          token_format: VAULT_TOKEN
        reidentify:
          enabled: false

Make the following request:

curl -i -X POST http://localhost:8001/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "skyflow-ai-data-control",
      "config": {
        "skyflow": {
          "vault_configuration": {
            "vault_id": "'$SKYFLOW_VAULT_ID'",
            "vault_url": "'$SKYFLOW_VAULT_URL'",
            "account_id": "'$SKYFLOW_ACCOUNT_ID'"
          },
          "credentials": {
            "method": "sts",
            "sts": {
              "service_account_id": "'$SKYFLOW_SERVICE_ACCOUNT_ID'",
              "expected_issuer": "'$SKYFLOW_EXPECTED_ISSUER'",
              "expected_audience": "'$SKYFLOW_EXPECTED_AUDIENCE'"
            }
          },
          "deidentify": {
            "entities": [
              "NAME",
              "EMAIL_ADDRESS",
              "PHONE_NUMBER",
              "SSN",
              "CREDIT_CARD"
            ],
            "token_format": "VAULT_TOKEN"
          },
          "reidentify": {
            "enabled": false
          }
        }
      }
    }
    '

Copied!

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "skyflow-ai-data-control",
      "config": {
        "skyflow": {
          "vault_configuration": {
            "vault_id": "'$SKYFLOW_VAULT_ID'",
            "vault_url": "'$SKYFLOW_VAULT_URL'",
            "account_id": "'$SKYFLOW_ACCOUNT_ID'"
          },
          "credentials": {
            "method": "sts",
            "sts": {
              "service_account_id": "'$SKYFLOW_SERVICE_ACCOUNT_ID'",
              "expected_issuer": "'$SKYFLOW_EXPECTED_ISSUER'",
              "expected_audience": "'$SKYFLOW_EXPECTED_AUDIENCE'"
            }
          },
          "deidentify": {
            "entities": [
              "NAME",
              "EMAIL_ADDRESS",
              "PHONE_NUMBER",
              "SSN",
              "CREDIT_CARD"
            ],
            "token_format": "VAULT_TOKEN"
          },
          "reidentify": {
            "enabled": false
          }
        }
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
controlPlaneId: The id of the control plane.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: skyflow-ai-data-control
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
  labels:
    global: 'true'
config:
  skyflow:
    vault_configuration:
      vault_id: '$SKYFLOW_VAULT_ID'
      vault_url: '$SKYFLOW_VAULT_URL'
      account_id: '$SKYFLOW_ACCOUNT_ID'
    credentials:
      method: sts
      sts:
        service_account_id: '$SKYFLOW_SERVICE_ACCOUNT_ID'
        expected_issuer: '$SKYFLOW_EXPECTED_ISSUER'
        expected_audience: '$SKYFLOW_EXPECTED_AUDIENCE'
    deidentify:
      entities:
      - NAME
      - EMAIL_ADDRESS
      - PHONE_NUMBER
      - SSN
      - CREDIT_CARD
      token_format: VAULT_TOKEN
    reidentify:
      enabled: false
plugin: skyflow-ai-data-control
" | kubectl apply -f -

Copied!

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_skyflow_ai_data_control" "my_skyflow_ai_data_control" {
  enabled = true

  config = {

    skyflow = {

      vault_configuration = {
        vault_id = var.skyflow_vault_id
        vault_url = var.skyflow_vault_url
        account_id = var.skyflow_account_id
      }

      credentials = {
        method = "sts"

        sts = {
          service_account_id = var.skyflow_service_account_id
          expected_issuer = var.skyflow_expected_issuer
          expected_audience = var.skyflow_expected_audience
        }
      }

      deidentify = {
        entities = ["NAME", "EMAIL_ADDRESS", "PHONE_NUMBER", "SSN", "CREDIT_CARD"]
        token_format = "VAULT_TOKEN"
      }

      reidentify = {
        enabled = false
      }
    }
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "skyflow_expected_audience" {
  type = string
}

Copied!

Add this section to your kong.yaml configuration file:

kong.yaml

Copied!

_format_version: "3.0"
plugins:
  - name: skyflow-ai-data-control
    service: serviceName|Id
    config:
      skyflow:
        vault_configuration:
          vault_id: ${{ env "DECK_SKYFLOW_VAULT_ID" }}
          vault_url: ${{ env "DECK_SKYFLOW_VAULT_URL" }}
          account_id: ${{ env "DECK_SKYFLOW_ACCOUNT_ID" }}
        credentials:
          method: sts
          sts:
            service_account_id: ${{ env "DECK_SKYFLOW_SERVICE_ACCOUNT_ID" }}
            expected_issuer: ${{ env "DECK_SKYFLOW_EXPECTED_ISSUER" }}
            expected_audience: ${{ env "DECK_SKYFLOW_EXPECTED_AUDIENCE" }}
        deidentify:
          entities:
          - NAME
          - EMAIL_ADDRESS
          - PHONE_NUMBER
          - SSN
          - CREDIT_CARD
          token_format: VAULT_TOKEN
        reidentify:
          enabled: false

Make sure to replace the following placeholders with your own values:

serviceName|Id: The id or name of the service the plugin configuration will target.

Make the following request:

curl -i -X POST http://localhost:8001/services/{serviceName|Id}/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "skyflow-ai-data-control",
      "config": {
        "skyflow": {
          "vault_configuration": {
            "vault_id": "'$SKYFLOW_VAULT_ID'",
            "vault_url": "'$SKYFLOW_VAULT_URL'",
            "account_id": "'$SKYFLOW_ACCOUNT_ID'"
          },
          "credentials": {
            "method": "sts",
            "sts": {
              "service_account_id": "'$SKYFLOW_SERVICE_ACCOUNT_ID'",
              "expected_issuer": "'$SKYFLOW_EXPECTED_ISSUER'",
              "expected_audience": "'$SKYFLOW_EXPECTED_AUDIENCE'"
            }
          },
          "deidentify": {
            "entities": [
              "NAME",
              "EMAIL_ADDRESS",
              "PHONE_NUMBER",
              "SSN",
              "CREDIT_CARD"
            ],
            "token_format": "VAULT_TOKEN"
          },
          "reidentify": {
            "enabled": false
          }
        }
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

serviceName|Id: The id or name of the service the plugin configuration will target.

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/services/{serviceId}/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "skyflow-ai-data-control",
      "config": {
        "skyflow": {
          "vault_configuration": {
            "vault_id": "'$SKYFLOW_VAULT_ID'",
            "vault_url": "'$SKYFLOW_VAULT_URL'",
            "account_id": "'$SKYFLOW_ACCOUNT_ID'"
          },
          "credentials": {
            "method": "sts",
            "sts": {
              "service_account_id": "'$SKYFLOW_SERVICE_ACCOUNT_ID'",
              "expected_issuer": "'$SKYFLOW_EXPECTED_ISSUER'",
              "expected_audience": "'$SKYFLOW_EXPECTED_AUDIENCE'"
            }
          },
          "deidentify": {
            "entities": [
              "NAME",
              "EMAIL_ADDRESS",
              "PHONE_NUMBER",
              "SSN",
              "CREDIT_CARD"
            ],
            "token_format": "VAULT_TOKEN"
          },
          "reidentify": {
            "enabled": false
          }
        }
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
controlPlaneId: The id of the control plane.
serviceId: The id of the service the plugin configuration will target.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: skyflow-ai-data-control
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  skyflow:
    vault_configuration:
      vault_id: '$SKYFLOW_VAULT_ID'
      vault_url: '$SKYFLOW_VAULT_URL'
      account_id: '$SKYFLOW_ACCOUNT_ID'
    credentials:
      method: sts
      sts:
        service_account_id: '$SKYFLOW_SERVICE_ACCOUNT_ID'
        expected_issuer: '$SKYFLOW_EXPECTED_ISSUER'
        expected_audience: '$SKYFLOW_EXPECTED_AUDIENCE'
    deidentify:
      entities:
      - NAME
      - EMAIL_ADDRESS
      - PHONE_NUMBER
      - SSN
      - CREDIT_CARD
      token_format: VAULT_TOKEN
    reidentify:
      enabled: false
plugin: skyflow-ai-data-control
" | kubectl apply -f -

Copied!

Next, apply the KongPlugin resource by annotating the service resource:

kubectl annotate -n kong service SERVICE_NAME konghq.com/plugins=skyflow-ai-data-control

Copied!

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_skyflow_ai_data_control" "my_skyflow_ai_data_control" {
  enabled = true

  config = {

    skyflow = {

      vault_configuration = {
        vault_id = var.skyflow_vault_id
        vault_url = var.skyflow_vault_url
        account_id = var.skyflow_account_id
      }

      credentials = {
        method = "sts"

        sts = {
          service_account_id = var.skyflow_service_account_id
          expected_issuer = var.skyflow_expected_issuer
          expected_audience = var.skyflow_expected_audience
        }
      }

      deidentify = {
        entities = ["NAME", "EMAIL_ADDRESS", "PHONE_NUMBER", "SSN", "CREDIT_CARD"]
        token_format = "VAULT_TOKEN"
      }

      reidentify = {
        enabled = false
      }
    }
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  service = {
    id = konnect_gateway_service.my_service.id
  }
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "skyflow_expected_audience" {
  type = string
}

Copied!

Add this section to your kong.yaml configuration file:

kong.yaml

Copied!

_format_version: "3.0"
plugins:
  - name: skyflow-ai-data-control
    route: routeName|Id
    config:
      skyflow:
        vault_configuration:
          vault_id: ${{ env "DECK_SKYFLOW_VAULT_ID" }}
          vault_url: ${{ env "DECK_SKYFLOW_VAULT_URL" }}
          account_id: ${{ env "DECK_SKYFLOW_ACCOUNT_ID" }}
        credentials:
          method: sts
          sts:
            service_account_id: ${{ env "DECK_SKYFLOW_SERVICE_ACCOUNT_ID" }}
            expected_issuer: ${{ env "DECK_SKYFLOW_EXPECTED_ISSUER" }}
            expected_audience: ${{ env "DECK_SKYFLOW_EXPECTED_AUDIENCE" }}
        deidentify:
          entities:
          - NAME
          - EMAIL_ADDRESS
          - PHONE_NUMBER
          - SSN
          - CREDIT_CARD
          token_format: VAULT_TOKEN
        reidentify:
          enabled: false

Make sure to replace the following placeholders with your own values:

routeName|Id: The id or name of the route the plugin configuration will target.

Make the following request:

curl -i -X POST http://localhost:8001/routes/{routeName|Id}/plugins/ \
    --header "Accept: application/json" \
    --header "Content-Type: application/json" \
    --data '
    {
      "name": "skyflow-ai-data-control",
      "config": {
        "skyflow": {
          "vault_configuration": {
            "vault_id": "'$SKYFLOW_VAULT_ID'",
            "vault_url": "'$SKYFLOW_VAULT_URL'",
            "account_id": "'$SKYFLOW_ACCOUNT_ID'"
          },
          "credentials": {
            "method": "sts",
            "sts": {
              "service_account_id": "'$SKYFLOW_SERVICE_ACCOUNT_ID'",
              "expected_issuer": "'$SKYFLOW_EXPECTED_ISSUER'",
              "expected_audience": "'$SKYFLOW_EXPECTED_AUDIENCE'"
            }
          },
          "deidentify": {
            "entities": [
              "NAME",
              "EMAIL_ADDRESS",
              "PHONE_NUMBER",
              "SSN",
              "CREDIT_CARD"
            ],
            "token_format": "VAULT_TOKEN"
          },
          "reidentify": {
            "enabled": false
          }
        }
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

routeName|Id: The id or name of the route the plugin configuration will target.

Make the following request:

curl -X POST https://{region}.api.konghq.com/v2/control-planes/{controlPlaneId}/core-entities/routes/{routeId}/plugins/ \
    --header "accept: application/json" \
    --header "Content-Type: application/json" \
    --header "Authorization: Bearer $KONNECT_TOKEN" \
    --data '
    {
      "name": "skyflow-ai-data-control",
      "config": {
        "skyflow": {
          "vault_configuration": {
            "vault_id": "'$SKYFLOW_VAULT_ID'",
            "vault_url": "'$SKYFLOW_VAULT_URL'",
            "account_id": "'$SKYFLOW_ACCOUNT_ID'"
          },
          "credentials": {
            "method": "sts",
            "sts": {
              "service_account_id": "'$SKYFLOW_SERVICE_ACCOUNT_ID'",
              "expected_issuer": "'$SKYFLOW_EXPECTED_ISSUER'",
              "expected_audience": "'$SKYFLOW_EXPECTED_AUDIENCE'"
            }
          },
          "deidentify": {
            "entities": [
              "NAME",
              "EMAIL_ADDRESS",
              "PHONE_NUMBER",
              "SSN",
              "CREDIT_CARD"
            ],
            "token_format": "VAULT_TOKEN"
          },
          "reidentify": {
            "enabled": false
          }
        }
      }
    }
    '

Copied!

Make sure to replace the following placeholders with your own values:

region: Geographic region where your Kong Konnect is hosted and operates.
KONNECT_TOKEN: Your Personal Access Token (PAT) associated with your Konnect account.
controlPlaneId: The id of the control plane.
routeId: The id of the route the plugin configuration will target.

See the Konnect API reference to learn about region-specific URLs and personal access tokens.

echo "
apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: skyflow-ai-data-control
  namespace: kong
  annotations:
    kubernetes.io/ingress.class: kong
config:
  skyflow:
    vault_configuration:
      vault_id: '$SKYFLOW_VAULT_ID'
      vault_url: '$SKYFLOW_VAULT_URL'
      account_id: '$SKYFLOW_ACCOUNT_ID'
    credentials:
      method: sts
      sts:
        service_account_id: '$SKYFLOW_SERVICE_ACCOUNT_ID'
        expected_issuer: '$SKYFLOW_EXPECTED_ISSUER'
        expected_audience: '$SKYFLOW_EXPECTED_AUDIENCE'
    deidentify:
      entities:
      - NAME
      - EMAIL_ADDRESS
      - PHONE_NUMBER
      - SSN
      - CREDIT_CARD
      token_format: VAULT_TOKEN
    reidentify:
      enabled: false
plugin: skyflow-ai-data-control
" | kubectl apply -f -

Copied!

Next, apply the KongPlugin resource by annotating the httproute or ingress resource:

kubectl annotate -n kong httproute  konghq.com/plugins=skyflow-ai-data-control

Copied!

kubectl annotate -n kong ingress  konghq.com/plugins=skyflow-ai-data-control

Copied!

Prerequisite: Configure your Personal Access Token

terraform {
  required_providers {
    konnect = {
      source  = "kong/konnect"
    }
  }
}

provider "konnect" {
  personal_access_token = "$KONNECT_TOKEN"
  server_url            = "https://us.api.konghq.com/"
}

Copied!

Add the following to your Terraform configuration to create a Konnect Gateway Plugin:

resource "konnect_gateway_plugin_skyflow_ai_data_control" "my_skyflow_ai_data_control" {
  enabled = true

  config = {

    skyflow = {

      vault_configuration = {
        vault_id = var.skyflow_vault_id
        vault_url = var.skyflow_vault_url
        account_id = var.skyflow_account_id
      }

      credentials = {
        method = "sts"

        sts = {
          service_account_id = var.skyflow_service_account_id
          expected_issuer = var.skyflow_expected_issuer
          expected_audience = var.skyflow_expected_audience
        }
      }

      deidentify = {
        entities = ["NAME", "EMAIL_ADDRESS", "PHONE_NUMBER", "SSN", "CREDIT_CARD"]
        token_format = "VAULT_TOKEN"
      }

      reidentify = {
        enabled = false
      }
    }
  }

  control_plane_id = konnect_gateway_control_plane.my_konnect_cp.id
  route = {
    id = konnect_gateway_route.my_route.id
  }
}

Copied!

This example requires the following variables to be added to your manifest. You can specify values at runtime by setting TF_VAR_name=value.

variable "skyflow_expected_audience" {
  type = string
}

Copied!

Skyflow De-identify

De-identify onlyv3.15+

Prerequisites

Environment variables

Set up the plugin

Help us make these docs great!

Still need help?