Transform

POST /transform

The single entry point for protect, unprotect, search, and any other operation your configuration defines. Behavior is selected by the processingContext referenced in each request. There is no /protect or /unprotect endpoint.

Headers:

Authorization: Bearer <token>
Content-Type: application/json

Request body

{
  "loggingContext": {
    "attributes": [
      { "name": "string", "value": "string" }
    ]
  },
  "rightsContexts": [
    {
      "guid": "string",
      "evidences": [
        { "name": "string", "value": "string" }
      ]
    }
  ],
  "processingContexts": [
    {
      "guid": "string",
      "evidences": [
        { "name": "string", "value": "string" }
      ]
    }
  ],
  "requests": [
    {
      "guid": "string",
      "rightsContext": "string",
      "processingContext": "string",
      "instances": [
        {
          "className": "string",
          "propertyName": "string",
          "value": "string"
        }
      ]
    }
  ]
}

Field	Required	Description
loggingContext.attributes	No	Optional name-value pairs added to the audit log for this call.
rightsContexts[]	Yes	Rights contexts referenced by requests[].rightsContext. Each carries evidence used to evaluate access.
rightsContexts[].guid	Yes	A GUID you choose; referenced from requests[]. Can be fixed per integration or generated per call.
rightsContexts[].evidences[]	Yes	Key-value pairs whose names are defined in your portal configuration.
processingContexts[]	Yes	Processing contexts referenced by requests[].processingContext. Evidence here selects the transformer sequence to run, for example Protect or Unprotect.
requests[]	Yes	One or more requests; each transforms one or more instances.
requests[].guid	Yes	Request identifier you choose. Surfaces in the response and in audit logs. Useful for correlating multi-request calls.
requests[].rightsContext	Yes	GUID matching one of rightsContexts[].guid.
requests[].processingContext	Yes	GUID matching one of processingContexts[].guid.
requests[].instances[]	Yes	Values to transform. Each (className, propertyName) must match a data instance configured in the portal.

WARNING

Evidence keys and values are matched case-insensitively, so Role and role, or Protect and protect, resolve to the same context. Everything else must match exactly: spaces and punctuation count, so a value with different spacing will not match. For readability, use the same casing as the portal.

TIP

Batch multiple instances[], and multiple requests[], into a single call rather than calling once per field. Fewer, larger calls reduce round-trips and let the engine optimize across instances.

Response body

{
  "responses": [
    {
      "request": "string",
      "instances": [
        {
          "className": "string",
          "propertyName": "string",
          "value": "string"
        },
        {
          "className": "string",
          "propertyName": "string",
          "error": {
            "code": "string",
            "message": "string"
          }
        }
      ]
    }
  ]
}

Each entry in responses[] carries a request field that echoes the corresponding requests[].guid, so you can correlate response items with the request that produced them. Each instance entry contains either a value (the transformed value) or an error object describing why this single instance could not be processed.

A partial-success response is possible. Most instances may succeed while a few report error. Always inspect both fields when iterating over the response. See Errors for handling guidance.

Search operators

When a request resolves to a search processing context, the engine returns a search token you compare against the stored protected column. Which query operators are supported depends on the protection scheme of the data instance:

Operator	Availability
Equals, Does not equal	Exact value on deterministic schemes; within a range on probabilistic ones
Is blank, Is not blank	Same as Equals
Is greater than, Is less than	Format-preserving schemes
Is (greater/less) than or equal to, Is between, Is not between	Format-preserving and deterministic schemes
Begins with	Matches the first 4 characters of the search string

Logging context

Add an optional loggingContext.attributes[] array to attach contextual metadata to the audit log entry for the call.

"loggingContext": {
  "attributes": [
    { "name": "trace_id", "value": "5ad2c0a1-9c4e-4d52-bd71-6f8b7f81b8e9" },
    { "name": "tenant",   "value": "acme-corp" }
  ]
}

Useful values include a request or trace identifier, the tenant of the calling application, the upstream user identifier, or any custom field your audit reports rely on.