Quickstart

After you install the Snowflake Native App and grant a role that can call app_public.mask(), use the pre-loaded app_public.sample_records table to try masking against synthetic healthcare-style records. The examples below are designed to run unchanged in that Snowflake environment.

1. Basic masking

Pass a string and get de-identified output back:

SELECT app_public.mask(
  'John Smith lives at 123 Main St. His SSN is 078-05-1120. Email: john@example.com'
);

app_public.mask() returns a VARIANT object. The top-level columns[0].deidentified_text field holds the masked output:

[PERSON_1] lives at [LOCATION_1]. His SSN is [US_SSN_1]. Email: [EMAIL_ADDRESS_1]

Each entity type gets its own counter. Multiple people become [PERSON_1], [PERSON_2], etc.

Treat response metadata as sensitive when it includes entity_ledger or analyzer_results; those fields can contain detected source values and span details.

2. Apply to related columns

Use the ARRAY variant when related text fields should share one entity ledger in the same call:

SELECT
  record_id,
  app_public.mask(ARRAY_CONSTRUCT(intake_note, discharge_summary)) AS masked
FROM app_public.sample_records;

The columns array contains one entry per input string. Extract them individually:

WITH t AS (
  SELECT record_id,
         app_public.mask(ARRAY_CONSTRUCT(intake_note, discharge_summary)) AS r
  FROM app_public.sample_records
)
SELECT
  record_id,
  r:columns[0]:deidentified_text AS masked_intake,
  r:columns[1]:deidentified_text AS masked_discharge
FROM t;

The ledger is shared within each call, so related fields in the same row can use consistent replacements. It is not shared across separate rows.

3. Pick a different operator

Override the default type_numbered operator via entity_config:

SELECT app_public.mask(
  'Call 555-0100, email john@acme.com',
  OBJECT_CONSTRUCT(
    'entity_config', OBJECT_CONSTRUCT(
      'PHONE_NUMBER', OBJECT_CONSTRUCT('operator', 'mask'),
      'EMAIL_ADDRESS', OBJECT_CONSTRUCT('operator', 'hash')
    )
  )
);
-- Call ***-****, email [HASH_a1b2c3d4...]

See the Operators section for all 9 operators and their parameters.

4. Custom entity (plain-English description)

Use description-based custom entities for domain-specific values:

SELECT app_public.mask(
  'Patient prescribed Metformin 500mg and Lisinopril 10mg',
  OBJECT_CONSTRUCT(
    'entity_config', OBJECT_CONSTRUCT(
      'MEDICATION', OBJECT_CONSTRUCT(
        'description', 'prescription drug names and dosages',
        'operator', 'constant',
        'operator_params', OBJECT_CONSTRUCT('value', '[RX]')
      )
    )
  )
);
-- Patient prescribed [RX] and [RX]

Full guide: Custom entities (description-based).

5. Identity-aware masking

Enable identity-aware grouping so aliases such as “Chen”, “Sarah Chen”, and “Dr. Chen” can share one placeholder:

SELECT app_public.mask(
  discharge_summary,
  OBJECT_CONSTRUCT('entity_collapse', 0.5)
) AS r
FROM app_public.sample_records
WHERE record_id = 2;

entity_collapse takes a value from 0.0 (conservative) to 1.0 (aggressive). The default is -1 (disabled). Full guide: Identity Resolution.

What’s next

• SQL reference — full mask() signature, all parameters, response shape.
• Operators — when to use each de-identification operator.
• Custom entities — describe or regex-match your domain-specific PII.
• Documents — PDF, image, DICOM redaction, plus DOCX, RTF, and ZIP extraction.
• Administration — scale compute, configure retention, and start or stop the service.