mask() Function

The app_public.mask() function is the SQL entry point for PII detection and de-identification in Snowflake. Use it with one string, or pass an array of related strings when you want one shared entity ledger for the call. It has two overloads.

Signature

-- Single string
app_public.mask(data STRING [, params VARIANT])
  RETURNS VARIANT

-- Array of strings
app_public.mask(data ARRAY [, params VARIANT])
  RETURNS VARIANT

The params argument is optional. When omitted, Agent Mask uses its default detection behavior, a 0.5 confidence threshold, the type_numbered operator, and the default entity set.

String overload

Pass a single string. The response columns array contains one entry.

SELECT app_public.mask('Alice Smith, 555-0100');

Return shape:

{
  "columns": [
    {
      "index": 0,
      "deidentified_text": "[PERSON_1], [PHONE_NUMBER_1]",
      "analyzer_results": [
        {"entity_type": "PERSON", "start": 0, "end": 11, "score": 0.97},
        {"entity_type": "PHONE_NUMBER", "start": 13, "end": 21, "score": 0.95}
      ]
    }
  ],
  "entity_ledger": [
    {
      "entity_type": "PERSON",
      "original": "Alice Smith",
      "placeholder": "[REDACTED_PERSON_1]",
      "replacement": "[PERSON_1]"
    },
    {
      "entity_type": "PHONE_NUMBER",
      "original": "555-0100",
      "placeholder": "[REDACTED_PHONE_NUMBER_1]",
      "replacement": "[PHONE_NUMBER_1]"
    }
  ]
}

Array overload

Pass multiple strings in one call. The response columns array contains one entry per input.

SELECT app_public.mask(
  ARRAY_CONSTRUCT(
    'Alice Smith emailed bob@acme.com',
    'Bob said Alice called back at 555-0100'
  )
);

The entity_ledger is shared across all columns in a single call, so “Alice Smith” gets the same [PERSON_1] replacement in both strings. When mask() runs across table rows, each row gets its own ledger unless you combine related values into one array in the same call.

Column application

Apply to one or more text columns in a table:

SELECT
  record_id,
  app_public.mask(ARRAY_CONSTRUCT(intake_note, discharge_summary)) AS masked
FROM app_public.sample_records;

Extract individual column results:

WITH t AS (
  SELECT record_id,
         app_public.mask(ARRAY_CONSTRUCT(intake_note, discharge_summary)) AS r
  FROM app_public.sample_records
)
SELECT
  record_id,
  r:columns[0]:deidentified_text AS masked_intake,
  r:columns[1]:deidentified_text AS masked_discharge
FROM t;

Required roles

Both app_admin and app_user can call mask(). Grant to your own roles:

GRANT APPLICATION ROLE agent_mask_en.app_user TO ROLE analyst;