chore: Support new Data Masking Config (#592)

n-o-u-r-h-a-n · CharlesDuboisSAP · bot-sdk-js · web-flow · commit 00de28fbe3b2 · 2025-10-15T13:39:15.000+02:00
* Supporting DPICustomEntity and option field replacement_strategy

* Update sample-code/spring-app/src/main/java/com/sap/ai/sdk/app/services/OrchestrationService.java

Co-authored-by: Charles Dubois &lt;103174266+CharlesDuboisSAP@users.noreply.github.com&gt;

* Fixing PR comments

* Formatting

* Updates

* Adding Release Notes.

* Updating withEntities method + Implementing withRegex() multiple times in a row.

* pom

* Updating code of new withRegex function to make it more efficient.

* Formatting

* Removing unused import.

* Updated release notes

* Updating unit test for DpiMasking

* Formatting

* Formatting opened files

* Improving code quality (reducing indentations) of withRegex() function outside builder.

* Fixing Build

* Updating Unit Test

* Reverting coverage percentage.

* Updating javadoc of maskingRegex() function.

* Updating again the javadoc of maskingRegex() function.

* Splitting Test and updating minor comments.

* Splitting 2 Test and updating minor comments.

* Update docs/release_notes.md

Co-authored-by: Alexander Dümont &lt;22489773+newtork@users.noreply.github.com&gt;

* Updating test name.

---------

Co-authored-by: Charles Dubois &lt;103174266+CharlesDuboisSAP@users.noreply.github.com&gt;
Co-authored-by: SAP Cloud SDK Bot &lt;cloudsdk@sap.com&gt;
Co-authored-by: Alexander Dümont &lt;22489773+newtork@users.noreply.github.com&gt;
diff --git a/docs/release_notes.md b/docs/release_notes.md
@@ -55,7 +55,7 @@
   
 ### 📈 Improvements
 
--
+- [Orchestration] Added new API `DpiMasking#withRegex` to apply custom masking patterns.
 
 ### 🐛 Fixed Issues
 
diff --git a/orchestration/src/main/java/com/sap/ai/sdk/orchestration/DpiMasking.java b/orchestration/src/main/java/com/sap/ai/sdk/orchestration/DpiMasking.java
@@ -6,12 +6,14 @@
 
 import com.sap.ai.sdk.orchestration.model.DPIConfig;
 import com.sap.ai.sdk.orchestration.model.DPIConfigMaskGroundingInput;
+import com.sap.ai.sdk.orchestration.model.DPICustomEntity;
 import com.sap.ai.sdk.orchestration.model.DPIEntities;
 import com.sap.ai.sdk.orchestration.model.DPIEntityConfig;
+import com.sap.ai.sdk.orchestration.model.DPIMethodConstant;
 import com.sap.ai.sdk.orchestration.model.DPIStandardEntity;
-import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.stream.Stream;
 import javax.annotation.Nonnull;
 import lombok.AccessLevel;
 import lombok.Getter;
@@ -32,7 +34,7 @@
 @RequiredArgsConstructor(access = AccessLevel.PRIVATE)
 public class DpiMasking implements MaskingProvider {
   @Nonnull DPIConfig.MethodEnum maskingMethod;
-  @Nonnull List<DPIEntities> entities;
+  @Nonnull List<DPIEntityConfig> entitiesConfig;
   @With boolean maskGroundingInput;
   @Nonnull List<String> allowList;
 
@@ -75,11 +77,53 @@ public static class Builder {
     @Nonnull
     public DpiMasking withEntities(
         @Nonnull final DPIEntities entity, @Nonnull final DPIEntities... entities) {
-      val entitiesList = new ArrayList<DPIEntities>();
-      entitiesList.add(entity);
-      entitiesList.addAll(Arrays.asList(entities));
-      return new DpiMasking(maskingMethod, entitiesList, false, List.of());
+      val entitiesConfig =
+          Stream.concat(Stream.of(entity), Arrays.stream(entities))
+              .map(it -> (DPIEntityConfig) DPIStandardEntity.create().type(it))
+              .toList();
+      return new DpiMasking(maskingMethod, entitiesConfig, false, List.of());
     }
+
+    /**
+     * Adds a custom regex pattern for masking.
+     *
+     * @param regex The regex pattern to match
+     * @param replacement The replacement string
+     * @return A new {@link DpiMasking} instance
+     */
+    @Nonnull
+    public DpiMasking withRegex(@Nonnull final String regex, @Nonnull final String replacement) {
+      val customEntity =
+          DPICustomEntity.create()
+              .regex(regex)
+              .replacementStrategy(
+                  DPIMethodConstant.create()
+                      .method(DPIMethodConstant.MethodEnum.CONSTANT)
+                      .value(replacement));
+
+      return new DpiMasking(maskingMethod, List.of(customEntity), false, List.of());
+    }
+  }
+
+  /**
+   * Specifies a custom regex pattern for masking.
+   *
+   * @param regex The regex pattern to match
+   * @param replacement The replacement string
+   * @return A new {@link DpiMasking} instance
+   */
+  @Nonnull
+  public DpiMasking withRegex(@Nonnull final String regex, @Nonnull final String replacement) {
+    val customEntity =
+        DPICustomEntity.create()
+            .regex(regex)
+            .replacementStrategy(
+                DPIMethodConstant.create()
+                    .method(DPIMethodConstant.MethodEnum.CONSTANT)
+                    .value(replacement));
+    val newEntities = new java.util.ArrayList<>(entitiesConfig);
+    newEntities.add(customEntity);
+    return new DpiMasking(maskingMethod, newEntities, maskGroundingInput, allowList);
   }
 
   /**
@@ -90,18 +134,16 @@ public DpiMasking withEntities(
    */
   @Nonnull
   public DpiMasking withAllowList(@Nonnull final List<String> allowList) {
-    return new DpiMasking(maskingMethod, entities, maskGroundingInput, allowList);
+    return new DpiMasking(maskingMethod, entitiesConfig, maskGroundingInput, allowList);
   }
 
   @Nonnull
   @Override
   public DPIConfig createConfig() {
-    val entitiesDTO =
-        entities.stream().map(it -> (DPIEntityConfig) DPIStandardEntity.create().type(it)).toList();
     return DPIConfig.create()
         .type(SAP_DATA_PRIVACY_INTEGRATION)
         .method(maskingMethod)
-        .entities(entitiesDTO)
+        .entities(entitiesConfig)
         .maskGroundingInput(DPIConfigMaskGroundingInput.create().enabled(maskGroundingInput))
         .allowlist(allowList);
   }
diff --git a/orchestration/src/test/java/com/sap/ai/sdk/orchestration/OrchestrationModuleConfigTest.java b/orchestration/src/test/java/com/sap/ai/sdk/orchestration/OrchestrationModuleConfigTest.java
@@ -10,7 +10,9 @@
 
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.sap.ai.sdk.orchestration.model.DPIConfig;
+import com.sap.ai.sdk.orchestration.model.DPICustomEntity;
 import com.sap.ai.sdk.orchestration.model.DPIEntities;
+import com.sap.ai.sdk.orchestration.model.DPIMethodConstant;
 import com.sap.ai.sdk.orchestration.model.DPIStandardEntity;
 import com.sap.ai.sdk.orchestration.model.DocumentGroundingFilter;
 import com.sap.ai.sdk.orchestration.model.GroundingModuleConfigConfig;
@@ -106,6 +108,36 @@ void testDpiMaskingConfig() {
         .hasSize(1);
   }
 
+  @Test
+  void testDpiMaskingRegex() {
+    var masking =
+        DpiMasking.anonymization()
+            .withRegex("\\d{3}-\\d{2}-\\d{4}", "***-**-****")
+            .withRegex("\\d{2}-\\d{2}-\\d{5}", "**-**-*****");
+    var config = new OrchestrationModuleConfig().withLlmConfig(GPT_4O).withMaskingConfig(masking);
+    assertThat(config.getMaskingConfig()).isNotNull();
+    assertThat(((MaskingModuleConfigProviders) config.getMaskingConfig()).getProviders())
+        .hasSize(1);
+    DPIConfig dpiConfig =
+        ((MaskingModuleConfigProviders) config.getMaskingConfig()).getProviders().get(0);
+    assertThat(dpiConfig.getMethod()).isEqualTo(DPIConfig.MethodEnum.ANONYMIZATION);
+    assertThat(dpiConfig.getEntities()).hasSize(2);
+    assertThat(((DPICustomEntity) dpiConfig.getEntities().get(0)).getRegex())
+        .isEqualTo("\\d{3}-\\d{2}-\\d{4}");
+    assertThat(((DPICustomEntity) dpiConfig.getEntities().get(0)).getReplacementStrategy())
+        .isEqualTo(
+            DPIMethodConstant.create()
+                .method(DPIMethodConstant.MethodEnum.CONSTANT)
+                .value("***-**-****"));
+    assertThat(((DPICustomEntity) dpiConfig.getEntities().get(1)).getRegex())
+        .isEqualTo("\\d{2}-\\d{2}-\\d{5}");
+    assertThat(((DPICustomEntity) dpiConfig.getEntities().get(1)).getReplacementStrategy())
+        .isEqualTo(
+            DPIMethodConstant.create()
+                .method(DPIMethodConstant.MethodEnum.CONSTANT)
+                .value("**-**-*****"));
+  }
+
   @Test
   void testParams() {
     // test withParams(Map<String, Object>)
diff --git a/sample-code/spring-app/src/main/java/com/sap/ai/sdk/app/controllers/OrchestrationController.java b/sample-code/spring-app/src/main/java/com/sap/ai/sdk/app/controllers/OrchestrationController.java
@@ -216,6 +216,17 @@ Object maskingAnonymization(
     return response.getContent();
   }
 
+  @GetMapping("/maskingRegex")
+  @Nonnull
+  Object maskingRegex(
+      @Nullable @RequestParam(value = "format", required = false) final String format) {
+    final var response = service.maskingRegex();
+    if ("json".equals(format)) {
+      return response;
+    }
+    return response.getContent();
+  }
+
   @GetMapping("/completion/{resourceGroup}")
   @Nonnull
   Object completionWithResourceGroup(
diff --git a/sample-code/spring-app/src/main/java/com/sap/ai/sdk/app/services/OrchestrationService.java b/sample-code/spring-app/src/main/java/com/sap/ai/sdk/app/services/OrchestrationService.java
@@ -267,9 +267,9 @@ public OrchestrationChatResponse maskingAnonymization(@Nonnull final DPIEntities
     val userMessage =
         Message.user(
             """
-                            I think the SDK is good, but could use some further enhancements.
-                            My architect Alice and manager Bob pointed out that we need the grounding capabilities, which aren't supported yet.
-                            """);
+    I think the SDK is good, but could use some further enhancements.
+    My architect Alice and manager Bob pointed out that we need the grounding capabilities, which aren't supported yet.
+    """);
 
     val prompt = new OrchestrationPrompt(systemMessage, userMessage);
     val maskingConfig = DpiMasking.anonymization().withEntities(entity);
@@ -278,6 +278,28 @@ public OrchestrationChatResponse maskingAnonymization(@Nonnull final DPIEntities
     return client.chatCompletion(prompt, configWithMasking);
   }
 
+  /**
+   * Let the LLM respond with a masked repeated phrase of patient IDs.
+   *
+   * @link <a
+   *     href="https://help.sap.com/docs/sap-ai-core/sap-ai-core-service-guide/data-masking">SAP AI
+   *     Core: Orchestration - Data Masking</a>
+   * @return the assistant response object
+   */
+  @Nonnull
+  public OrchestrationChatResponse maskingRegex() {
+    val systemMessage = Message.system("Repeat following messages");
+    val userMessage = Message.user("The patient id is patient_id_123.");
+
+    val prompt = new OrchestrationPrompt(systemMessage, userMessage);
+    val regex = "patient_id_[0-9]+";
+    val replacement = "REDACTED_ID";
+    val maskingConfig = DpiMasking.anonymization().withRegex(regex, replacement);
+    val configWithMasking = config.withMaskingConfig(maskingConfig);
+
+    return client.chatCompletion(prompt, configWithMasking);
+  }
+
   /**
    * Chat request to OpenAI through the Orchestration deployment under a specific resource group.
    *
diff --git a/sample-code/spring-app/src/main/resources/static/index.html b/sample-code/spring-app/src/main/resources/static/index.html
@@ -380,6 +380,18 @@ <h2>Orchestration</h2>
                                         </div>
                                     </div>
                                 </li>
+                                <li class="list-group-item">
+                                    <div class="info-tooltip">
+                                        <button type="submit"
+                                                formaction="/orchestration/maskingRegex"
+                                                class="link-offset-2-hover link-underline link-underline-opacity-0 link-underline-opacity-75-hover endpoint">
+                                            <code>/orchestration/maskingRegex</code>
+                                        </button>
+                                        <div class="tooltip-content">
+                                            Let the LLM respond with a masked repeated phrase of patient IDs.
+                                        </div>
+                                    </div>
+                                </li>
                                 <li class="list-group-item">
                                     <div class="info-tooltip">
                                         <button type="submit"
diff --git a/sample-code/spring-app/src/test/java/com/sap/ai/sdk/app/controllers/OrchestrationTest.java b/sample-code/spring-app/src/test/java/com/sap/ai/sdk/app/controllers/OrchestrationTest.java
@@ -150,6 +150,25 @@ void testMaskingAnonymization() {
     assertThat(result.getIntermediateResults().getOutputUnmasking()).isEmpty();
   }
 
+  @Test
+  void testMaskingRegex() {
+    var response = service.maskingRegex();
+    var result = response.getOriginalResponse();
+    var llmChoice = result.getFinalResult().getChoices().get(0);
+    assertThat(llmChoice.getFinishReason()).isEqualTo("stop");
+
+    var maskingResult = result.getIntermediateResults().getInputMasking();
+    assertThat(maskingResult.getMessage()).isNotEmpty();
+    var data = (Map<String, Object>) maskingResult.getData();
+    var maskedMessage = (String) data.get("masked_template");
+    assertThat(maskedMessage)
+        .describedAs("The masked input should replace patient IDs with REDACTED_ID")
+        .doesNotContain("patient_id_123")
+        .contains("REDACTED_ID");
+
+    assertThat(result.getIntermediateResults().getOutputUnmasking()).isEmpty();
+  }
+
   @SuppressWarnings("unchecked")
   @Test
   void testMaskingPseudonymization() {
