This feature allows you to obscure data before sending it as part of the analytics payload.
With this feature, Apigee uses SHA512 to hash the original value before communicating from the runtime
plane to the control plane.
Procedure
Enable this feature by setting features.analytics.data.obfuscation.enabled to
true.
With obfuscation enabled, Apigee hybrid will hash the following fields with SHA512 at the runtime plane before
sending the information to analytics backend:
client_id
client_ip
developer_email
proxy_client_ip
proxy_pathsuffix
request_urirequest_path
target_basepath
target_url
x_forwarded_for_ip
x-apigee.edge.true_client_ip
x-apigee.intelligence.client_ip_header
Apigee hybrid will hash the following dimension values in custom analytics reports:
The obfuscated results display in the Apigee hybrid analytics dashboard. It may take several
minutes before you see the hashed results in the UI.
Example
The following example shows the data before and after obfuscating:
// JSON data sent to AX before obfuscating{"proxy_basepath":"/APP_NAME","x-apigee.edge.execution.stats.request_flow_endtimestamp":1582770652814,"apiproxy":"APP_NAME","x-apigee.edge.is_policy_error":0,"client_sent_start_timestamp":1582770652817,"x-apigee.edge.is_target_error":0,"client_received_start_timestamp":1582770652813,"client_ip":"10.10.0.99","is_error":false,"x-apigee.edge.stats.steps":"{\"JS1.0\":1}","request_size":0,"x-apigee.intelligence.client_ip_header":"10.10.0.99","virtual_host":"default","x-apigee.edge.mp_host":"mp","sla":false,"x-apigee.intelligence.service":"{}","client_sent_end_timestamp":1582770652817,"request_uri":"/APP_NAME","proxy":"default","proxy_client_ip":"10.10.0.99","x-apigee.edge.dn.region":"dc-1","apigee.edge.execution.is_apigee_fault":0,"x-apigee.edge.target.latency.stats":"{\"targetList\":[]}","useragent":"Apache-HttpClient/4.3.6 (java 1.5)","proxy_pathsuffix":"","x-apigee.edge.execution.stats.request_flow_start_timestamp":1582770652814,"x_forwarded_for_ip":"10.10.0.99","x_forwarded_proto":"http","response_status_code":200,"request_verb":"GET","x-apigee.edge.execution.stats.response_flow_end_timestamp":1582770652816,"gateway_source":"message_processor","environment":"env_82hw","client_received_end_timestamp":1582770652814,"organization":"Org_1582769880344","x-apigee.edge.execution.stats.response_flow_start_timestamp":1582770652814,"request_path":"/APP_NAME","gateway_flow_id":"rt-8644-188-1","apiproxy_revision":"1"}
// JSON data sent to AX after obfuscating{"proxy_basepath":"/APP_NAME","x-apigee.edge.execution.stats.request_flow_endtimestamp":1582749361836,"apiproxy":"APP_NAME","x-apigee.edge.is_policy_error":0,"client_sent_start_timestamp":1582749361884,"x-apigee.edge.is_target_error":0,"client_received_start_timestamp":1582749361790,"client_ip":"090cdae81ea6e58e55093f702661cf2325cef6a68aa801f1209e73bb0649c2b931bcad468911da887a42ce1d1daee07b24933e3dbbde6eb7438cfc9020a25445","is_error":false,"x-apigee.edge.stats.steps":"{\"JS1.0\":30}","request_size":0,"x-apigee.intelligence.client_ip_header":"090cdae81ea6e58e55093f702661cf2325cef6a68aa801f1209e73bb0649c2b931bcad468911da887a42ce1d1daee07b24933e3dbbde6eb7438cfc9020a25445","virtual_host":"default","x-apigee.edge.mp_host":"mp","sla":false,"x-apigee.intelligence.service":"{}","client_sent_end_timestamp":1582749361886,"request_uri":"0176937d9c4a33094d3c3f38ac8b15fa05dd6380a6bb544e4002c98de9f27bdbfea754901b0acb487f4980b09f7d312ad1e7027b96b2c8bfd8b9c24e833fbb5a","proxy":"default","proxy_client_ip":"090cdae81ea6e58e55093f702661cf2325cef6a68aa801f1209e73bb0649c2b931bcad468911da887a42ce1d1daee07b24933e3dbbde6eb7438cfc9020a25445","x-apigee.edge.dn.region":"dc-1","apigee.edge.execution.is_apigee_fault":0,"x-apigee.edge.target.latency.stats":"{\"targetList\":[]}","useragent":"Apache-HttpClient/4.3.6 (java 1.5)","proxy_pathsuffix":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","x-apigee.edge.execution.stats.request_flow_start_timestamp":1582749361833,"x_forwarded_for_ip":"090cdae81ea6e58e55093f702661cf2325cef6a68aa801f1209e73bb0649c2b931bcad468911da887a42ce1d1daee07b24933e3dbbde6eb7438cfc9020a25445","x_forwarded_proto":"http","response_status_code":200,"request_verb":"GET","x-apigee.edge.execution.stats.response_flow_end_timestamp":1582749361874,"gateway_source":"message_processor","environment":"env_xj25","client_received_end_timestamp":1582749361821,"organization":"Org_1582749068984","x-apigee.edge.execution.stats.response_flow_start_timestamp":1582749361836,"request_path":"0176937d9c4a33094d3c3f38ac8b15fa05dd6380a6bb544e4002c98de9f27bdbfea754901b0acb487f4980b09f7d312ad1e7027b96b2c8bfd8b9c24e833fbb5a","gateway_flow_id":"rt-6290-57-1","apiproxy_revision":"1"}
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eThis document describes how to enable data obfuscation for Apigee hybrid analytics, a feature available in version 1.2 and newer.\u003c/p\u003e\n"],["\u003cp\u003eData obfuscation utilizes SHA512 hashing to obscure sensitive data fields such as client_id, client_ip, and developer_email before they are sent from the runtime to the control plane.\u003c/p\u003e\n"],["\u003cp\u003eTo enable data obfuscation, set the \u003ccode\u003efeatures.analytics.data.obfuscation.enabled\u003c/code\u003e property to \u003ccode\u003etrue\u003c/code\u003e within your environment's properties, using a PUT request.\u003c/p\u003e\n"],["\u003cp\u003eAfter enabling, hashed data will be displayed in the Apigee hybrid analytics dashboard, although it may take a few minutes for the changes to be visible.\u003c/p\u003e\n"],["\u003cp\u003eThe obfuscated values for the fields sent to analytics are clearly hashed with SHA512 as demonstrated in the example, contrasting with the unhashed, plaintext data from before obfuscation was enabled.\u003c/p\u003e\n"]]],[],null,["# Obfuscating user data for analytics\n\n| You are currently viewing version 1.2 of the Apigee hybrid documentation. **This version is end of life.** You should upgrade to a newer version. For more information, see [Supported versions](/apigee/docs/hybrid/supported-platforms#supported-versions).\n\nThis feature allows you to obscure data before sending it as part of the analytics payload.\nWith this feature, Apigee uses SHA512 to hash the original value before communicating from the runtime\nplane to the control plane.\n| This feature is for Apigee hybrid 1.2 and newer only.\n\nProcedure\n---------\n\nEnable this feature by setting `features.analytics.data.obfuscation.enabled` to **true**.\nWhen using `PUT`, be careful to include the entire set of properties for your environment. PUT overwrites the entire property set each time you issue it. \n\n```\ncurl -v -X PUT \\\n https://apigee.googleapis.com/v1/organizations/YOUR_ORG_NAME/environments/YOUR_ENV_NAME \\\n -H \"Content-Type: application/json\" \\\n -H \"Authorization: Bearer $TOKEN\" \\\n -d '{\n \"name\" : \"YOUR_ENV_NAME\",\n \"properties\" : {\n \"property\" : [ {\n \"name\" : \"features.analytics.data.obfuscation.enabled\",\n \"value\" : \"true\"\n },]\n }\n}'\n```\n\n\nWith obfuscation enabled, Apigee hybrid will hash the following fields with SHA512 at the runtime plane before\nsending the information to analytics backend:\n\n- client_id\n- client_ip\n- developer_email\n- proxy_client_ip\n- proxy_pathsuffix\n- request_urirequest_path\n- target_basepath\n- target_url\n- x_forwarded_for_ip\n- x-apigee.edge.true_client_ip\n- x-apigee.intelligence.client_ip_header\n\nApigee hybrid will hash the following dimension values in custom analytics reports:\n\n- Client ID\n- Client IP Address\n- Developer Email\n- Proxy Client IP\n- Proxy Path Suffix\n- Referred Client IP\n- Request Path\n- Request URI\n- Resolved Client IP\n- Target Base Path\n- Target URL\n- X Forwarded For\n\nSee [Analytics metrics, dimensions, and filters reference](https://docs.apigee.com/api-platform/analytics/analytics-reference#dimensions) for detailed descriptions of analytics dimensions.\n\nViewing obfuscated results\n--------------------------\n\n\nThe obfuscated results display in the Apigee hybrid analytics dashboard. It may take several\nminutes before you see the hashed results in the UI.\n\n| **Note:** Analytics reports will display unhashed data communicated from the runtime plane before you enabled obfuscating or after you disable it. \n\nExample\n-------\n\n\nThe following example shows the data before and after obfuscating: \n\n```scilab\n// JSON data sent to AX before obfuscating\n{\n \"proxy_basepath\":\"/APP_NAME\",\n \"x-apigee.edge.execution.stats.request_flow_endtimestamp\":1582770652814,\n \"apiproxy\":\"APP_NAME\",\n \"x-apigee.edge.is_policy_error\":0,\n \"client_sent_start_timestamp\":1582770652817,\n \"x-apigee.edge.is_target_error\":0,\n \"client_received_start_timestamp\":1582770652813,\n \"client_ip\":\"10.10.0.99\",\n \"is_error\":false,\n \"x-apigee.edge.stats.steps\":\"{\\\"JS1.0\\\":1}\",\n \"request_size\":0,\n \"x-apigee.intelligence.client_ip_header\":\"10.10.0.99\",\n \"virtual_host\":\"default\",\n \"x-apigee.edge.mp_host\":\"mp\",\n \"sla\":false,\n \"x-apigee.intelligence.service\":\"{}\",\n \"client_sent_end_timestamp\":1582770652817,\n \"request_uri\":\"/APP_NAME\",\n \"proxy\":\"default\",\n \"proxy_client_ip\":\"10.10.0.99\",\n \"x-apigee.edge.dn.region\":\"dc-1\",\n \"apigee.edge.execution.is_apigee_fault\":0,\n \"x-apigee.edge.target.latency.stats\":\"{\\\"targetList\\\":[]}\",\n \"useragent\":\"Apache-HttpClient/4.3.6 (java 1.5)\",\n \"proxy_pathsuffix\":\"\",\n \"x-apigee.edge.execution.stats.request_flow_start_timestamp\":1582770652814,\n \"x_forwarded_for_ip\":\"10.10.0.99\",\n \"x_forwarded_proto\":\"http\",\n \"response_status_code\":200,\n \"request_verb\":\"GET\",\n \"x-apigee.edge.execution.stats.response_flow_end_timestamp\":1582770652816,\n \"gateway_source\":\"message_processor\",\n \"environment\":\"env_82hw\",\n \"client_received_end_timestamp\":1582770652814,\n \"organization\":\"Org_1582769880344\",\n \"x-apigee.edge.execution.stats.response_flow_start_timestamp\":1582770652814,\n \"request_path\":\"/APP_NAME\",\n \"gateway_flow_id\":\"rt-8644-188-1\",\n \"apiproxy_revision\":\"1\"\n}\n``` \n\n```scilab\n// JSON data sent to AX after obfuscating\n{\n \"proxy_basepath\":\"/APP_NAME\",\n \"x-apigee.edge.execution.stats.request_flow_endtimestamp\":1582749361836,\n \"apiproxy\":\"APP_NAME\",\n \"x-apigee.edge.is_policy_error\":0,\n \"client_sent_start_timestamp\":1582749361884,\n \"x-apigee.edge.is_target_error\":0,\n \"client_received_start_timestamp\":1582749361790,\n \"client_ip\":\"090cdae81ea6e58e55093f702661cf2325cef6a68aa801f1209e73bb0649c2b931bcad468911da887a42ce1d1daee07b24933e3dbbde6eb7438cfc9020a25445\",\n \"is_error\":false,\n \"x-apigee.edge.stats.steps\":\"{\\\"JS1.0\\\":30}\",\n \"request_size\":0,\n \"x-apigee.intelligence.client_ip_header\":\"090cdae81ea6e58e55093f702661cf2325cef6a68aa801f1209e73bb0649c2b931bcad468911da887a42ce1d1daee07b24933e3dbbde6eb7438cfc9020a25445\",\n \"virtual_host\":\"default\",\n \"x-apigee.edge.mp_host\":\"mp\",\n \"sla\":false,\n \"x-apigee.intelligence.service\":\"{}\",\n \"client_sent_end_timestamp\":1582749361886,\n \"request_uri\":\"0176937d9c4a33094d3c3f38ac8b15fa05dd6380a6bb544e4002c98de9f27bdbfea754901b0acb487f4980b09f7d312ad1e7027b96b2c8bfd8b9c24e833fbb5a\",\n \"proxy\":\"default\",\n \"proxy_client_ip\":\"090cdae81ea6e58e55093f702661cf2325cef6a68aa801f1209e73bb0649c2b931bcad468911da887a42ce1d1daee07b24933e3dbbde6eb7438cfc9020a25445\",\n \"x-apigee.edge.dn.region\":\"dc-1\",\n \"apigee.edge.execution.is_apigee_fault\":0,\n \"x-apigee.edge.target.latency.stats\":\"{\\\"targetList\\\":[]}\",\n \"useragent\":\"Apache-HttpClient/4.3.6 (java 1.5)\",\n \"proxy_pathsuffix\":\"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e\",\n \"x-apigee.edge.execution.stats.request_flow_start_timestamp\":1582749361833,\n \"x_forwarded_for_ip\":\"090cdae81ea6e58e55093f702661cf2325cef6a68aa801f1209e73bb0649c2b931bcad468911da887a42ce1d1daee07b24933e3dbbde6eb7438cfc9020a25445\",\n \"x_forwarded_proto\":\"http\",\n \"response_status_code\":200,\n \"request_verb\":\"GET\",\n \"x-apigee.edge.execution.stats.response_flow_end_timestamp\":1582749361874,\n \"gateway_source\":\"message_processor\",\n \"environment\":\"env_xj25\",\n \"client_received_end_timestamp\":1582749361821,\n \"organization\":\"Org_1582749068984\",\n \"x-apigee.edge.execution.stats.response_flow_start_timestamp\":1582749361836,\n \"request_path\":\"0176937d9c4a33094d3c3f38ac8b15fa05dd6380a6bb544e4002c98de9f27bdbfea754901b0acb487f4980b09f7d312ad1e7027b96b2c8bfd8b9c24e833fbb5a\",\n \"gateway_flow_id\":\"rt-6290-57-1\",\n \"apiproxy_revision\":\"1\"\n}\n```"]]
