Description

This is the current, recommended version of the Skyflow SDK. V2.1.0 brings flexible auth, multi-vault support, native data types, and rich error diagnostics.
Migrating from v1? See the Migration Guide for step-by-step instructions. V1 is in maintenance mode and will reach End of Life on October 31, 2026.

The Skyflow Go SDK is designed to help with integrating Skyflow into a go backend.

Table of Contents
Overview
Install
- Requirements
- Configuration
Quickstart
Upgrade from v1 to v2
Vault
Custom Request Headers
Detect
Connections
- Invoke a Connection
Client management
Authentication & authorization
- Types of credentials
- Generate bearer tokens for authentication & authorization
Logging
- Example: Setting LogLevel to INFO
Error handling
- Catching SkyflowError instances
- Bearer token expiration edge cases
Security
- Reporting a Vulnerability

Overview

Important

This readme documents SDK version 2. For version 1 see the v1 README. For more information on how to migrate see docs/migrate_to_v2.md.

Authenticate using a Skyflow service account and generate bearer tokens for secure access.
Perform Vault API operations such as inserting, retrieving, and tokenizing sensitive data with ease.
Invoke connections to third-party APIs without directly handling sensitive data, ensuring compliance and data protection.
See the v1 README for documentation related to v1.

Install

Requirements

go 1.22.0 and above

Configuration

Make sure your project is using Go Modules (it will have a go.mod file in its root if it already is):

gomodinit

Then, reference skyflow-go in a Go program with import:

import (
"github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)

Alternatively, go get <package_name> can also be used to download the required dependencies

Quickstart

Get started quickly with the essential steps: authenticate, initialize the client, and perform a basic vault operation. This section provides a minimal setup to help you integrate the SDK efficiently.

Authenticate

You can use an API key or a bearer token to directly authenticate and authorize requests with the SDK. Use API keys for long-term service authentication. Use bearer tokens for optimal security.

API Key

skyflowCredentials:= common.Credentials{ApiKey: "<YOUR_API_KEY>"} // Replace <API_KEY> with your actual API key

Bearer Token (static)

skyflowCredentials:= common.Credentials{Token: "<BEARER_TOKEN>"}

For authenticating via generated bearer tokens including support for scoped tokens, context-aware access tokens, and more, refer to the Authenticate with bearer tokens section.

Initialize the client

To get started, you must first initialize the skyflow client. While initializing the skyflow client, you can specify different types of credentials.

import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
funcmain() {
creds:= common.Credentials{
Path: "<YOUR_CREDENTIALS_FILE_PATH_1>"
} // Replace with the path to the credentials filevaultConfig1:= common.VaultConfig{
VaultId: "<VAULT_ID1>", ClusterId: "<CLUSTER_ID1>", Env: common.DEV, Credentials: creds
} // Replace with the Cluster and Vault ID of the first vault, Set the environment (e.g., DEV, STAGE, PROD)vararr []common.VaultConfigarr=append(arr, vaultConfig1)
// Create a Skyflow client and add vault configurationsskyflowClient, err:=client.NewSkyflow(
client.WithVaults(arr...), // Add the first vault configurationclient.WithCredentials(common.Credentials{
Token: "<BEARER_TOKEN>"
}), // Add the first vault configurationclient.WithLogLevel(logger.DEBUG), // Enable debugging for detailed logs
)
}

See docs/advanced_initialization.md for advanced initialization examples including multiple vaults and different credential types.

Insert data into the vault, get tokens back

To insert data into your vault, use the Insert method. The InsertRequest struct creates an insert request, which includes the values to be inserted as a list of records. Below is a simple example to get started. For advanced options, check out Insert data into the vault section.

/** * This example demonstrates how to insert sensitive data (e.g., card information) into a Skyflow vault using the Skyflow client. * * 1. Initializes the Skyflow client. * 2. Prepares a record with sensitive data (e.g., card number and cardholder name). * 3. Creates an insert request for inserting the data into the Skyflow vault. * 4. Prints the response of the insert operation. */package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
funcmain() {
// Initialize Skyflow client// Step 1: Initialize data to be inserted into the Skyflow vaultctx:=context.TODO() // Create a context for the operation.// Create a slice to hold the data records for insertion.values:=make([]map[string]interface{}, 0)
// Add a record with sensitive fields (e.g., card number and cardholder name).values=append(values, map[string]interface{}{
"card_number": "4111111111111111",// Replace with actual card number (sensitive data)"cardholder_name": "john doe", // Replace with the actual cardholder name (sensitive data)
})
insertRequest:= common.InsertRequest{
Table: "table1", // Specify the table in the vault where the data will be insertedValues: values, // Attach the data (records) to be inserted
}
insertOptions:= common.InsertOptions{
ReturnTokens: true, // Request tokenized values to be returned in the response.
}
// Step 2: Obtain a Vault service instance for performing operations.service, serviceError:=skyflowClient.Vault("9f27764a10f7946fe56b3258e117") // Replace the vault ID "9f27764a10f7946fe56b3258e117" with your actual Skyflow vault IDifserviceError!=nil {
// Handle errors while getting the vault service instance.fmt.Println("Error obtaining Vault service:", serviceError)
}
// Step 3: Perform the insert operation using the Skyflow clientinsert, err4:=service.Insert(ctx, insertRequest, insertOptions)
iferr4!=nil {
// Step 4: Handle any errors that occur during the insert operation.fmt.Println("Error occurred: ", *err4)
} else {
// Step 5: Print the response from the insert operation.fmt.Println("Insert Response: ", insert)
}
}

Skyflow returns tokens for the record that was just inserted.

Insert Response: {
"InsertedFields": [{
"card_number": "5484-7829-1702-9110",
"RequestIndex": "0",
"SkyflowId": "9fac9201-7b8a-4446-93f8-5244e1213bd1",
"cardholder_name": "b2308e2a-c1f5-469b-97b7-1f193159399b",
}],
"Errors": []
}

Upgrade from v1 to v2

Upgrade from skyflow-go v1 using the dedicated guide in docs/migrate_to_v2.md.

Vault

The Vault module performs operations on the vault, including inserting records, detokenizing tokens, and retrieving tokens associated with a SkyflowId.

Insert data into the vault

Apart from using the Insert method to insert data into your vault covered in Quickstart, you can also specify options in InsertRequest, such as returning tokenized data, upserting records, or continuing the operation in case of errors.

Construct an insert request

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
/** * Example program to demonstrate inserting data into a Skyflow vault, along with corresponding InsertRequest schema. * */funcmain() {
// Initialise Skyflow client// Step 1: Prepare the data to be inserted into the Skyflow vault.ctx:=context.TODO() // Create a context for the operation.// Create the first record with field names and their respective valuesvalues:=make([]map[string]interface{}, 0)
// Add the first record with field names and their respective values.values=append(values, map[string]interface{}{
"<FIELD_NAME1_1>": "<VALUE_1>", // Replace with actual field name and value.
})
// Create the second record with field names and their respective valuesvalues=append(values, map[string]interface{}{
"<FIELD_NAME_2>": "<VALUE_1>", // Replace with actual field name and value.
})
// Step 2: Build an InsertRequest object with the table name and the data to insertinsertRequest:= common.InsertRequest{
Table: "<TABLE_NAME>", // Replace with the actual table name in your Skyflow vault.Values: values, // Attach the data to be inserted.
}
// Step 3: Use the Skyflow client to perform the insert operation//Obtain a Vault service instance for performing operations. service, err:=skyflowClient.Vault("<VAULT_ID>") // Replace <VAULT_ID> with your actual vault IDiferr!=nil {
// Handle errors while getting the vault service instance.fmt.Println("Error obtaining Vault service:", err)
}
// Step 4: Perform the insert operation using the Vault service.insert, errs:=service.Insert(ctx, insertRequest)
iferrs!=nil {
// Handle any exceptions that occur during the insert operationfmt.Println("Error occurred while inserting data: ", *err4)
} else {
// Print the response from the insert operationfmt.Println("Insert Response: ", insert)
}
}

InsertOptions fields:

Field	Type	Description
`ReturnTokens`	`bool`	Return tokens for the inserted records.
`Upsert`	`string`	Column name to use for upsert (must be unique in schema).
`ContinueOnError`	`bool`	Continue inserting remaining records if one fails.
`Homogeneous`	`bool`	Set to `true` when all records in the batch have identical fields; enables a more efficient bulk-insert path.
`TokenMode`	`BYOT`	Bring-Your-Own-Token mode: `ENABLE`, `DISABLE`, `ENABLE_STRICT`.
`Tokens`	`[]map[string]interface{}`	BYOT tokens to associate with inserted records.
`CustomHeaders`	`map[CustomHeaderKey]string`	Request-level custom headers for this call.

Insert example with `ContinueOnError` option

Set the ContinueOnError flag to true to allow insert operations to proceed despite encountering partial errors.

Tip

See the full example in the samples directory: insert_records.go

/** * This example demonstrates how to insert multiple records into a Skyflow vault using the Skyflow client. * * 1. Initializes the Skyflow client. * 2. Prepares multiple records with sensitive data (e.g., card number and cardholder name). * 3. Creates an insert request with the records to insert into the Skyflow vault. * 4. Specifies options to continue on error and return tokens. * 5. Prints the response of the insert operation. */package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
funcmain() {
// Initialize Skyflow client// Step 1: Initialize a list to hold the data records to be inserted into the vaultctx:=context.TODO() // Create a context for the operation.// Create a slice to hold the data records for insertion.insertData:=make([]map[string]interface{}, 0)
// Step 2: Create the first record with card number and cardholder nameinsertRecord1:=map[string]interface{}{
"card_number": "4111111111111111", // Replace with the actual card number."cardholder_name": "john doe", // Replace with the actual cardholder name.
}
// Step 3: Create the second record with card number and cardholder nameinsertRecord2:=map[string]interface{}{
"card_number": "42222222222222222", // Replace with the actual card number."cardholder_name": "john doe", // Replace with the actual cardholder name.
}
// Step 4: Add the records to the insertData mapinsertData=append(insertData, insertRecord1)
insertData=append(insertData, insertRecord2)
// Step 5: Build the InsertRequest object with the data records to insertinsertRequest:= common.InsertRequest{
Table: "table1", // Replace with the actual table name in your Skyflow vault.Values: insertData, // Attach the prepared data for insertion.
}
// Step 6: Create insert options to support the continue on error insertOptions:= common.InsertOptions{
ContinueOnError: true, // Specify to continue inserting records even if an error occurs for some recordsReturnTokens: true, // Specify if tokens should be returned upon successful insertion
}
// Step 7: Obtain a Vault service instance for performing operations.service, serviceError:=skyflowClient.Vault("9f27764a10f7946fe56b3258e117") // Replace with your actual vault ID.ifserviceError!=nil {
// Handle errors while getting the vault service instance.fmt.Println("Error obtaining Vault service:", serviceError)
}
// Step 8: Perform the insert operation using the Vault service.insert, err4:=service.Insert(ctx, insertRequest , insertOptions)
iferr4!=nil {
// Handle any errors that occur during the insert operation.fmt.Println("Error occurred: ", *err4)
} else {
// Print the response from the insert operation.fmt.Println("Insert Response: ", insert)
}
}

Sample response :

{
"InsertedFields": [{
"card_number": "5484-7829-1702-9110",
"RequestIndex": "0",
"SkyflowId": "9fac9201-7b8a-4446-93f8-5244e1213bd1",
"cardholder_name": "b2308e2a-c1f5-469b-97b7-1f193159399b",
}],
"Errors": [{
"RequestIndex": "1",
"error": "Insert failed. Column card_numbe is invalid. Specify a valid column."
}]
}

Upsert request

Turn an insert into an update-or-insert operation using the upsert option. The vault checks for an existing record with the same value in the specified column. If a match exists, the record updates; otherwise, a new record inserts.

Note

The column used for upsert must have the unique constraint configured in the vault.

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
/** * This example demonstrates how to insert or upsert a record into a Skyflow vault using the Skyflow client, with the option to return tokens. * * 1. Initializes the Skyflow client. * 2. Prepares a record to insert or upsert (e.g., cardholder name). * 3. Creates an insert request with the data to be inserted or upserted into the Skyflow vault. * 4. Specifies the field (cardholder_name) for upsert operations. * 5. Prints the response of the insert or upsert operation. */funcmain() {
// Initialize Skyflow client// Step 1: Initialize a list to hold the data records for the insert/upsert operationupsertData:=make([]map[string]interface{}, 0)
ctx:=context.TODO()
// Step 2: Create a record with the field 'cardholder_name' to insert or upsertupsertRecord:=map[string]interface{}{
"cardholder_name": "jane doe", // Replace with the actual cardholder name
}
// Step 3: Add the record to the upsertData listupsertData=append(upsertData, upsertRecord)
// Step 4: Build the InsertRequest object with the upsertDatainsertRequest:= common.InsertRequest{
Table: "table1", // Specify the table in the vault where data will be inserted/upsertedValues: upsertData, // Attach the data records to be inserted/upserted
}
// Step 5: Create the insert options object insertOptions:= common.InsertOptions{
ReturnTokens: true, // Specify if tokens should be returned upon successful operationUpsert: "cardholder_name", // Specify the field to be used for upsert operations (e.g., cardholder_name)
}
// Step 5: Obtain a Vault service instance for performing operations.service, serviceError:=skyflowClient.Vault("<VAULT_ID>")
ifserviceError!=nil {
fmt.Println("Error obtaining Vault service:", serviceError)
}
// Step 6: Perform the insert/upsert operation using the Skyflow clientinsert, err4:=service.Insert(ctx, insertRequest, insertOptions)
iferr4!=nil {
fmt.Println("Error occurred", *err4)
} else {
fmt.Println("RESPONSE:", insert)
}
}

Sample response :

{
"InsertedFields": [{
"SkyflowId": "9fac9201-7b8a-4446-93f8-5244e1213bd1",
"cardholder_name": "73ce45ce-20fd-490e-9310-c1d4f603ee83"
}],
"Errors": []
}

Detokenize

To retrieve tokens from your vault, use the Detokenize method. The DetokenizeRequest struct requires a list of detokenization data as input. Additionally, you can provide optional parameters, such as the redaction type and the option to continue on error.

Construct a detokenize request

package vaultapi
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
/** * This example demonstrates how to detokenize sensitive data from tokens stored in a Skyflow vault, along with corresponding DetokenizeRequest schema. * */funcmain() {
// Configure the vaults and Skyflow clientctx:=context.TODO() // Create a context for the detokenization operation.// Step 1: Create the DetokenizeRequest with tokens and per-token redaction typesdetokenizeRequest:= common.DetokenizeRequest{
DetokenizeData: []common.DetokenizeData{
{Token: "<TOKEN1>", RedactionType: common.PLAIN_TEXT},
{Token: "<TOKEN2>", RedactionType: common.PLAIN_TEXT},
},
}
// Step 2: Create the DetokenizeOptions object with ContinueOnErroroptions:= common.DetokenizeOptions{
ContinueOnError: true, // Continue even if one token cannot be detokenized.
}
// Step 3: Obtain a Vault service instance for performing operations.service, serviceError:=skyflowClient.Vault("<VAULT_ID>") // Replace <VAULT_ID> with the specific vault ID.ifserviceError!=nil {
// Handle errors while getting the vault service instance.fmt.Println("Error obtaining Vault service:", serviceError)
}
// Step 4: Call the Skyflow vault to detokenize the provided tokensres, err:=service.Detokenize(ctx, detokenizeRequest, options)
iferr!=nil {
// Step 5: Handle any errors that occur during the detokenization process.fmt.Println("Error occurred ", err)
} else {
// Step 6: Print the detokenization response.fmt.Println("RESPONSE: ", res)
}
}

DetokenizeOptions fields:

Field	Type	Description
`ContinueOnError`	`bool`	Continue detokenizing if one token fails. Defaults to `true`.
`DownloadUrl`	`bool`	Return a pre-signed download URL for file-type tokens instead of inline data.
`CustomHeaders`	`map[CustomHeaderKey]string`	Request-level custom headers for this call.

Notes:

RedactionType is set per token on DetokenizeData, not on the request.
ContinueOnError defaults to true.

Tip

See the full example in the samples directory: detokenize.go

package vaultapi
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
/** * This example demonstrates how to detokenize sensitive data from tokens stored in a Skyflow vault. * * 1. Initializes the Skyflow client. * 2. Creates a list of tokens (e.g., credit card tokens) that represent the sensitive data. * 3. Builds a detokenization request using the provided tokens and specifies how the redacted data should be returned. * 4. Calls the Skyflow vault to detokenize the tokens and retrieves the detokenized data. * 5. Prints the detokenization response, which contains the detokenized values or errors. */funcmain() {
// Initialize Skyflow clientctx:=context.TODO() // Create a context for the detokenization operation.// Step 1: Create the DetokenizeRequest with tokens and per-token redaction types.detokenizeRequest:= common.DetokenizeRequest{
DetokenizeData: []common.DetokenizeData{
{Token: "9738-1683-0486-1480", RedactionType: common.PLAIN_TEXT},
{Token: "6184-6357-8409-6668", RedactionType: common.PLAIN_TEXT},
{Token: "4914-9088-2814-3840", RedactionType: common.PLAIN_TEXT},
},
}
// Step 3: Obtain a Vault service instance for performing operations.service, serviceError:=skyflowClient.Vault("9f27764a10f7946fe56b3258e117") // Replace "9f27764a10f7946fe56b3258e117" with your actual Skyflow vault IDifserviceError!=nil {
// Handle errors while getting the vault service instance.fmt.Println("Error obtaining Vault service:", serviceError)
}
options:= common.DetokenizeOptions{
ContinueOnError: false, // Continue even if one token cannot be detokenized.
}
// Step 4: Perform the detokenization operation using the Vault service.res, errDetokenize:=service.Detokenize(ctx, detokenizeRequest, options)
iferrDetokenize!=nil {
// Step 5: Handle any errors that occur during the detokenization process.fmt.Println("Error occurred: ", errDetokenize)
} else {
// Step 6: Print the detokenization response.fmt.Println("RESPONSE: ", res)
}
}

Sample response:

{
"DetokenizedFields": [{
"token": "9738-1683-0486-1480",
"value": "4111111111111115",
"type": "STRING"
}, {
"token": "6184-6357-8409-6668",
"value": "4111111111111119",
"type": "STRING"
}, {
"token": "4914-9088-2814-3840",
"value": "4111111111111118",
"type": "STRING"
}],
"Errors": []
}

Tip

See the full example with ContinueOnError in the samples directory: detokenize.go

package vaultapi
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
/** * This example demonstrates how to detokenize sensitive data (e.g., credit card numbers) from tokens in a Skyflow vault. * * 1. Initializes the Skyflow client. * 2. Creates a list of tokens (e.g., credit card tokens) to be detokenized. * 3. Builds a detokenization request with the tokens and specifies the redaction type for the detokenized data. * 4. Calls the Skyflow vault to detokenize the tokens and retrieves the detokenized data. * 5. Prints the detokenization response, which includes the detokenized values or errors. */funcmain() {
// Initialize Skyflow client// Step 1: Create the DetokenizeRequest with tokens and per-token redaction typesrequest:= common.DetokenizeRequest{
DetokenizeData: []common.DetokenizeData{
{Token: "9738-1683-0486-1480", RedactionType: common.PLAIN_TEXT},
{Token: "6184-6357-8409-6668", RedactionType: common.PLAIN_TEXT},
{Token: "4914-9088-2814-3840", RedactionType: common.PLAIN_TEXT},
},
}
options:= common.DetokenizeOptions{
ContinueOnError: false, // Continue even if one token cannot be detokenized.
}
ctx:=context.TODO() // Create a context for the detokenization operation.// Step 3: Obtain a Vault service instance for performing operations.service, serviceError:=skyflowClient.Vault("9f27764a10f7946fe56b3258e117") // Replace "9f27764a10f7946fe56b3258e117" with your actual Skyflow vault IDifserviceError!=nil {
// Handle errors while getting the vault service instance.fmt.Println("Error obtaining Vault service:", serviceError)
}
// Step 4: Call the Skyflow vault to detokenize the provided tokensres, errDetokenize:=service.Detokenize(ctx, request, options)
iferrDetokenize!=nil {
// Step 5: Handle any errors that occur during the detokenization process.fmt.Println("Error occurred ", errDetokenize)
} else {
// Step 6: Print the detokenization response, which contains the detokenized data or errors fmt.Println("RESPONSE: ", res)
}
}

Sample response:

{
"DetokenizedFields": [{
"token": "9738-1683-0486-1480",
"value": "4111111111111115",
"type": "STRING"
}, {
"token": "6184-6357-8409-6668",
"value": "4111111111111119",
"type": "STRING"
}],
"Errors": [{
"token": "4914-9088-2814-384",
"error": "Token Not Found"
}]
}

Tokenize

Tokenization replaces sensitive data with unique identifier tokens. This approach protects sensitive information by securely storing the original data while allowing the use of tokens within your application.

To tokenize data, use the Tokenize method. The TokenizeRequest creates a tokenize request. In this request, you specify the values parameter, which is a list of ColumnValue objects. Each ColumnValue contains two properties: Value and ColumnGroup.

Constructing your Tokenize request

package vaultapi
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
/** * This example demonstrates how to tokenize sensitive data (e.g., credit card information) * using the Skyflow client, along with corresponding TokenizeRequest schema. */funcmain() {
// Initialize Skyflow client// Step 1: Create a TokenizeRequest array to hold sensitive datactx:=context.TODO()
varreqArray []common.TokenizeRequest// Step 2: Create column values for each sensitive data field (e.g., card number and cardholder name)columnValue1:= common.TokenizeRequest{
ColumnGroup: "<COLUMN_GROUP>", Value: "<VALUE>", // Replace <VALUE> and <COLUMN_GROUP> with actual data
}
columnValue2:= common.TokenizeRequest{
ColumnGroup: "<COLUMN_GROUP>", Value: "<VALUE>", } // Replace <VALUE> and <COLUMN_GROUP> with actual data// Add the created column values to the TokenizeRequest arrayreqArray=append(reqArray, columnValue1)
reqArray=append(reqArray, columnValue2)
// Step 3: Access the vaultservice, serviceErr:=skyflowClient.Vault("<VAULT_ID>")
ifserviceErr!=nil {
// Handle error accessing the vaultfmt.Println(serviceErr)
} else {
// Step 4: Call the Skyflow vault to tokenize the sensitive datares, tokenizeErr:=service.Tokenize(ctx, reqArray)
iftokenizeErr!=nil {
// Step 5: Handle error during the tokenization processfmt.Println("Error occurred: ", tokenizeErr)
} else {
// Step 6: Print the tokenization response, which contains the generated tokens or errors fmt.Println("RESPONSE: ", res)
}
}
}

Tip

See the full example in the samples directory: tokenize_records.go

import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to tokenize sensitive data (e.g., credit card information) using the Skyflow client. * * 1. Initializes the Skyflow client. * 2. Creates a column value for sensitive data (e.g., credit card number). * 3. Builds a tokenize request with the column value to be tokenized. * 4. Sends the request to the Skyflow vault for tokenization. * 5. Prints the tokenization response, which includes the token or errors. **/funcmain() {
// Initialize Skyflow client// Step 1: Initialize a array of column values to be tokenized (replace with actual sensitive data)ctx:=context.TODO()
varreqArray []common.TokenizeRequest// Step 2: Create a column value for the sensitive data (e.g., card number with its column group)columnValue:= common.TokenizeRequest{
ColumnGroup: "card_number_cg", // Replace with actual column group nameValue: "4111111111111111", // Replace with the actual sensitive data (e.g., card number)
}
//Step 3: Add the created column value to the listreqArray=append(reqArray, columnValue)
// Access the vaultservice, serviceErr:=skyflowClient.Vault("9f27764a10f7946fe56b3258e117") // Replace "9f27764a10f7946fe56b3258e117" with your actual Skyflow vault IDifserviceErr!=nil {
// Handle error accessing the vaultfmt.Println(serviceErr)
} else {
// Step 4 : Call the Skyflow vault to tokenize the sensitive datares, tokenizeErr:=service.Tokenize(ctx, reqArray)
iftokenizeErr!=nil {
// Handle error during the tokenization processfmt.Println("Error occurred ", tokenizeErr)
} else {
// Step 5: Print the tokenization response, which contains the generated tokens or errorsfmt.Println("RESPONSE: ", res)
}
}
}

Sample response:

{
"tokens": [5479-4229-4622-1393]
}

Get

To retrieve data using Skyflow IDs or unique column values, use the Get method. The GetRequest struct creates a get request, where you specify parameters such as the table name, redaction type, Skyflow IDs, column names, column values, and whether to return tokens.

Note

You can't use both Skyflow IDs and column name/value pairs in the same request.

Constructing your get request:

package vaultapi
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to retrieve data from the Skyflow vault using different methods, * along with corresponding GetRequest schema. */funcmain() {
// Initialize Skyflow client// Step 1: Initialize a array of Skyflow IDs to retrieve records (replace with actual Skyflow IDs)ctx:=context.TODO() // Prepare the context for the requestids:= []string{"<SKYFLOW_ID_1>", "<SKYFLOW_ID_2>"} // Replace with actual Skyflow ID// Step 2: Create a GetRequest and GetOptions to retrieve records by Skyflow ID without returning tokensgetRequest:= common.GetRequest{
Table: "<TABLE_NAME>", // Replace with the actual table nameIds: ids,
}
options:= common.GetOptions{
ReturnTokens: false, // Set to false to avoid returning tokensRedactionType: common.PLAIN_TEXT, // Redact data as plain text
}
// Initialize the Skyflow service and replace <VAULT_ID> with your actual Skyflow vault IDservice, serviceError:=skyflowClient.Vault("<VAULT_ID>")
ifserviceError!=nil {
// Handle any errors during initializationfmt.Println("Error occurred while initializing Skyflow service:", serviceError)
}
// Send the request to the Skyflow vault and retrieve the recordsres, getErr:=service.Get(ctx, getRequest, options)
ifgetErr!=nil {
// Handle any errors during the retrieval processfmt.Println("Error occurred while retrieving records by ID:", getErr)
} else {
// Print the retrieved recordsfmt.Println("Response for records by ID:", res.Data)
}
// Step 3: Create another GetRequest and GetOptions to retrieve records by Skyflow ID with tokenized valuesgetTokensRequest:= common.GetRequest{
Table: "<TABLE_NAME>", // Replace with the actual table nameIds: ids, // Replace with actual Skyflow IDs
}
options:= common.GetOptions{
ReturnTokens: true, // Set to true to return tokenized values
}
// Send the request to the Skyflow vault and retrieve the tokenized recordsresWithTokens, getErrWithTokens:=service.Get(ctx, getTokensRequest, options)
ifgetErrWithTokens!=nil {
// Handle any errors during the retrieval processfmt.Println("Error occurred while retrieving tokenized records:", getErrWithTokens)
} else {
// Print the retrieved tokenized recordsfmt.Println("Response for tokenized records:", resWithTokens.Data)
}
// Step 4: Retrieve records based on specific column values// ColumnName and ColumnValues belong on GetOptions, not GetRequestcolumnValues:= []string{"<COLUMN_VALUE_1>", "<COLUMN_VALUE_2>"}
getByColumnResponse, getErrByColumn:=service.Get(ctx, common.GetRequest{
Table: "<TABLE_NAME>",
}, common.GetOptions{
ColumnName: "<COLUMN_NAME>", // Column to filter by (must be unique in schema)ColumnValues: columnValues, // Values to match in that columnRedactionType: common.PLAIN_TEXT,
})
ifgetErrByColumn!=nil {
// Handle any errors during the retrieval processfmt.Println("Error occurred while retrieving records by column values:", getErrByColumn)
} else {
// Print the retrieved records filtered by column valuesfmt.Println("Response for records by column values:", getByColumnResponse.Data)
}
}

Get by skyflow IDs

Retrieve specific records using SkyflowIds. Ideal for fetching exact records when IDs are known.

Tip

See the full example in the samples directory: get_records.go

package vaultapi
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to retrieve data from the Skyflow vault using a list of Skyflow IDs. * * 1. Initializes the Skyflow client with a given vault ID. * 2. Creates a request to retrieve records based on Skyflow IDs. * 3. Specifies that the response should not return tokens. * 4. Uses plain text redaction type for the retrieved records. * 5. Prints the response to display the retrieved records. */funcmain() {
// Initialize Skyflow client// Step 1: Initialize a list of Skyflow IDs (replace with actual Skyflow IDs)ids:= []string{
"a581d205-1969-4350-acbe-a2a13eb871a6", // Replace with actual Skyflow ID"5ff887c3-b334-4294-9acc-70e78ae5164a", // Replace with actual Skyflow ID
}
// Step 2: Create a GetRequest and GetOptions to retrieve records based on Skyflow IDs// The request specifies:// - `ids`: The list of Skyflow IDs to retrieve// - `table`: The table from which the records will be retrievedgetRequest:= common.GetRequest{
Table: "table1", // Replace with the actual table nameIds: ids,
}
// The options specifies:// - `ReturnTokens`: Set to false, meaning tokens will not be returned in the response// - `RedactionType`: Set to PLAIN_TEXT, meaning the retrieved records will have data redacted as plain textgetOptions:= common.GetOptions{
ReturnTokens: false, // Tokens will not be returnedRedactionType: common.PLAIN_TEXT, // Data will be redacted as plain text
} // Initialize the Skyflow service// Replace <VAULT_ID> with your actual Skyflow vault IDservice, serviceError:=skyflowClient.Vault("<VAULT_ID>")
ifserviceError!=nil {
// Step 4: Handle any errors that occur during the initialization processfmt.Println("Error occurred while initializing Skyflow service:", serviceError)
}
ctx:=context.TODO()
// Step 3: Send the request to the Skyflow vault and retrieve the recordsres, getErr:=service.Get(ctx, getRequest, getOptions)
ifgetErr!=nil {
// Step 4: Handle any errors that occur during the data retrieval processfmt.Println("Error occurred while retrieving records:", getErr)
} else {
// Step 5: Print the retrieved records from the responsefmt.Println("Response:", res.Data)
}
}

Sample response:

{
"Data": [{
"card_number": "4555555555555553",
"email": "john.doe@gmail.com",
"name": "john doe",
"SkyflowId": "a581d205-1969-4350-acbe-a2a13eb871a6",
}, {
"card_number": "4555555555555559",
"email": "jane.doe@gmail.com",
"name": "jane doe",
"SkyflowId": "5ff887c3-b334-4294-9acc-70e78ae5164a",
}],
"Errors": []
}

Get tokens

Return tokens for records. Ideal for securely processing sensitive data while maintaining data privacy.

Tip

See the full example in the samples directory: get_records.go

/** * This example demonstrates how to retrieve data from the Skyflow vault and return tokens along with the records. * * 1. Initializes the Skyflow client with a given vault ID. * 2. Creates a request to retrieve records based on Skyflow IDs and ensures tokens are returned. * 3. Prints the response to display the retrieved records along with the tokens. */funcmain() {
// Initialize Skyflow client// Step 1: Initialize a list of Skyflow IDs (replace with actual Skyflow IDs)ids:= []string{
"a581d205-1969-4350-acbe-a2a13eb871a6", // Replace with actual Skyflow ID"5ff887c3-b334-4294-9acc-70e78ae5164a", // Replace with actual Skyflow ID
}
// Step 2: Create a GetRequest to retrieve records based on Skyflow IDs// The request specifies:// - `ids`: The list of Skyflow IDs to retrieve// - `table`: The table from which the records will be retrievedgetRequest:= common.GetRequest{
Table: "table1", // Replace with the actual table nameIds: ids,
}
// Specify options for the request// - `returnTokens`: Set to true, meaning tokens will be included in the response	getOptions:= common.GetOptions{
ReturnTokens: true, // Tokens will be returned
}
// Prepare the context for the requestctx:=context.TODO()
// Initialize the Skyflow service// Replace <VAULT_ID> with your actual Skyflow vault IDservice, serviceError:=skyflowClient.Vault("<VAULT_ID>")
ifserviceError!=nil {
// Handle any errors that occur during the initialization processfmt.Println("Error occurred while initializing Skyflow service:", serviceError)
}
// Step 3: Send the request to the Skyflow vault and retrieve the records with tokensres, getErr:=service.Get(ctx, getRequest, getOptions)
ifgetErr!=nil {
// Step 4: Handle any errors that occur during the data retrieval processfmt.Println("Error occurred while retrieving records:", getErr)
} else {
// Step 5: Print the retrieved records from the responsefmt.Println("Response:", res.Data)
}
}

Sample response:

{
"Data": [{
"card_number": "3998-2139-0328-0697",
"email": "c9a6c9555060@82c092e7.bd52",
"name": "82c092e7-74c0-4e60-bd52-c9a6c9555060",
"SkyflowId": "a581d205-1969-4350-acbe-a2a13eb871a6",
}, {
"card_number": "3562-0140-8820-7499",
"email": "6174366e2bc6@59f82e89.93fc",
"name": "59f82e89-138e-4f9b-93fc-6174366e2bc6",
"SkyflowId": "5ff887c3-b334-4294-9acc-70e78ae5164a",
}],
"Errors": []
}

Get By column name and column values

Retrieve records by unique column values. Ideal for querying data without knowing Skyflow IDs, using alternate unique identifiers.

Tip

See the full example in the samples directory: get_column_values.go

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to retrieve data from the Skyflow vault based on column values. * * 1. Initializes the Skyflow client with a given vault ID. * 2. Creates a request to retrieve records based on specific column values (e.g., email addresses). * 3. Prints the response to display the retrieved records after redacting sensitive data based on the specified redaction type. */funcmain() {
// Initialize Skyflow client// Step 1: Initialize a list of column values (email addresses in this case)columnValues:= []string{"john.doe@gmail.com", "jane.doe@gmail.com"} // Replace with actual values// Step 2: Create a GetRequest and GetOptions to retrieve records based on column values// ColumnName and ColumnValues are set on GetOptions, not GetRequestrequest:= common.GetRequest{
Table: "table1", // Replace with the actual table name
}
options:= common.GetOptions{
ColumnName: "email", // The column to filter by (must be unique in schema)ColumnValues: columnValues, // The list of column values to matchRedactionType: common.PLAIN_TEXT,
}
// Set up the Skyflow vault serviceservice, serviceError:=skyflowClient.Vault("<VAULT_ID>") // Replace <VAULT_ID> with the actual vault IDifserviceError!=nil {
fmt.Println(serviceError) // Print any errors that occur during service initialization
}
// Define the context for the API callctx:=context.TODO() // Using context to manage the API request lifecycle// Step 3: Send the Get request to the Skyflow vault and retrieve the recordsresponse, getErr:=service.Get(ctx, request, options)
ifgetErr!=nil {
// Step 4: Handle any errors that occur during the data retrieval processfmt.Println("Error occurred", getErr)
} else {
// Print the response to display the retrieved recordsfmt.Println("RESPONSE:", response.Data)
}
}

Sample response:

{
"Data": [{
"card_number": "4555555555555553",
"email": "john.doe@gmail.com",
"name": "john doe",
"SkyflowId": "a581d205-1969-4350-acbe-a2a13eb871a6",
}, {
"card_number": "4555555555555559",
"email": "jane.doe@gmail.com",
"name": "jane doe",
"SkyflowId": "5ff887c3-b334-4294-9acc-70e78ae5164a",
}],
"Errors": []
}

`GetOptions` fields

Field	Type	Description
`RedactionType`	`RedactionType`	How to display sensitive data (`PLAIN_TEXT`, `MASKED`, `REDACTED`, `DEFAULT`).
`ReturnTokens`	`bool`	Return tokens instead of plain-text values.
`ColumnName`	`string`	Filter by this column (must be unique in schema). Use with `ColumnValues`.
`ColumnValues`	`[]string`	Values to match in `ColumnName`. Cannot be combined with `Ids`.
`Fields`	`[]string`	Return only these specific fields.
`Offset`	`string`	Pagination offset.
`Limit`	`string`	Pagination limit.
`OrderBy`	`OrderByEnum`	Sort order: `ASCENDING`, `DESCENDING`, or `NONE`.
`DownloadUrl`	`bool`	Return a pre-signed download URL for file-type columns.
`CustomHeaders`	`map[CustomHeaderKey]string`	Request-level custom headers for this call.

Redaction types

Redaction types determine how sensitive data is displayed when retrieved from the vault.

Available Redaction Types

DEFAULT: Applies the vault-configured default redaction setting.
REDACTED: Completely removes sensitive data from view.
MASKED: Partially obscures sensitive information.
PLAIN_TEXT: Displays the full, unmasked data.

Choosing the Right Redaction Type

Use REDACTED for scenarios requiring maximum data protection to prevent exposure of sensitive information.
Use MASKED to provide partial visibility of sensitive data for less critical use cases.
Use PLAIN_TEXT for internal, authorized access where full data visibility is necessary.

Update

To update data in your vault, use the Update method. The UpdateRequest struct creates an update request, where you specify parameters such as the table name, data (as a map of key-value pairs), tokens, ReturnTokens, and TokenMode. If ReturnTokens is set to true, Skyflow returns tokens for the updated records. If ReturnTokens is set to false, Skyflow returns IDs for the updated records.

Construct an update request

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to update records in the Skyflow vault by providing new data and/or tokenized values, along with corresponding UpdateRequest schema. * */funcmain() {
// Initialize Skyflow client// Step 1: Prepare the data to update in the vault — include SkyflowId as a key in the mapdata:=map[string]interface{}{
"SkyflowId": "<SKYFLOW_ID>", // Skyflow ID for identifying the record to update"<COLUMN_NAME_1>": "<COLUMN_VALUE_1>", // Column name and new value"<COLUMN_NAME_2>": "<COLUMN_VALUE_2>", // Column name and new value
}
// Step 2: Optionally provide BYOT tokens for specific columnstokens:=map[string]interface{}{
"<COLUMN_NAME_2>": "<TOKEN_VALUE_2>",
}
// Define the context for the API callctx:=context.TODO() // Using context to manage the API request lifecycle// Step 3: Create an UpdateRequest to specify the update operationupdateRequest:= common.UpdateRequest{
Table: "<TABLE_NAME>", // Replace with the actual table nameData: data, // The data to update; SkyflowId identifies the recordTokens: tokens, // Optional: BYOT tokens for specific columns
}
updateOptions:= common.UpdateOptions{
ReturnTokens: true, // Specify whether to return tokens in the responseTokenMode: common.DISABLE, // Specify the tokenization mode (e.g., ENABLE or DISABLE)
}
// Set up the Skyflow vault serviceservice, serviceErr:=skyflowClient.Vault("<VAULT_ID>") // Replace <VAULT_ID> with the actual vault IDifserviceErr!=nil {
// Handle errors that occur during service initializationfmt.Println(serviceErr) // Print the error
}
// Step 4: Send the request to the Skyflow vault and update the recordresponse, errUpdate:=service.Update(ctx, updateRequest, updateOptions)
iferrUpdate!=nil {
// Handle errors that occur during the update operationfmt.Println("Error occurred", *errUpdate) // Print the error for debugging purposes
} else {
// Print the response to confirm the update resultfmt.Println("response:", response)
}
}

Tip

See the full example in the samples directory: update_record.go

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to update a record in the Skyflow vault with specified data and tokens. * * 1. Initializes the Skyflow client with a given vault ID. * 2. Constructs an update request with data to modify and tokens to include. * 3. Sends the request to update the record in the vault. * 4. Prints the response to confirm the success or failure of the update operation. */funcmain() {
// Initialize Skyflow client// Step 1: Prepare the data to update in the vault — include SkyflowId as a key in the mapdata:=map[string]interface{}{
"SkyflowId": "5b699e2c-4301-4f9f-bcff-0a8fd3057413", // Skyflow ID identifies the record to update"name": "john doe", // New value for the "name" column"card_number": "4111111111111115", // New value for the "card_number" column
}
// Step 2: Optionally provide BYOT tokens for specific columnstokens:=map[string]interface{}{
"name": "72b8ffe3-c8d3-4b4f-8052-38b2a7405b5a",
}
// Step 3: Create an UpdateRequest to define the update operationupdateRequest:= common.UpdateRequest{
Table: "table1", // Replace with the actual table nameData: data, // The data to update; SkyflowId identifies the recordTokens: tokens, // Optional: BYOT tokens for specific columns
}
// Define update options, including tokenization modeupdateOptions:= common.UpdateOptions{
ReturnTokens: true, // Specify whether to return tokens in the responseTokenMode: common.DISABLE, // Specify tokenization mode (e.g., DISABLE means no tokenization)
}
//Set up the Skyflow vault service// Initialize the Skyflow client with the provided Vault IDservice, serviceErr:=skyflowClient.Vault("<VAULT_ID>") // Replace <VAULT_ID> with your actual Vault IDifserviceErr!=nil {
// Handle errors that occur during the service initializationfmt.Println(serviceErr) // Print the error for debugging purposes
}
// Step 4: Send the update request to the Skyflow vaultresponse, errUpdate:=service.Update(context.TODO(), updateRequest, updateOptions)
iferrUpdate!=nil {
// Handle errors that occur during the update operationfmt.Println("Error occurred", *errUpdate) // Print the error for debugging purposes
} else {
// Print the response to confirm the update resultfmt.Println("response:", response)
}
}

Sample response: When ReturnTokens is set to true

{
"UpdatedField": {
"SkyflowId": "5b699e2c-4301-4f9f-bcff-0a8fd3057413",
"name": "72b8ffe3-c8d3-4b4f-8052-38b2a7405b5a",
"card_number": "4315-7650-1359-9681"
},
"Errors": []
}

Sample response

When ReturnTokens is set to false

{
"UpdatedField": {
"SkyflowId": "5b699e2c-4301-4f9f-bcff-0a8fd3057413"
},
"Errors": []
}

Delete

To delete records using Skyflow IDs, use the Delete method. The DeleteRequest struct accepts a list of Skyflow IDs that you want to delete, as shown below:

Construct a delete request

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to delete records from a Skyflow vault using specified Skyflow IDs, along with corresponding DeleteRequest schema. * */funcmain() {
// Initialize Skyflow client // Step 1: Prepare a list of Skyflow IDs for the records to delete// The list stores the Skyflow IDs of the records that need to be deleted from the vaultids:= []string{
"<SKYFLOW_ID_1>", // Replace with actual Skyflow ID 1"<SKYFLOW_ID_2>", // Replace with actual Skyflow ID 2"<SKYFLOW_ID_3>", // Replace with actual Skyflow ID 3
}
// Define the context for the API callctx:=context.TODO() // Use context to manage the lifecycle of the API request// Step 2: Create a DeleteRequest to define the delete operation// The request specifies the table from which to delete the records and the IDs of the records to deletedeleteRequest:= common.DeleteRequest{
Table: "<TABLE_NAME>", // Replace with the actual table name from which to delete recordsIds: ids, // List of Skyflow IDs to delete
}
// Set up the Skyflow vault serviceservice, serviceErr:=skyflowClient.Vault("<VAULT_ID>") // Replace <VAULT_ID> with the actual vault IDifserviceErr!=nil {
// Handle errors during service initializationfmt.Println(serviceErr) // Print the error message
}
// Step 3: Send the delete request to the Skyflow vaultdeleteResponse, errDelete:=service.Delete(ctx, deleteRequest) // Call to delete records from the vaultiferrDelete!=nil {
// Handle errors during the delete operationfmt.Println("Error occurred", *errDelete) // Print the error message for debugging
} else {
// Step 4: Print the response to confirm the delete result// The response confirms whether the delete operation was successfulfmt.Println("response:", deleteResponse) // Print the delete response
}
}

Tip

See the full example in the samples directory: delete.go

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to delete records from a Skyflow vault using specified Skyflow IDs. * * 1. Initializes the Skyflow client with a given Vault ID. * 2. Constructs a delete request by specifying the IDs of the records to delete. * 3. Sends the delete request to the Skyflow vault to delete the specified records. * 4. Prints the response to confirm the success or failure of the delete operation. **/funcmain() {
// Step 1: Set up the Skyflow vault serviceservice, serviceErr:=skyflowClient.Vault("<VAULT_ID>") // Replace <VAULT_ID> with your actual vault IDifserviceErr!=nil {
// Handle any errors that occur during service initializationfmt.Println(serviceErr) // Print the error
}
// Prepare a list of Skyflow IDs for the records to delete// The list stores the Skyflow IDs of the records that need to be deleted from the vaultids:= []string{
"9cbf66df-6357-48f3-b77b-0f1acbb69280", // Replace with actual Skyflow ID 1"ea74bef4-f27e-46fe-b6a0-a28e91b4477b", // Replace with actual Skyflow ID 2"47700796-6d3b-4b54-9153-3973e281cafb", // Replace with actual Skyflow ID 3
}
// Step 2: Create a DeleteRequest to define the delete operation// The request specifies the table from which to delete the records and the IDs of the records to deletedeleteRequest:= common.DeleteRequest{
Table: "<TABLE_NAME>", // Replace with the actual table name from which to deleteIds: ids, // List of Skyflow IDs to delete
}
// Step 3: Send the delete request to the Skyflow vaultdeleteResponse, errDelete:=service.Delete(context.TODO(), deleteRequest)
iferrDelete!=nil {
// Handle errors that occur during the delete operationfmt.Println("Error occurred", *errDelete) // Print the error for debugging purposes
} else {
// Step 4: Print the response to confirm the delete resultfmt.Println("response:", deleteResponse)
}
}

Sample response:

{
"DeletedIds": [
"9cbf66df-6357-48f3-b77b-0f1acbb69280",
"ea74bef4-f27e-46fe-b6a0-a28e91b4477b",
"47700796-6d3b-4b54-9153-3973e281cafb"
]
}

Query

To retrieve data with SQL queries, use the Query method. The QueryRequest struct accepts a query parameter, as shown below.

Construct a query request

Refer to Query your data and Execute Query for guidelines and restrictions on supported SQL statements, operators, and keywords.

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to execute a custom SQL query on a Skyflow vault, along with QueryRequest schema. * */funcmain() {
// Initialize Skyflow client// Step 1: Define the SQL query to execute on the Skyflow vault// Replace "<YOUR_SQL_QUERY>" with the actual SQL query you want to runquery:="<YOUR_SQL_QUERY>"// Example: "SELECT * FROM demo WHERE SkyflowId='<ID>'"// Step 2: Create a QueryRequest with the specified SQL queryqueryRequest:= common.QueryRequest{
Query: query, // Pass the query string to the request
}
// Step 3: Initialize the Skyflow vault serviceservice, serviceError:=skyflowClient.Vault("<VAULT_ID>") // Replace <VAULT_ID> with the actual Vault IDifserviceError!=nil {
// Handle errors that occur during the service initializationfmt.Println(serviceError) // Print the error message
}
ctx:=context.TODO() // Using context to manage the API request lifecycle// Step 4: Execute the query request on the specified Skyflow vaultres, queryErr:=service.Query(ctx, queryRequest) // Execute the query// Step 5: Handle the response or any errors from the query executionifqueryErr!=nil {
// Handle any errors that occur during query executionfmt.Println("Error occurred: ", *queryErr) // Print the error message
} else {
// Print the response containing the query resultsfmt.Println("RESPONSE: ", res)
}
}

Tip

See the full example in the samples directory: query_record.go

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to execute a SQL query on a Skyflow vault to retrieve data. * * 1. Initializes the Skyflow client with the Vault ID. * 2. Constructs a query request with a specified SQL query. * 3. Executes the query against the Skyflow vault. * 4. Prints the response from the query execution. **/funcmain() {
// Initialize Skyflow client// Step 1: Define the SQL query to execute// Example query: Retrieve all records from the "demo" table with a specific SkyflowIdquery:="SELECT * FROM cards WHERE SkyflowId='3ea3861-x107-40w8-la98-106sp08ea83f'"// Replace with the actual Skyflow ID to filter the query // Step 2: Create a QueryRequest with the SQL queryqueryRequest:= common.QueryRequest{
Query: query, // SQL query to execute
}
// Set up the Skyflow vault serviceservice, serviceError:=skyflowClient.Vault("9f27764a10f7946fe56b3258e117") // Replace with the actual vault IDifserviceError!=nil {
// Handle errors that occur during service initializationfmt.Println(serviceError) // Print the error
}
// Step 3: Execute the query request on the specified Skyflow vault and handle the responsectx:=context.TODO() // Context for managing the lifecycle of the query requestres, queryErr:=service.Query(ctx, queryRequest) // Execute the query requestifqueryErr!=nil {
// Handle any errors that occur during query executionfmt.Println("Error occurred ", *queryErr) // Print the error for debugging purposes
} else {
// Step 5: Print the response from the query execution// The response contains the query results retrieved from the Skyflow vaultfmt.Println("RESPONSE: ", res) // Print the query response to show the results
}
}

Sample response:

{
"Fields": [{
"card_number": "XXXXXXXXXXXX1112",
"name": "S***ar",
"SkyflowId": "3ea3861-x107-40w8-la98-106sp08ea83f",
"TokenizedData": []
}],
"Errors": []
}

Upload File

To upload a file, use the UploadFile method. The FileUploadRequest struct accepts the skyflow id and associated parameters, as shown below:

Construct an File upload request

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to upload files in the Skyflow vault by providing skyflow id and file data, along with corresponding FileUploadRequest schema. * */funcmain() {
// Initialize Skyflow client// Set up the Skyflow vault serviceservice, serviceErr:=skyflowClient.Vault("<VAULT_ID>") // Replace <VAULT_ID> with the actual vault IDifserviceErr!=nil {
// Handle errors that occur during service initializationfmt.Println(serviceErr) // Print the error
} else {
ctx:=context.TODO()
// Step 2: Create File object for requestfilePath:="<FILE_PATH>"// File path for creating the file objectfileObj, err:=os.Open(filePath)
iferr!=nil {
fmt.Println("Error in reading file: ", err)
} else {
// Step 3: Create file requestrequest:= common.FileUploadRequest{
Table: "<TABLE_NAME>", // Replace with the actual table name into which file is to upload FileObject: *fileObj, // OptionalFilePath: "<FILE_PATH>"// Optional Base64: "<BASE_64>" // Optional
ColumnName: "<COLUMN_NAME>", // Replace column name with your file columnSkyflowId: "<SKYFLOW_ID>", // Replace skyflow id for file uploadFileName: "<FILE_NAME>"// Optional, File name is required in case of base64
}
// Step 4: Send the file upload request to the Skyflow vaultfileResponse, errFile:=service.UploadFile(ctx, request)
// Step 5: Prints the response to confirm the success or failure of the update operation.iferrFile!=nil {
// Handle errors that occur during the upload operationfmt.Println("ERROR: ", *errFile)
} else {
// Print the response to confirm the file upload resultfmt.Println("Response: ", fileResponse)
}
}
}
}

Note:

We can pass only one from file path, file object and base64 in file upload request.
File name is required when base64 is passed in request.

Tip

See the full example in the samples directory: upload_file.go

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to upload file in the Skyflow vault with specified data and tokens. * * 1. Initializes the Skyflow client with a given vault ID. * 2. Create File object for request * 3. Constructs an file upload request  * 4. Send the file upload request to the Skyflow vault * 5. Prints the response to confirm the success or failure of the file upload operation. */funcmain() {
// Initialize Skyflow client// Set up the Skyflow vault serviceservice, serviceErr:=skyflowClient.Vault("<VAULT_ID>") // Replace <VAULT_ID> with the actual vault IDifserviceErr!=nil {
// Handle errors that occur during service initializationfmt.Println(serviceErr) // Print the error
} else {
ctx:=context.TODO()
// Step 2: Create File object for requestfilePath:="Photo.png"// File path for creating the file objectfileObj, err:=os.Open(filePath)
iferr!=nil {
fmt.Println("Error in reading file: ", err)
} else {
// Step 3: Constructs an file upload request request:= common.FileUploadRequest{
Table: "table1", // Replace with the actual table name into which file is to upload FileObject: *fileObj, // OptionalFilePath: filePath// Optional Base64: "<BASE_64>" // OptionalColumnName: "file", // Replace column name with your file columnSkyflowId: "5b699e2c-4301-4f9f-bcff-0a8fd3057413", // Replace skyflow id for file uploadFileName: "<FILE_NAME>"// Optional, File name is required in case of base64
}
// Step 4: Send the file upload request to the Skyflow vaultfileResponse, errFile:=service.UploadFile(ctx, request)
// Step 5: Prints the response to confirm the success or failure of the file upload operation.iferrFile!=nil {
// Handle errors that occur during the upload operationfmt.Println("ERROR: ", *errFile)
} else {
// Print the response to confirm the file upload resultfmt.Println("Response: ", fileResponse)
}
}
}
}

Sample response:

{
"SkyflowId": "5b699e2c-4301-4f9f-bcff-0a8fd3057413"
}

Custom Request Headers

The SDK supports passing custom HTTP headers at two levels: client level (applied to all requests) and request level (applied to a single API call).

Supported headers

Constant	Header name	Description
`common.RequestIDHeader`	`x-request-id`	Custom request identifier for tracing
`common.SkyflowAccountID`	`x-skyflow-account-id`	Skyflow account identifier
`common.SkyflowAccountName`	`x-skyflow-account-name`	Skyflow account name

Client-level custom headers

Use client.WithCustomHeaders when building the Skyflow client. These headers are sent with every request made through that client.

import (
"github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
customHeaders:=map[common.CustomHeaderKey]string{
common.RequestIDHeader: "<REQUEST_ID>", // Replace with your request IDcommon.SkyflowAccountID: "<ACCOUNT_ID>", // Replace with your account ID
}
skyflowClient, err:=client.NewSkyflow(
client.WithVaults(vaultConfig),
client.WithCredentials(skyflowCredentials),
client.WithCustomHeaders(customHeaders),
)

Request-level custom headers

Pass CustomHeaders in the options struct for any individual operation. Request-level headers take precedence over client-level headers for that call.

The following options structs support CustomHeaders:

Vault operations

Operation	Options struct
`Insert`	`InsertOptions`
`Detokenize`	`DetokenizeOptions`
`Get`	`GetOptions`
`Update`	`UpdateOptions`
`Delete`	`DeleteOptions`
`Query`	`QueryOptions`
`Tokenize`	`TokenizeOptions`
`UploadFile`	`FileUploadOptions`

Detect operations

Operation	Options struct
`DeidentifyText`	`DeidentifyTextOptions`
`ReidentifyText`	`ReidentifyTextOptions`
`DeidentifyFile`	`DeidentifyFileOptions`
`GetDetectRun`	`GetDetectRunOptions`

Example — passing a custom request ID on a single insert call:

import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
customHeaders:=map[common.CustomHeaderKey]string{
common.RequestIDHeader: "<REQUEST_ID>", // Replace with your request ID
}
insertOptions:= common.InsertOptions{
ReturnTokens: true,
CustomHeaders: customHeaders,
}
service, serviceErr:=skyflowClient.Vault("<VAULT_ID>")
ifserviceErr!=nil {
fmt.Println("Error:", serviceErr)
}
response, err:=service.Insert(context.TODO(), insertRequest, insertOptions)
iferr!=nil {
fmt.Println("Error:", err)
} else {
fmt.Println("Response:", response)
}

Detect

Skyflow Detect enables you to deidentify and reidentify sensitive data in text and files, supporting advanced privacy-preserving workflows. The Detect API supports the following operations:

Deidentify Text

To deidentify text, use the DeidentifyText method. The DeidentifyTextRequest struct creates a deidentify text request, which includes the text to be deidentified. Additionally, you can provide optional parameters using the DeidentifyTextRequest struct.

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
funcmain() {
// Configure the vault with detect service.service, serviceErr:=skyflowInstance.Detect("<VAULT_ID>") // Replace with your vault ID from the vault configifserviceErr!=nil {
fmt.Println(*serviceErr)
} else {
ctx:=context.TODO()
// Step 1: Prepare the request to be deidentified the textrequest:= common.DeidentifyTextRequest{
Text: "<TEXT_TO_BE_DEIDENTIFIED>",
Entities: []common.DetectEntities{ // Entities to deidentifycommon.Ssn,
common.CreditCard,
},
AllowRegexList: []string{"<ALLOW_REGEX_PATTERN1>", "<ALLOW_REGEX_PATTERN2>"}, // Allowlist regex patternsRestrictRegexList: []string{"<RESTRICT_REGEX_PATTERN1>", "<RESTRICT_REGEX_PATTERN2>"}, // Restrict regex patternsTransformations: common.Transformations{ // Specify custom transformations for entitiesShiftDates: common.DateTransformation{
MaxDays: 15, // Maximum days to shiftMinDays: 5, // Minimum days to shiftEntities: []common.TransformationsShiftDatesEntityTypesItem{ // Entities to apply the shiftcommon.TransformationsShiftDatesEntityTypesItemDob,
},
},
},
TokenFormat: common.TokenFormat{ // Specify the token format for deidentified entitiesDefaultType: common.TokenTypeDefaultEntityOnly,
VaultToken: []common.DetectEntities{ // Specify entities to use vault tokenscommon.CreditCard,
common.Ssn,
common.Name,
common.CreditCardExpiration,
},
EntityUniqueCounter: []common.DetectEntities{
common.Statistics,
},
EntityOnly: []common.DetectEntities{
common.Dob,
},
},
}
// Step 3: Call deidentifyTextdeidentifyTextRes, deidentifyTextErr:=service.DeidentifyText(ctx, request)
// Step 5: Handle the response and errors.ifdeidentifyTextErr!=nil {
fmt.Println("ERROR: ", *deidentifyTextErr)
} else {
fmt.Println("RESPONSE: ", deidentifyTextRes)
}
}
}

Tip

See the full example in the samples directory: deidentify_text.go

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
/** * This example demonstrates how to use the Skyflow Go SDK to deidentify sensitive data in text * by masking or transforming detected values according to your configuration. * <p> * Steps include: * 1. Set up Skyflow vault credentials. * 2. Configure the skyflow client. * 3. Configure the vault with detect service. * 4. Deidentifying sensitive data in the text and returning the output. * 5. Handling the response and errors. */funcmain() {
// Step 1: Set up Skyflow vault credentials// Step 2: Configure the skyflow client.// Step 3: Configure the vault with detect service.service, serviceErr:=skyflowInstance.Detect("<VAULT_ID>") // Replace with your vault ID from the vault configifserviceErr!=nil {
fmt.Println(*serviceErr)
} else {
ctx:=context.TODO()
// Step 4: Deidentify sensitive data in the text and return the outputdeidentifyTextRes, deidentifyTextErr:=service.DeidentifyText(ctx, common.DeidentifyTextRequest{
Text: "My SSN is 123-45-6789 and my card is 4111 1111 1111 1111.", // Text to be deidentifiedEntities: []common.DetectEntities{ // Specify which entities to deidentifycommon.Ssn,
common.CreditCard,
},
Transformations: common.Transformations{ //Specify custom transformations for entitiesShiftDates: common.DateTransformation{
MaxDays: 15, // Maximum days to shiftMinDays: 5, // Minimum days to shiftEntities: []common.TransformationsShiftDatesEntityTypesItem{ // Apply shift to DOB entitiescommon.TransformationsShiftDatesEntityTypesItemDob,
},
},
},
TokenFormat: common.TokenFormat{ // Specify the token format for deidentified entitiesDefaultType: common.TokenTypeDefaultEntityOnly,
VaultToken: []common.DetectEntities{ // Specify entities to use vault tokenscommon.CreditCard,
common.Ssn,
common.Name,
common.CreditCardExpiration,
},
EntityUniqueCounter: []common.DetectEntities{
common.Statistics,
},
EntityOnly: []common.DetectEntities{
common.Dob,
},
},
})
// Step 5: Handle the response and errors.ifdeidentifyTextErr!=nil {
fmt.Println("ERROR: ", *deidentifyTextErr)
} else {
fmt.Println("RESPONSE: ", deidentifyTextRes)
}
}
}

Sample Response:

{
"ProcessedText": "My SSN is [SSN_0ykQWPA] and my card is [CREDIT_CARD_N92QAVa].",
"Entities": [
{
"Token": "SSN_0ykQWPA",
"Value": "123-45-6789",
"TextIndex": {
"Start": 10,
"End": 21
},
"ProcessedIndex": {
"Start": 10,
"End": 23
},
"Entity": "SSN",
"Scores": {
"SSN": 0.9383999705314636
}
},
{
"Token": "CREDIT_CARD_N92QAVa",
"Value": "4111 1111 1111 1111",
"TextIndex": {
"Start": 37,
"End": 56
},
"ProcessedIndex": {
"Start": 39,
"End": 60
},
"Entity": "CREDIT_CARD",
"Scores": {
"CREDIT_CARD": 0.9050999879837
}
}
],
"WordCount": 9,
"CharCount": 57
}

Reidentify Text

To reidentify text, use the reidentifyText method. The ReidentifyTextRequest struct creates a reidentify text request, which includes the redacted or deidentified text to be reidentified. Additionally, you can provide optional parameters using the ReidentifyTextRequest struct to control how specific entities are returned (as redacted, masked, or plain text).

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
funcmain() {
// Configure the vault with detect service.service, serviceErr:=skyflowInstance.Detect("<VAULT_ID>") // Replace with your vault ID from the vault configifserviceErr!=nil {
fmt.Println(*serviceErr)
} else {
ctx:=context.TODO()
// Prepare the redacted text to be reidentifiedrequest:= common.ReidentifyTextRequest{
Text: "<DEIDENTIFY_TEXT_RESPONSE>", // The redacted text to reidentifyMaskedEntities: []common.DetectEntities{
common.CreditCard, // Entities to mask
},
RedactedEntities: []common.DetectEntities{
common.Name, // Entities to keep redacted
},
PlainTextEntities: []common.DetectEntities{
common.Year, // Entities to return as plain text
},
}
// Call ReidentifyTextreidentifyTextResponse, reidentifyTextErr:=service.ReidentifyText(ctx, request)
// Handle the response and errors.ifreidentifyTextErr!=nil {
fmt.Println("ERROR: ", *reidentifyTextErr)
} else {
fmt.Println("RESPONSE: ", reidentifyTextResponse)
}
}
}

Tip

See the full example in the samples directory: reidentify_text.go

package main
/** * Skyflow Reidentify Text Example *  * This example demonstrates how to: * 1. Configure credentials * 2. Set up vault configuration * 3. Create a reidentify text request * 4. Use all available options for reidentification * 5. Handle response and errors */import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
funcmain() {
// Configure the vault with detect service.service, serviceErr:=skyflowInstance.Detect("<VAULT_ID>") // Replace with your vault ID from the vault configifserviceErr!=nil {
fmt.Println(*serviceErr)
} else {
ctx:=context.TODO()
// Prepare the redacted text to be reidentifiedrequest:= common.ReidentifyTextRequest{
Text: "My SSN is [SSN_0ykQWPA] and my card is [CREDIT_CARD_N92QAVa]."// The redacted text to reidentifyMaskedEntities: []common.DetectEntities{
common.CreditCard, // Entities to mask
},
RedactedEntities: []common.DetectEntities{
common.Name, // Entities to keep redacted
},
PlainTextEntities: []common.DetectEntities{
common.Year, // Entities to return as plain text
},
}
// Call ReidentifyTextreidentifyTextResponse, reidentifyTextErr:=service.ReidentifyText(ctx, request)
// Handle the response and errors.ifreidentifyTextErr!=nil {
fmt.Println("ERROR: ", *reidentifyTextErr)
} else {
fmt.Println("RESPONSE: ", reidentifyTextResponse)
}
}
}

Sample Response:

{
"ProcessedText": "My SSN is 123-45-6789 and my card is 4111 1111 1111 1111."
}

Deidentify File

To deidentify files, use the DeidentifyFile method. The DeidentifyFileRequest struct creates a deidentify file request, which includes the file to be deidentified (such as images, PDFs, audio, documents, spreadsheets, or presentations). Additionally, you can provide optional parameters using the DeidentifyFileRequest struct to control how entities are detected and deidentified, as well as how the output is generated for different file types.

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
funcmain() {
// Configure the vault with detect service.service, serviceErr:=skyflowInstance.Detect("<VAULT_ID>") // Replace with your vault ID from the vault configifserviceErr!=nil {
fmt.Println(*serviceErr)
} else {
ctx:=context.TODO()
// Step 1: Prepare the file to be deidentifiedfilePath:="<PATH_TO_FILE>"// Replace with your file path to deidentifyfile, _:=os.Open(filePath)
deferfile.Close()
request:= common.DeidentifyFileRequest{
File: common.FileInput{
File: file,
// FilePath: filePath, // Provide FilePath or File at a time
},
OutputDirectory: "<OUTPUT_DIRECTORY_PATH>", // Output directory for saving the deidentified file. This is not supported in Cloudflare workersWaitTime: 20, // Wait time for response (max 64 seconds; throws error if more)Entities: []common.DetectEntities{
common.Ssn,
common.CreditCard,
common.EmailAddress,
},
AllowRegexList: []string{"<ALLOW_REGEX_PATTERN1>", "<ALLOW_REGEX_PATTERN2>"}, // Replace with the regex patterns you want to allow during deidentificationRestrictRegexList: []string{"<RESTRICT_REGEX_PATTERN1>", "<RESTRICT_REGEX_PATTERN2>"}, // Replace with the regex patterns you want to restrict during deidentificationTransformations: common.Transformations{ // Transformations for entitiesShiftDates: common.DateTransformation{
MaxDays: 15, // Maximum days to shiftMinDays: 5, // Minimum days to shiftEntities: []common.TransformationsShiftDatesEntityTypesItem{ // Apply shift to DOB entitiescommon.TransformationsShiftDatesEntityTypesItemDob,
},
},
},
TokenFormat: common.TokenFormat{ // Token format for deidentified entitiesDefaultType: common.TokenTypeDefaultEntityOnly,
EntityUniqueCounter: []common.DetectEntities{
common.Statistics,
},
EntityOnly: []common.DetectEntities{
common.Dob,
},
},
// ===== Image Options (apply when file is an image) =====MaskingMethod: common.BLACKBOX, // Masking method for image entitiesOutputProcessedImage: true, // Include processed image in outputOutputOcrText: true, // Include OCR text in response// ===== PDF Options (apply when file is a PDF) ===== PixelDensity: 30, // Pixel density for PDF processingMaxResolution: 3, // Max resolution for PDF// ===== Audio Options (apply when file is audio) =====OutputProcessedAudio: true,
Bleep: common.AudioBleep { // Bleep audio configurationGain: 70, // Relative loudness in dBFrequency: 100, // Pitch in HzStartPadding: 2, // Padding at start in secondsStopPadding: 8, // Padding at end in seconds
},
// OutputTranscription: common.PLAINTEXT_TRANSCRIPTION,
}
//Step 2: Construct the file input by providing either file or filePath but not bothdeidentifyFileRes, deidentifyFileErr:=service.DeidentifyFile(ctx, request)
// Step 5: Handle the response and errors.ifdeidentifyFileErr!=nil {
fmt.Println("ERROR: ", *deidentifyFileErr)
} else {
fmt.Println("RESPONSE: ", deidentifyFileRes)
}
}
}

Tip

See the full example in the samples directory: deidentify_file.go

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
/** * Skyflow Deidentify File Example *  * This sample demonstrates how to use all available options for deidentifying files. * Supported file types: images (jpg, png, etc.), pdf, audio (mp3, wav), documents, spreadsheets, presentations, structured text. */funcmain() {
// Configure the vault with detect service.service, serviceErr:=skyflowInstance.Detect("<VAULT_ID>") // Replace with your vault ID from the vault configifserviceErr!=nil {
fmt.Println(*serviceErr)
} else {
ctx:=context.TODO()
// Step 1: Prepare Deidentify File RequestfilePath:="/detect/sample.txt"// Replace with your file path to deidentifyfile, _:=os.Open(filePath)
deferfile.Close()
// Construct the file input by providing either file or filePath but not bothfileInput:= common.FileInput{
File: file,
// FilePath: filePath, // Provide FilePath or File at a time
},
request :=common.DeidentifyFileRequest{
File: fileInput,
OutputDirectory: "/home/user/output", // Output directory for saving the deidentified file. This is not supported in Cloudflare workersWaitTime: 15, // Wait time for response (max 64 seconds; throws error if more)Entities: []common.DetectEntities{
common.Ssn,
common.CreditCard,
common.EmailAddress,
},
Transformations: common.Transformations{ // Transformations for entitiesShiftDates: common.DateTransformation{
MaxDays: 15, // Maximum days to shiftMinDays: 5, // Minimum days to shiftEntities: []common.TransformationsShiftDatesEntityTypesItem{ // Apply shift to DOB entitiescommon.TransformationsShiftDatesEntityTypesItemDob,
},
},
},
TokenFormat: common.TokenFormat{ // Token format for deidentified entitiesDefaultType: common.TokenTypeDefaultEntityOnly,
EntityUniqueCounter: []common.DetectEntities{
common.Statistics,
},
EntityOnly: []common.DetectEntities{
common.Dob,
},
},
}
//Step 2: Construct the file input by providing either file or filePath but not bothdeidentifyFileRes, deidentifyFileErr:=service.DeidentifyFile(ctx, request)
// Step 5: Handle the response and errors.ifdeidentifyFileErr!=nil {
fmt.Println("ERROR: ", *deidentifyFileErr)
} else {
fmt.Println("RESPONSE: ", deidentifyFileRes)
}
}
}

Sample Response:

{
"Entities": [
{
"file": "0X2xhYmVsIjoiQ1JFRElUX0NB==",
"extension": "json"
}
],
"FileBase64": "TXkgU1NOIGlzIFtTU0==",
"File": {
"Size": 15075,
"Type": "",
"Name": "deidentified.jpeg",
"LastModified": 1750791985426
},
"Type": "redacted_file",
"Extension": "txt",
"WordCount": 12,
"CharCount": 58,
"SizeInKb": 0.06,
"DurationInSeconds": 0,
"PageCount": 0,
"SlideCount": 0,
"RunId": "undefined",
"Status": "SUCCESS"
}

Supported file types:

Documents: doc, docx, pdf
PDFs: pdf
Images: bmp, jpeg, jpg, png, tif, tiff
Structured text: json, xml
Spreadsheets: csv, xls, xlsx
Presentations: ppt, pptx
Audio: mp3, wav

MaskingMethod values (image files):

Value	Description
`common.BLACKBOX`	Cover detected entities with a solid black rectangle.
`common.BLUR`	Apply a gaussian blur over detected entities.

OutputTranscription values (audio files):

Value	Description
`common.PLAINTEXT_TRANSCRIPTION`	Return transcript as plain text.
`common.DIARIZED_TRANSCRIPTION`	Return transcript with speaker labels.

Note:

Transformations cannot be applied to Documents, Images, or PDFs file formats.
The waitTime option must be ≤ 64 seconds; otherwise, an error is thrown.
If the API takes more than 64 seconds to process the file, it will return only the run ID in the response.

Sample response (when the API takes more than 64 seconds):

{
"Entities": nil,
"File": nil,
"Type": nil,
"Extension": nil,
"WordCount": nil,
"CharCount": nil,
"SizeInKb": nil,
"DurationInSeconds": nil,
"PageCount": nil,
"SlideCount": nil,
"RunId": "1ad6dc12-8405-46cf-1c13-db1123f9f4c5",
"Status": "IN_PROGRESS"
}

Get run

To retrieve the results of a previously started file deidentification operation, use the GetDetectRun method.
The GetDetectRunRequest struct is initialized with the RunId returned from a prior DeidentifyFile call.
This method allows you to fetch the final results of the file processing operation once they are available.

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
funcmain() {
// Configure the vault with detect service.service, serviceErr:=skyflowInstance.Detect("<VAULT_ID>") // Replace with your vault ID from the vault configifserviceErr!=nil {
fmt.Println(*serviceErr)
} else {
ctx:=context.TODO()
request:= common.GetDetectRunRequest{
RunId: "<RUN_ID_FROM_DEIDENTIFY_FILE_RESPONSE>",
}
getDetectRunRes, deidentifyFileErr:=service.GetDetectRun(ctx, request)
// Step 5: Handle the response and errors.ifdeidentifyFileErr!=nil {
fmt.Println("ERROR: ", *deidentifyFileErr)
} else {
fmt.Println("RESPONSE: ", getDetectRunRes)
}
}
}

Tip

See the full example in the samples directory: get_detect_run.go

package main
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
funcmain() {
// Configure the vault with detect service.service, serviceErr:=skyflowInstance.Detect("<VAULT_ID>") // Replace with your vault ID from the vault configifserviceErr!=nil {
fmt.Println(*serviceErr)
} else {
ctx:=context.TODO()
// Step 1: Prepare the GetDetectRunRequest with the runId from a previous deidentifyFile callrequest:= common.GetDetectRunRequest{
RunId: "89699e2c-4301-4f9f-bcff-0a8fd30574898", // Replace with the runId you received earlier
}
// Step 2: Call GetDetectRungetDetectRunRes, deidentifyFileErr:=service.GetDetectRun(ctx, request)
// Step 5: Handle the response and errorsifdeidentifyFileErr!=nil {
fmt.Println("ERROR: ", *deidentifyFileErr)
} else {
fmt.Println("RESPONSE: ", getDetectRunRes)
}
}
}

Sample response

{
"Entities": [
{
"File": "0X2xhYmVsIjoiQ1JFRElUX0NB==",
"Extension": "json"
}
],
"File": "TXkgU1NOIGlzIFtTU0==",
"Type": "redacted_file",
"Extension": "txt",
"WordCount": 12,
"CharCount": 58,
"SizeInKb": 0.06,
"DurationInSeconds": 0,
"PageCount": 0,
"SlideCount": 0,
"Status": "SUCCESS"
}

Connections

Skyflow Connections is a gateway service leveraging tokenization to securely send and receive data between your systems and first- or third-party services. The connections module is used to invoke both INBOUND and/or OUTBOUND connections.

Inbound Connections: Act as intermediaries between your client and server, tokenizing sensitive data before it reaches your backend, ensuring downstream services handle only tokenized data.
Outbound Connections: Enable secure extraction of data from the vault and transfer it to third-party services via your backend server.

Invoke Connection

To invoke a connection, use the Invoke method of the Skyflow client.

Construct an invoke connection request

package vaultapi
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/utils/logger"
. "github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to invoke an external connection using the Skyflow SDK, along with corresponding InvokeConnectionRequest schema. * */funcmain() {
// Initialize Skyflow client // Step 1: Define the request body parameters// These are the values you want to send in the request bodyctx:=context.TODO() // Define the context of the requestbody:=map[string]interface{}{ // Set your data in the body of the request"<KEY>": "<VALUE>", // Example BODY
}
// Step 2: Define the request headers// Add any required headers that need to be sent with the requestheaders:=map[string]string{ "<HEADER_NAME_1>": "<HEADER_VALUE_1>", "<HEADER_NAME_2>": "<HEADER_VALUE_2>", }
// Step 3: Define the path parameters// Path parameters are part of the URL and typically used in RESTful APIspathParams:=map[string]string{ "<YOUR_PATH_PARAM_KEY_1>": "<YOUR_PATH_PARAM_VALUE_1>", }
// Step 4: Define the query parameters// Query parameters are included in the URL after a '?' and are used to filter or modify the responsequeryParams:=map[string]interface{}{ "<YOUR_QUERY_PARAM_KEY_1>": "<YOUR_QUERY_PARAM_VALUE_1>",
"<YOUR_QUERY_PARAM_KEY_2>": "<YOUR_QUERY_PARAM_VALUE_2>",
}
// Step 5: Build the InvokeConnectionRequest// Construct the request by specifying method, headers, body, query parameters, and path parametersreq:=InvokeConnectionRequest{
Method: POST, // The HTTP method to use for the request (POST in this case)Headers: headers, // The headers to include in the requestBody: body, // Attach the request bodyQueryParams: queryParams, // The query parameters to append to the URLPathParams: pathParams, // The path parameters for the URL
}
// Replace "<CONNECTION_ID>" with the actual connection ID you are usingservice, conError:=client1.Connection("<CONNECTION_ID1>") // Replace with actual connection IDifconError!=nil {
// Handle errors when establishing the connectionfmt.Println("Error:", conError) // Print the connection error if it occurs
} else {
// Step 6: Invoke the connection using the request// Send the request to the external connection and receive the responseres, invokeError:=service.Invoke(ctx, req) // Invoke the connection with the provided requestifinvokeError!=nil {
// Handle any errors that occur during the connection invocationfmt.Println("Error occurred ", *invokeError) // Print the error if the invocation fails
} else {
// Step 7: Print the response from the invoked connection// The response contains the result of the request sent to the external systemfmt.Println("RESPONSE", res) // Print the successful response
}
}
}

method supports the following methods:

GET
POST
PUT
PATCH
DELETE

PathParams, QueryParams, RequestHeader, RequestBody are the objects represented as map, that will be sent through the connection integration url.

Tip

See the full example in the samples directory: invoke_connection.go See docs.skyflow.com for more details on integrations with Connections, Functions, and Pipelines.

import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/utils/logger"
. "github.com/skyflowapi/skyflow-go/v2/client"
. "github.com/skyflowapi/skyflow-go/v2/utils/common"
)
/** * This example demonstrates how to invoke an external connection using the Skyflow SDK. * It configures a connection, sets up the request, and sends a POST request to the external service. * * 1. Initialize Skyflow client with connection details. * 2. Define the request body, headers, and method. * 3. Execute the connection request. * 4. Print the response from the invoked connection. */funcmain() {
// Initialize Skyflow client // Step 1: Set up credentials and connection configuration// Load credentials from a JSON file (you need to provide the correct path)credentials:=Credentials{Path: "../cred.json"}
// Define the connection configuration (URL and credentials)connConfig1:=ConnectionConfig{
ConnectionId: "<CONNECTION_ID1>", // Replace with actual connection IDConnectionUrl: "https://connection.url.com", // Replace with actual connection URLCredentials: credentials, // Set credentials for the connection
}
// Add connection configurations to an arrayvararr []ConnectionConfigarr=append(arr, connConfig1)
// Initialize the Skyflow client with the connection configurationskyflowClient, clientError:=NewSkyflow(
WithConnections(arr...), // Add the connection configurations to the clientWithLogLevel(logger.DEBUG), // Set log level to DEBUG for detailed logs
)
ifclientError!=nil {
// Handle any errors that occur during Skyflow client initializationfmt.Println("Error:", clientError)
} else {
// Replace "<CONNECTION_ID1>" with the actual connection IDservice, conError:=skyflowClient.Connection("<CONNECTION_ID1>")
ifconError!=nil {
// Handle errors that occur during the connection setupfmt.Println("Error:", conError)
} else {
// Step 2: Define the request body and headers// Map for request body parametersctx:=context.TODO() // Define the context for the API callbody:=map[string]interface{}{ // Set your request data"card_number": "4337-1696-5866-0865", // Example card number"ssn": "524-41-4248", // Example SSN
}
// Map for request headersheaders:=map[string]string{ // Set the request headers"Content-Type": "application/json", // Specify the content type for the request
}
// Step 3: Build the InvokeConnectionRequest with required parameters// Set HTTP method to POST, include the request body and headersreq:=InvokeConnectionRequest{
Method: POST, // Set the HTTP method to POSTHeaders: headers, // Add request headersBody: body, // Add the body with request data
}
// Step 4: Invoke the connection and capture the responseres, invokeError:=service.Invoke(ctx, req)
ifinvokeError!=nil {
// Handle any errors that occur during the connection invocationfmt.Println("Error occurred ", *invokeError)
} else {
// Step 8: Print the response from the connection invocationfmt.Println("RESPONSE", res)
}
}
}
}

Sample response:

{
"data": {
"card_number": "4337-1696-5866-0865",
"ssn": "524-41-4248"
},
"metadata": {
"requestId": "4a3453b5-7aa4-4373-98d7-cf102b1f6f97"
}
}

Client management

After the Skyflow client is initialized, you can add, update, retrieve, and remove vault and connection configurations at runtime without recreating the client.

Vault management

Method	Description
`AddVaultConfig(config VaultConfig)`	Add a new vault after initialization
`RemoveVaultConfig(vaultId string)`	Remove a vault by ID
`UpdateVaultConfig(config VaultConfig)`	Update an existing vault configuration
`GetVaultConfig(vaultId string)`	Retrieve a vault configuration by ID

import (
"fmt""github.com/skyflowapi/skyflow-go/v2/utils/common"
)
// Add a new vaultnewVault:= common.VaultConfig{
VaultId: "<NEW_VAULT_ID>",
ClusterId: "<NEW_CLUSTER_ID>",
Env: common.PROD,
Credentials: common.Credentials{Token: "<BEARER_TOKEN>"},
}
iferr:=skyflowClient.AddVaultConfig(newVault); err!=nil {
fmt.Println("Error adding vault:", err)
}
// Retrieve vault configurationvaultCfg, err:=skyflowClient.GetVaultConfig("<VAULT_ID>")
iferr!=nil {
fmt.Println("Error getting vault config:", err)
} else {
fmt.Println("Vault config:", vaultCfg)
}
// Update an existing vault configurationupdatedVault:= common.VaultConfig{
VaultId: "<VAULT_ID>",
ClusterId: "<NEW_CLUSTER_ID>",
Env: common.PROD,
}
iferr:=skyflowClient.UpdateVaultConfig(updatedVault); err!=nil {
fmt.Println("Error updating vault:", err)
}
// Remove a vaultiferr:=skyflowClient.RemoveVaultConfig("<VAULT_ID>"); err!=nil {
fmt.Println("Error removing vault:", err)
}

Connection management

Method	Description
`AddConnectionConfig(config ConnectionConfig)`	Add a new connection after initialization
`RemoveConnectionConfig(connId string)`	Remove a connection by ID
`UpdateConnectionConfig(config ConnectionConfig)`	Update an existing connection configuration
`GetConnectionConfig(connId string)`	Retrieve a connection configuration by ID

Credential management

Method	Description
`AddSkyflowCredentials(config Credentials)`	Add client-level credentials
`UpdateSkyflowCredentials(credentials Credentials)`	Update client-level credentials
`GetSkyflowCredentials()`	Get current client-level credentials

Log level management

Method	Description
`UpdateLogLevel(logLevel LogLevel)`	Update the log level at runtime
`GetLoglevel()`	Get the current log level

import"github.com/skyflowapi/skyflow-go/v2/utils/logger"// Change log level at runtimeskyflowClient.UpdateLogLevel(logger.INFO)
// Get current log levellevel:=skyflowClient.GetLoglevel()
fmt.Println("Current log level:", *level)

Authentication & authorization

Types of credentials

The SDK accepts one of several credential types. Only one type can be used at a time.

API key — A unique identifier used to authenticate and authorize requests to an API. Use for long-term service authentication.
```
credentials:= common.Credentials{
ApiKey: "<YOUR_API_KEY>",
}
```
Bearer token — A temporary access token used to authenticate API requests. Use for optimal security.
```
credentials:= common.Credentials{
Token: "<YOUR_BEARER_TOKEN>",
}
```
Service account credentials file path — The file path pointing to a JSON file containing credentials for a service account. Use when credentials are managed externally or stored in secure file systems.
```
credentials:= common.Credentials{
Path: "<PATH_TO_CREDENTIALS_JSON_FILE>",
}
```
Service account credentials string — A JSON-formatted string containing service account credentials. Use when integrating with secret management systems or when credentials are passed programmatically.
```
credentials:= common.Credentials{
CredentialsString: "<CREDENTIALS_JSON_AS_STRING>",
}
```
Environment variable — If no credentials are explicitly provided, the SDK automatically looks for the SKYFLOW_CREDENTIALS environment variable. Use to avoid hardcoding credentials in source code.

Note

Only one type of credential can be used at a time. If multiple credentials are provided, the individual vault-level credentials take precedence over common credentials, and common credentials take precedence over the environment variable.

Generate bearer tokens for authentication & authorization

Generate and manage bearer tokens to authenticate API calls. This section covers options for scoping to certain roles, passing context, and signing data tokens.

Generate a bearer token: Enable the creation of bearer tokens using service account credentials. These tokens, valid for 60 minutes, provide secure access to Vault services and management APIs based on the service account's permissions.
Generate a bearer token with context: Support embedding context values into bearer tokens, enabling dynamic access control and the ability to track end-user identity.
Generate a scoped bearer token: Facilitate the creation of bearer tokens with role-specific access, ensuring permissions are limited to the operations allowed by the designated role.
Generate signed data tokens: Add an extra layer of security by digitally signing data tokens with the service account's private key.

Generate a bearer token

The Service Account go module is designed to generate service account tokens using a service account credentials file, which is provided when a service account is created. The tokens generated by this module are valid for 60 minutes and can be used to make API calls to Vault services and management APIs, depending on the permissions assigned to the service account.

The GenerateBearerToken(filepath) utility provides functionality for generating bearer tokens using a credentials JSON file. Alternatively, you can pass the credentials as a string to achieve the same result.

Tip

See the full example in the samples directory: service_account_token.go

import (
"fmt"
saUtil "github.com/skyflowapi/skyflow-go/v2/serviceaccount""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
/** * Example program to generate a Bearer Token using Skyflow's BearerToken utility. * The token can be generated in two ways: * 1. Using the file path to a credentials.json file. * 2. Using the JSON content of the credentials file as a string. */funcBearerTokenGenerationExample() {
// Variable to store the generated tokenvartokenstring// Example 1: Generate Bearer Token using a credentials.json file// Specify the full file path to the credentials.json filevarfilePath="<YOUR_CREDENTIALS_FILE_PATH>"// Check if the token is either not initialized or has expiredifsaUtil.IsExpired(token) {
// Create a BearerToken using the credentials fileres, err:=saUtil.GenerateBearerToken(filePath, common.BearerTokenOptions{
LogLevel: logger.DEBUG,
})
iferr!=nil {
fmt.Println("errors", *err)
} else {
token=res.AccessToken
}
}
// Print the generated Bearer Token to the consolefmt.Println("Generated Bearer Token (from file): "+token)
// Example 2: Generate Bearer Token using the credentials JSON as a string// Provide the credentials JSON content as a stringvarfileContents="<YOUR_CREDENTIALS_FILE_CONTENTS_AS_STRING>"// Check if the token is either not initialized or has expiredifsaUtil.IsExpired(token) {
// Create a BearerToken using the credentials stringres, err:=saUtil.GenerateBearerTokenFromCreds(fileContents, common.BearerTokenOptions{
LogLevel: logger.DEBUG,
})
iferr!=nil {
fmt.Println("Errors", *err)
} else {
fmt.Println("Token", res.AccessToken)
}
token=res.AccessToken
}
// Print the generated Bearer Token to the consolefmt.Println("Generated Bearer Token: "+token)
}

Generate bearer tokens with context

Context-Aware Authorization embeds context values into a bearer token during its generation so you can reference those values in your policies. This enables more flexible access controls, such as helping you track end-user identity when making API calls using service accounts, and facilitates using signed data tokens during detokenization.

A service account with the context_id identifier generates bearer tokens containing context information, represented as a JWT claim in a Skyflow-generated bearer token. Tokens generated from such service accounts include a context_identifier claim, are valid for 60 minutes, and can be used to make API calls to the Data and Management APIs, depending on the service account's permissions.

The Ctx field accepts either a string or a map[string]interface{}:

String context — use when your policy references a single context value:

res, err:=serviceaccount.GenerateBearerToken(filePath, common.BearerTokenOptions{
Ctx: "user_12345",
})

JSON object context — use when your policy needs multiple context values for conditional data access. Each key in the map maps to a Skyflow CEL policy variable under request.context.*:

ctxMap:=map[string]interface{}{
"role": "admin",
"department": "finance",
"user_id": "user_12345",
}
res, err:=serviceaccount.GenerateBearerToken(filePath, common.BearerTokenOptions{
Ctx: ctxMap,
})

With the map above, your Skyflow policies can reference request.context.role, request.context.department, and request.context.user_id to make conditional access decisions.

You can also set context on Credentials for automatic token generation:

// String contextcreds:= common.Credentials{
Path: "path/to/credentials.json",
Context: "user_12345",
}
// Map contextcreds:= common.Credentials{
Path: "path/to/credentials.json",
Context: map[string]interface{}{
"role": "admin",
"department": "finance",
},
}

Context map keys must contain only alphanumeric characters and underscores ([a-zA-Z0-9_]). Invalid keys will return a SkyflowError.

Tip

See the full example in the samples directory: token_generation_with_context.go See Skyflow's context-aware authorization and conditional data access docs for policy variable syntax like request.context.*.

Generate scoped bearer tokens

A service account with multiple roles can generate bearer tokens with access limited to a specific role by specifying the appropriate roleID. It can be used to limit access to specific roles for services with multiple responsibilities, such as segregating access for billing vs. analytics. The generated bearer tokens are valid for 60 minutes and can only execute operations permitted by the permissions associated with the designated role.

Tip

See the full example in the samples directory: scoped_token_generation.go See docs.skyflow.com for more details on authentication, access control, and governance for Skyflow.

import (
"fmt"
saUtil "github.com/skyflowapi/skyflow-go/v2/serviceaccount""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
/** * Example program to generate a Scoped Token using Skyflow's BearerToken utility. * The token is generated by providing the file path to the credentials.json file * and specifying roles associated with the token. */funcScopedTokenGenerationExample() {
// Variable to store the generated scoped tokenvarscopedTokeninterface{}
// Example: Generate Scoped Token by specifying the credentials.json file path// Create a list of roles that the generated token will be scoped tovarroles= []string{"<ROLE_ID_1>", "<ROLE_ID_2>", "<ROLE_ID_3>"}
// Specify the full file path to the service account's credentials.json filevarfilePath="<YOUR_CREDENTIALS_FILE_PATH>"// Create a BearerToken using the credentials file and associated rolesres, err:=saUtil.GenerateBearerToken(filePath, common.BearerTokenOptions{LogLevel: logger.DEBUG, RoleIds: roles}) // Set the roles that the token should be scoped toiferr!=nil {
fmt.Println("Errors", *err)
} else {
// retrieve tokenfmt.Println("Token", res.AccessToken)
}
// Retrieve the generated scoped tokenscopedToken=res.AccessToken// Print the generated scoped token to the consolefmt.Println(scopedToken);
}

Generate signed data tokens

Skyflow generates data tokens when sensitive data is inserted into the vault. These data tokens can be digitally signed with a service account's private key, adding an extra layer of protection. Signed tokens can only be detokenized by providing the signed data token along with a bearer token generated from the service account's credentials. The service account must have the necessary permissions and context to successfully detokenize the signed data tokens.

Tip

See the full example in the samples directory: signed_token_generation.go See docs.skyflow.com for more details on authentication, access control, and governance for Skyflow.

import (
"fmt"
saUtil "github.com/skyflowapi/skyflow-go/v2/serviceaccount""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
// Example program to generate Signed Data Tokens using Skyflow's SignedDataTokens utility.// Signed Data Tokens can be generated in two ways:// 1. By specifying the file path to the credentials.json file.// 2. By providing the credentials as a JSON string.funcSignedTokenGenerationExample() {
// Example 1: Generate Signed Data Tokens by specifying the credentials.json file path// File path to the service account's credentials.json filevarfilePath="<YOUR_CREDENTIALS_FILE_PATH>";
// Context value to associate with the tokenvarcontext="abc";
vartokens []stringtokens=append(tokens, "<TOKEN>") // List of data tokens to sign; replace with your actual data tokens// Build the SignedDataTokensOptions object using the file path and required configurationsoptions:= common.SignedDataTokensOptions{
Ctx: context, // Set the context valueDataTokens: tokens, // Set the data tokens to be signedTimeToLive: 60, // Set the token's time-to-live (TTL) in secondsLogLevel: logger.ERROR,
}
// Generate and retrieve the signed data tokensres, err:=saUtil.GenerateSignedDataTokens(filePath, options)
iferr!=nil {
fmt.Println("Error occurred ", err)
} else {
// retrieve the signed data tokens fmt.Println("RESPONSE:", res)
}
// Example 2: Generate Signed Data Tokens by specifying credentials as a JSON string// Provide the credentials JSON content as a stringvarfileContents="<YOUR_CREDENTIALS_FILE_CONTENTS_AS_STRING>";
// Context value to associate with the tokencontext="abc";
tokens=niltokens=append(tokens, "<TOKEN>")
// Create the SignedDataTokensOptions object using the required configurationsoptions= common.SignedDataTokensOptions{
DataTokens: tokens, // Set the data tokens to be signedTimeToLive: 60, // in secondsLogLevel: logger.ERROR,
}
// Generate and retrieve the signed data tokensres, err=saUtil.GenerateSignedDataTokensFromCreds(fileContents, options)
iferr!=nil {
fmt.Println("Error occurred ", err)
} else {
// retrieve the signed data tokens fmt.Println("RESPONSE: ", res)
}
}

Response:

[
{
"Token":"5530-4316-0674-5748",
"signedToken":"signed_token_eyJhbGciOiJSUzI1NiJ9.eyJpc3MiOiJzLCpZjA"
}
]

Notes:

The time to live (TTL) value should be specified in seconds.
By default, the TTL value is set to 60 seconds.

Bearer token expiry edge case

When you use bearer tokens for authentication and API requests in SDKs, there's the potential for a token to expire after the token is verified as valid but before the actual API call is made, causing the request to fail unexpectedly due to the token's expiration. An error from this edge case would look something like this:

message: Authentication failed. Bearer token is expired. Use a valid bearer token. See https://docs.skyflow.com/api-authentication/

If you encounter this kind of error, retry the request. During the retry, the SDK detects that the previous bearer token has expired and generates a new one for the current and subsequent requests.

Tip

See the full example in the samples directory: bearer_token_expiry_example.go See docs.skyflow.com for more details on authentication, access control, and governance for Skyflow.

package serviceaccount
import (
"context""fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/error""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
// * This example demonstrates how to configure and use the Skyflow SDK// * to detokenize sensitive data stored in a Skyflow vault.// * It includes setting up credentials, configuring the vault, and// * making a detokenization request. The code also implements a retry// * mechanism to handle unauthorized access errors (HTTP 401).funcDetokenizeData(skyflowClient, vaultID) error.SkyflowError {
service, serviceError:=skyflowInstance.Vault(vaultID)
ifserviceError!=nil {
fmt.Println(serviceError)
returnserviceError
} else {
ctx:=context.TODO()
// Creating a list of tokens to be detokenizeddetokenizeData:= []common.DetokenizeData{
{
Token: "<TOKEN1>",
RedactionType: common.REDACTED,
},
{
Token: "<TOKEN2>",
RedactionType: common.MASKED,
},
}
// Building a detokenization requestreq:= common.DetokenizeRequest{DetokenizeData: detokenizeData}
// Sending the detokenization request and receiving the responseres, errDetokenize:=service.Detokenize(ctx, req, common.DetokenizeOptions{
ContinueOnError: true,
})
iferrDetokenize!=nil {
fmt.Println("Unexpected error occurred: ", errDetokenize)
returnerrDetokenize
} else {
// Printing the detokenized responsefmt.Println("Skyflow error occurred: ", res)
}
}
returnnil
}
funcmain(){
// Setting up credentials for accessing the Skyflow vault// Credentials string for authenticationcredentials:= common.Credentials{
CredentialsString: "<STRINGIFIED_JSON_VALUE>", }
// Configuring the Skyflow vault with necessary detailsprivaryVaultConfig:= common.VaultConfig{
VaultId: "<YOUR_VAULT_ID1>",
ClusterId: "<YOUR_CLUSTER_ID1>",
Env: common.DEV,
Credentials: credentials,
}
// Create a new Skyflow clientskyflowClient, err:=client.NewSkyflow(
client.WithVaults(privaryVaultConfig),
client.WithCredentials(credentials),
client.WithLogLevel(logger.DEBUG),
)
iferr!=nil {
fmt.Println("Error creating Skyflow client:", err)
return
}
// Attempting to detokenize data using the Skyflow clienterr=DetokenizeData(skyflowClient, "<VAULT_ID>")
iferr!=nil {
fmt.Println("Error detokenizing data:", err)
// Retry detokenization if the error is due to unauthorized access (HTTP 401)iferr.GetCode() =="401" {
fmt.Println("Unauthorized access. Retrying...")
err2:=DetokenizeData(skyflowClient, "<VAULT_ID>")
iferr2!=nil {
fmt.Println("Error detokenizing data on retry:", err2)
} else {
fmt.Println("Detokenization successful on retry")
}
}
return
} else {
fmt.Println("Detokenization successful")
}
}

Logging

The Skyflow Go SDK provides useful logging using go's built-in logging library. By default, the SDK's logging level is set to LogLevel.ERROR. This can be changed using the UpdateLogLevel(logLevel) method as shown below.

Currently, the following five log levels are supported:

DEBUG:
When LogLevel.DEBUG is passed, logs at all levels will be printed (DEBUG, INFO, WARN, ERROR).
INFO:
When LogLevel.INFO is passed, INFO logs for every event that occurs during SDK flow execution will be printed, along with WARN and ERROR logs.
WARN:
When LogLevel.WARN is passed, only WARN and ERROR logs will be printed.
ERROR:
When LogLevel.ERROR is passed, only ERROR logs will be printed.
OFF: LogLevel.OFF can be used to turn off all logging from the Skyflow Go SDK.

Note: The ranking of logging levels is as follows: DEBUG < INFO < WARN < ERROR < OFF.

Example: Setting LogLevel to INFO

package main
import (
"fmt""github.com/skyflowapi/skyflow-go/v2/client""github.com/skyflowapi/skyflow-go/v2/utils/common""github.com/skyflowapi/skyflow-go/v2/utils/logger"
)
/** * This example demonstrates how to configure the Skyflow client with custom log levels * and authentication credentials (either token, credentials string, or other methods). * It also shows how to configure a vault connection using specific parameters. * * 1. Set up credentials with a Bearer token or credentials string. * 2. Define the Vault configuration. * 3. Build the Skyflow client with the chosen configuration and set log level. * 4. Example of changing the log level from ERROR (default) to INFO. */funcmain() {
// Step 1: Set up credentials - either pass token or use credentials string// In this case, we are using a Bearer token for authentication.credentials:= common.Credentials{
Token: "<BEARER_TOKEN>", // Replace with the actual Bearer token
}
// Step 2: Define the Vault configuration// Configure the vault with necessary details like vault ID, cluster ID, and environmentconfig:= common.VaultConfig{
VaultId: "<VAULT_ID>", // Replace with the actual Vault ID (first vault)ClusterId: "<CLUSTER_ID>", // Replace with the actual Cluster ID (from vault URL)Env: common.DEV, // Set the environment (default is DEV, can also use PROD)Credentials: credentials,
}
credentialString:="<CREDENTIAL_AS_JSON_STRING>"skyflowCredentials:= common.Credentials{
CredentialsString: credentialString,
}
// Step 2: Define the Vault configuration// Create an array of Vault configurations to be used for multiple Vaults.vararr []common.VaultConfigarr=append(arr, config) // Add Vault configurations to the array// Step 3: Build the Skyflow client with the chosen configuration and log level// Using the Vault configurations and setting the log level to DEBUG.skyflowClient, err:=client.NewSkyflow(
client.WithVaults(arr...), // Add the Vault configurations from the arrayclient.WithCredentials(skyflowCredentials), // Use Skyflow credentials if no token is passedclient.WithLogLevel(logger.INFO), // Set log level to INFO (default is ERROR)
)
// Step 4: Handle any errors that occur during client creationiferr!=nil {
// Print the error if something went wrong during client initializationfmt.Println("Error occurred while creating Skyflow client:", err)
} else {
skyflowClient.UpdateLogLevel(logger.DEBUG)
}
// Step 5: Client is now ready to use with the specified log level and credentialsfmt.Println("Skyflow client has been successfully configured with log level: DEBUG.")
}

Error handling

Catching SkyflowError instances

All SDK methods return *skyflowError.SkyflowError as the error type. Check for nil before accessing the error fields.

SkyflowError methods:

Method	Return type	Description
`GetMessage()`	`string`	Human-readable error message.
`GetHttpStatusCode()`	`string`	HTTP status code (e.g. `"400"`, `"401"`). Preferred over `GetCode()`.
`GetHttpCode()`	`string`	Alias for `GetHttpStatusCode()`.
`GetCode()`	`string`	Error code. Deprecated — use `GetHttpStatusCode()` instead.
`GetRequestId()`	`string`	Request ID for tracing and support.
`GetGrpcCode()`	`string`	gRPC status code when applicable.
`GetDetails()`	`[]interface{}`	Structured error details array from the API response.
`GetResponseBody()`	`map[string]interface{}`	Raw response body from the API.

import (
"fmt"
skyflowError "github.com/skyflowapi/skyflow-go/v2/utils/error"
)
res, err:=service.Insert(ctx, insertRequest)
iferr!=nil {
fmt.Println("HTTP status:", err.GetHttpStatusCode())
fmt.Println("message:", err.GetMessage())
fmt.Println("request ID:", err.GetRequestId())
fmt.Println("details:", err.GetDetails())
}
_=res

Bearer token expiration edge cases

When using bearer tokens for authentication, a token may expire after validation but before the actual API call completes. This causes the request to fail unexpectedly. An error from this edge case looks like this:

message: Authentication failed. Bearer token is expired. Use a valid bearer token. See https://docs.skyflow.com/api-authentication/

If you encounter this kind of error, retry the request. During the retry, the SDK detects that the previous bearer token has expired and generates a new one for the current and subsequent requests.

Security

Reporting a Vulnerability

If you discover a potential security issue in this project, please reach out to us at security@skyflow.com. Please refrain from creating public GitHub issues or pull requests, as malicious actors could potentially view them.

Name		Name	Last commit message	Last commit date
Latest commit History 333 Commits
.github/workflows		.github/workflows
Rule		Rule
commonutils		commonutils
docs		docs
samples		samples
serviceaccount		serviceaccount
skyflow		skyflow
test		test
v2		v2
.gitignore		.gitignore
CHANGELOG.md		CHANGELOG.md
LICENSE		LICENSE
README-v1.md		README-v1.md
README.md		README.md
SECURITY.md		SECURITY.md
codecov.yml		codecov.yml
go.mod		go.mod
go.sum		go.sum

Uh oh!

Folders and files

Latest commit

History

Repository files navigation

Description

Table of Contents

Overview

Install

Requirements

Configuration

Quickstart

Authenticate

API Key

Bearer Token (static)

Initialize the client

Insert data into the vault, get tokens back

Upgrade from v1 to v2

Vault

Insert data into the vault

Construct an insert request

Insert example with ContinueOnError option

Upsert request

Detokenize

Construct a detokenize request

Tokenize

Constructing your Tokenize request

Get

Constructing your get request:

Get by skyflow IDs

Get tokens

Get By column name and column values

GetOptions fields

Redaction types

Update

Construct an update request

Delete

Construct a delete request

Query

Construct a query request

Upload File

Construct an File upload request

Note:

Custom Request Headers

Supported headers

Client-level custom headers

Request-level custom headers

Detect

Deidentify Text

Reidentify Text

Deidentify File

Get run

Connections

Invoke Connection

Construct an invoke connection request

Client management

Vault management

Connection management

Credential management

Log level management

Authentication & authorization

Types of credentials

Generate bearer tokens for authentication & authorization

Generate a bearer token

Generate bearer tokens with context

Generate scoped bearer tokens

Generate signed data tokens

Bearer token expiry edge case

Logging

Example: Setting LogLevel to INFO

Error handling

Catching SkyflowError instances

Bearer token expiration edge cases

Security

Reporting a Vulnerability

About

Topics

Resources

Security policy

Stars

Insert example with `ContinueOnError` option

`GetOptions` fields