To hide sensitive data exchanged between API consumers and API implementations while allowing the conversion of tokenized fields back to their original values for other API requests or responses, the best approach is to use tokenization. This involves:
* Tokenization Format: Create a tokenization format that will be used to apply a tokenization policy in the API gateway. This format ensures that sensitive fields in message payloads are replaced with tokenized values that maintain a similar format, making them less recognizable as sensitive data.
* Tokenization Policy: Apply a tokenization policy in the API gateway that replaces sensitive data with tokenized values.
* Detokenization Policy: Apply a corresponding detokenization policy in the API gateway to convert tokenized values back to their original values when required by other APIs.
This method does not require recoding the API implementations and ensures that sensitive data is protected while still being accessible in its original form when necessary.
References
* MuleSoft Documentation on Tokenization Policies
* API Gateway Security Best Practices