system.masking_policies

System table containing information about all masking policies in the system.

Description

Contains information about all masking policies defined in the system.

Masking policies can only be created and applied in ClickHouse Cloud. In open-source builds the system.masking_policies table is always empty, but it is still present so that introspection queries such as SHOW MASKING POLICIES work and return an empty result instead of throwing.

Columns

• name (String) — Name of a masking policy. The full name format is short_name ON database.table.
• short_name (String) — Short name of a masking policy. For example, if the full name is mask_email ON mydb.mytable, the short name is mask_email.
• database (String) — Database name.
• table (String) — Table name.
• id (UUID) — Masking policy ID.
• storage (String) — Name of the directory where the masking policy is stored.
• update_assignments (Nullable(String)) — UPDATE assignments that define how data should be masked. For example: email = '***masked***', phone = '***-***-****'.
• where_condition (Nullable(String)) — Optional WHERE condition that specifies when the masking should be applied.
• priority (Int64) — Priority for applying multiple masking policies. Higher priority policies are applied first. Default is 0.
• apply_to_all (UInt8) — Shows whether the masking policy applies to all roles and/or users. 1 if true, 0 otherwise.
• apply_to_list (Array(String)) — List of the roles and/or users to which the masking policy is applied.
• apply_to_except (Array(String)) — The masking policy is applied to all roles and/or users except the listed ones. Only populated when apply_to_all is 1.