Anonymize Dataset
data.anonymize_dataset
Overview
When you send columns, rows, and an explicit per-column policy, we transform values deterministically (drop, null, constant, mask, truncate, hash, hmac_token, bucket, round, date_shift, generalize, shuffle) and return transformed rows plus a per-column report. We validate the whole policy before touching any row. Same data, policy, secret, and seed yield identical output — do not use this as proof of legal anonymization or GDPR compliance.
Ad-hoc masking is inconsistent. We apply the policy you declare the same way every time.
Reliability
Give us the same rows, policy, secret and seed and you get byte-identical output, which is what makes tokens joinable across exports. Feeding the result back in changes it again, so anonymize once from the source. We check the whole policy before touching a single row: a bad rule fails the call rather than leaving you half-transformed, and your key is never echoed back or folded into policyDigest. What we cannot promise is legal anonymity — a rare combination of quasi-identifiers can still single someone out. Five errors can come back, none of them retryable unchanged: ANONYMIZATION_POLICY_INVALID — trigger: an action we do not know, a missing parameter such as value, length, step, boundaries or mapping, or more than 1,000 columns; retryable: no; next: fix that rule and call again. ANONYMIZATION_COLUMN_NOT_FOUND — trigger: a rule names a column missing from your columns list while failOnUnknownColumn is on; retryable: no; next: correct the name or set the option to false to skip it. ANONYMIZATION_TYPE_MISMATCH — trigger: date_shift met text that is not an ISO date like 2026-03-14; retryable: no; next: reformat the column or switch action. ANONYMIZATION_DATE_OVERFLOW — trigger: shifting a date pushed it outside the supported calendar range; retryable: no; next: lower maxDays. ANONYMIZATION_SECRET_REQUIRED — trigger: an hmac_token rule without a key; retryable: no; next: add key to that rule and keep the same key across exports you want to join.
Context footprint
Returns transformed rows, columnStats, warnings, policyDigest, and optional _meta. A successful call costs 1 execution credit.
When to use it
When you can specify columns, rows, and an explicit transform policy.
When you need a certified legal anonymization guarantee.
Scope
Non-goals
- Does not certify legal anonymization
- Does not auto-detect PII
- Does not return raw secrets
Properties
Capabilities
Cost & billing
Flat rate per invocation
File handling
How we handle your data
What this means
This skill is designed to detect, mask, redact, validate, or otherwise process sensitive data.
Squillify guarantees
- Runs inside Squillify
- This skill runs inside Squillify.
- Payloads are not sent to an external service by this skill.
- Squillify does not permanently store submitted payloads.
- Telemetry records metadata only, not submitted content.
- Submitted payloads are not used for training.
- Submitted payloads are not reviewed by humans.
- Targets sensitive data
- The response may contain submitted or transformed content.
Your responsibility
Squillify does not determine whether submitted content is sensitive. Your application is responsible for deciding what data it is allowed to submit. Your application is responsible for securing the response.
Input schema
| Field | Type | Required | Description |
|---|---|---|---|
| columns | array | Yes | Bounded array of 1 through 1000 input column names in the order they should return. |
| rows | array | Yes | Bounded array of 0 through 200000 input row objects keyed by column name, where missing keys count as null. |
| policy | array | Yes | Bounded array of 0 through 1000 closed per-column rules; a column with no rule passes through. |
| options | object | No | Closed optional run knobs; omit the object to keep seed 42, preserveNulls true, and failOnUnknownColumn true. |
Output schema
| Field | Type | Required | Description |
|---|---|---|---|
| columns | array | Yes | Bounded array of 0 through 1000 surviving column names after drop rules were applied. |
| rows | array | Yes | Bounded array of 0 through 200000 result row objects keyed by column name after this skill transformed the table. |
| columnStats | object | Yes | Purpose-bound tally keyed by policy column name; extra keys are those columns and a missing key means the column was dropped or untouched. |
| warnings | array | Yes | Bounded array of 0 through 1000 closed findings such as ANONYMIZATION_WEAK_TRANSFORM. |
| policyDigest | string | Yes | 16-character fingerprint of the applied policy with secrets omitted. |
| _meta | object | No | Closed provenance naming the transform rules and how many rows came back. |
API contract
POST /v1/executecurl -sS -X POST "$BASE/v1/execute" -H "Authorization: Bearer $KEY" -H 'Content-Type: application/json' -d '{"skillKey":"data.anonymize_dataset","input":{"columns":["age"],"rows":[{"age":37}],"policy":[{"column":"age","action":"round","step":10}]}}'import { Squillify } from "@squillify/sdk";
const sq = new Squillify({ apiKey: process.env.SQUILLIFY_API_KEY });
const { output } = await sq.execute("data.anonymize_dataset", {"rows":[{"name":"Alice","age":37}],"policy":[{"column":"name","action":"drop"},{"action":"bucket","boundaries":[0,18,30,45,65,200],"column":"age"}],"columns":["name","age"]});Errors
| Code | HTTP | Retryable | Description |
|---|---|---|---|
| VALIDATION_ERROR | 400 | No | The request payload failed schema validation. |
| UNAUTHORIZED | 401 | No | Missing or invalid API key. |
| SKILL_NOT_ACCESSIBLE | 403 | No | The API key is not granted access to this skill. |
| SKILL_NOT_AVAILABLE_FOR_PLAN | 403 | No | This skill is not included in your current plan. |
| PLAN_ELIGIBILITY_UNAVAILABLE | 503 | Yes | Plan eligibility could not be decided. Retry after backoff. |
| SKILL_NOT_FOUND | 404 | No | The requested skill or version does not exist. |
| TENANT_RATE_LIMITED | 429 | Yes | Request rate limit exceeded. Retry after backoff. |
| QUOTA_EXCEEDED | 429 | Yes | Plan quota exhausted. Retryable once the quota period resets. |
| EXECUTION_TIMEOUT | 504 | Yes | Execution exceeded the allowed time budget. |
| ANONYMIZATION_POLICY_INVALID | 400 | No | The request payload failed this skill's input validation. |
| ANONYMIZATION_COLUMN_NOT_FOUND | 400 | No | The request payload failed this skill's input validation. |
| ANONYMIZATION_TYPE_MISMATCH | 400 | No | The request payload failed this skill's input validation. |
| ANONYMIZATION_DATE_OVERFLOW | 400 | No | The request payload failed this skill's input validation. |
| ANONYMIZATION_SECRET_REQUIRED | 412 | No | The input is valid but cannot be processed as-is. |
Other limits
| Limit | Value |
|---|---|
| Recommended inline bytes | 32 KiB |
Limitations
- Does not certify legal anonymization
- Does not auto-detect PII
- Does not return raw secrets
- Claiming a dataset is legally anonymous
- Reversible tokens without a secret
How to call
POST /v1/execute (requires authentication)
{
"skillKey": "data.anonymize_dataset",
"input": {
"rows": [
{
"name": "Alice",
"age": 37
}
],
"policy": [
{
"column": "name",
"action": "drop"
},
{
"action": "bucket",
"boundaries": [
0,
18,
30,
45,
65,
200
],
"column": "age"
}
],
"columns": [
"name",
"age"
]
}
}Examples
Drop name and bucket age
{
"rows": [
{
"name": "Alice",
"age": 37
}
],
"policy": [
{
"column": "name",
"action": "drop"
},
{
"action": "bucket",
"boundaries": [
0,
18,
30,
45,
65,
200
],
"column": "age"
}
],
"columns": [
"name",
"age"
]
}{
"policyDigest": "50d8326c5d473e9e",
"_meta": {
"policyVersion": "anonymize-1",
"rowsTransformed": 1
},
"rows": [
{
"age": "[30,45)"
}
],
"columns": [
"age"
],
"warnings": [],
"columnStats": {
"age": {
"transformed": 1
}
}
}Round numeric values to a step
{
"rows": [
{
"age": 37
}
],
"policy": [
{
"action": "round",
"step": 10,
"column": "age"
}
],
"columns": [
"age"
]
}{
"policyDigest": "f20333391323d3d1",
"_meta": {
"policyVersion": "anonymize-1",
"rowsTransformed": 1
},
"rows": [
{
"age": 40
}
],
"columns": [
"age"
],
"warnings": [],
"columnStats": {
"age": {
"transformed": 1
}
}
}Recommended use cases
- Drop or mask identifiers before sharing
- Bucket ages or dates deterministically
- Pseudonymize with HMAC tokens when you supply a secret
Avoid for
- Claiming a dataset is legally anonymous
- Reversible tokens without a secret
Related skills
Composable with
Safety & privacy
- Runs without calling any external service.
- Your payloads are never stored permanently.
- Telemetry captures metadata only — never your payload contents.
- We never train models on your payloads.
- No human reviews your payloads.