In Apigee, to prevent sensitive data from being exposed in trace or debug sessions, you must assign it to a private variable. The private. prefix is a specific mechanism used to designate a variable as private. When a value is retrieved from an encrypted Key Value Map (KVM) using the KeyValueMapOperations policy and assigned to a variable with this prefix (e.g., private.mysecret), Apigee's trace tool will not capture or display its value. This is a critical security practice for handling credentials, tokens, or other confidential information.

A. encrypted: This term describes the state of the KVM itself, not a variable prefix used to hide data in a trace session.

B. mask: While related to the concept of data masking, private. is the specific, required prefix for the variable name to prevent its capture.

C. kvm: This is a common, conventional prefix for KVM-related variables but provides no inherent security or masking functionality in trace.

E. hidden: This is not a recognized or functional variable prefix within Apigee for masking data in trace sessions.

1. Google Cloud

Apigee Documentation

"KeyValueMapOperations policy": Under the section for the element

the documentation explicitly states: "To retrieve the value into a private variable that will not be visible in a Trace session

use the private. prefix on the variable name in the assignTo attribute."

2. Google Cloud

Apigee Documentation

"Working with key value maps": In the section "Retrieving values from a KVM

" the documentation notes the use of the private. prefix for sensitive data: "If the data is sensitive

use the private. prefix in the variable name... The private. prefix masks the variable in Trace and debug sessions."