# Mask

A mask: the regular expression to match, and how to rewrite the match. May also be written as a bare regex string when no replacement or preserved prefix is needed.

**Type**: `object`

## Properties

- name: preserveThrough (optional)
  type: string
  description: Delimiter ending a prefix of the match that is kept verbatim instead of being replaced. The match is split at the first occurrence of this text, so a regex matching "?token=abc123" with a delimiter of "=" keeps "?token=" and rewrites only the value. When the delimiter does not occur in the match, the whole match is replaced.

- name: regex (required)
  type: string
  description: Regular expression whose matches are rewritten. Must be compatible with Hyperscan syntax: no lookbehind and no backreferences. Prefer unbounded repeats (`+`, `*`) over bounded ones (`{1,50}`) — a bounded repeat is expanded into that many copies of the pattern and can exceed the compiler's size limit.

- name: replacement (optional)
  type: string
  description: Text substituted for the match. Defaults to the mask's label in square brackets, e.g. a mask labeled "email" becomes "[email]".