dlpSensitiveInformationTypes

Sensitive Information Types. Define the sensitive data patterns that DLP policies look for. The dlpSensitiveInformationTypes entity set lives under /exchange/v1.0/dlpSensitiveInformationTypes in the Governance & protection category.

Fact	Value
Path	`/exchange/v1.0/dlpSensitiveInformationTypes`
Category	Governance & protection
Tier	Tier 5, Compliance
Read role	`Compliance.IPPS.Read.All` (Community)
Write role	`Compliance.IPPS.ReadWrite.All` (Enterprise)
Backing cmdlets	Get-DlpSensitiveInformationType, New-DlpSensitiveInformationType, Set-DlpSensitiveInformationType, Remove-DlpSensitiveInformationType

Routes

Method	Path	Synopsis	Role	Plan
GET	`/exchange/v1.0/dlpSensitiveInformationTypes`	List custom DLP sensitive-information types - tenant-defined patterns extending Microsoft’s built-in catalog.	`Compliance.IPPS.Read`	Community
POST	`/exchange/v1.0/dlpSensitiveInformationTypes`	POST /dlpSensitiveInformationTypes - create a custom SIT. Optional body: name, description, fileData (base64), fingerprints, isExact, locale, thresholdConfig. Returns 201 + Location (or 204 if no name was supplied).	`Compliance.IPPS.ReadWrite`	Enterprise
GET	`/exchange/v1.0/dlpSensitiveInformationTypes/{key}`	Get a single DLP sensitive-information type by Identity. Use ?includeDetails / ?includeElements to expand the matching-logic detail. Returns 404 if absent.	`Compliance.IPPS.Read`	Community
PATCH	`/exchange/v1.0/dlpSensitiveInformationTypes/{key}`	PATCH /dlpSensitiveInformationTypes/{key} - partial update. Returns 200 + post-Set SIT.	`Compliance.IPPS.ReadWrite`	Enterprise
DELETE	`/exchange/v1.0/dlpSensitiveInformationTypes/{key}`	DELETE /dlpSensitiveInformationTypes/{key} - remove a custom SIT. Returns 204.	`Compliance.IPPS.ReadWrite`	Enterprise

GET /exchange/v1.0/dlpSensitiveInformationTypes

List custom DLP sensitive-information types - tenant-defined patterns extending Microsoft’s built-in catalog.

Backing cmdlet: Get-DlpSensitiveInformationType. Role: Compliance.IPPS.Read (Community).

Parameter	In	Type	Description
`includeDetails`	query	bool (switch)	Include full element/pattern detail (regex/keyword/confidence configuration) rather than the summary view.
`includeElements`	query	string	Return only specific primitive matching elements (ClassificationPrimitiveElementType enum, e.g. Func \| Keyword \| Regex). Invalid values are rejected by the cmdlet.
`capability`	query	string	Filter by classification capability (e.g. matching capability the SIT supports). Passed through to the cmdlet.

List DLP sensitive information types

Returns the data loss prevention (DLP) sensitive information types (SITs) available in the tenant, including the Microsoft built-in entity definitions and any custom SITs.

GET /exchange/v1.0/dlpSensitiveInformationTypes HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#dlpSensitiveInformationTypes",
  "value": [
    {
      "Id": "005b3ef1-47dd-4e68-bb02-c6db484d00f2",
      "Identity": "005b3ef1-47dd-4e68-bb02-c6db484d00f2",
      "Name": "Croatia Driver's License Number",
      "Description": "Detects Croatia Driver's License Number",
      "Locale": null,
      "Publisher": "Microsoft Corporation",
      "IsExact": false,
      "Threshold": null,
      "Fingerprints": [],
      "CreatedDateTime": null,
      "LastModifiedDateTime": null,
      "AllLocalizedDescriptions": [
        "[en-US",
        "Detects Croatia Driver's License Number]"
      ],
      "AllLocalizedNames": [
        "[en-US",
        "Croatia Driver's License Number]"
      ],
      "BaseId": "00000000-0000-0000-0000-000000000000",
      "BaseType": "None",
      "Capability": "Standard",
      "Classifier": "Content",
      "Clonable": "Allowed",
      "DefaultCulture": "en-US",
      "DlpSensitiveInformationTypeRuleCollection": "Microsoft Rule Package",
      "FormalName": "",
      "Guidance": null,
      "HighConfidenceLevelEntityDetails": null,
      "IsOutOfBox": true,
      "LastModifiedTime": "2023-01-01T00:00:00Z",
      "LocalizedName": "Croatia Driver's License Number",
      "LowConfidenceLevelEntityDetails": null,
      "MediumConfidenceLevelEntityDetails": null,
      "MinEngineVersion": "15.20.3150.0",
      "PerfEvaluationState": "NotAvailable",
      "PhysicalInstanceID": null,
      "PrimitiveElementDetails": null,
      "PrimitiveType": 0,
      "RecommendedConfidence": 75,
      "RecommendedConfidenceLevel": "Medium",
      "RulePackId": "00000000-0000-0000-0000-000000000000",
      "State": "Production",
      "ThresholdConfig": null,
      "Type": "Entity",
      "WhenChanged": null
    },
    {
      "Id": "019b39dd-8c25-4765-91a3-d9c6baf3c3b3",
      "Identity": "019b39dd-8c25-4765-91a3-d9c6baf3c3b3",
      "Name": "Philippines Unified Multi-Purpose ID Number",
      "Description": "Detects Philippines Unified Multi-Purpose ID numbers",
      "Locale": null,
      "Publisher": "Microsoft Corporation",
      "IsExact": false,
      "Threshold": null,
      "Fingerprints": [],
      "CreatedDateTime": null,
      "LastModifiedDateTime": null,
      "AllLocalizedDescriptions": [
        "[en-US",
        "Detects Philippines Unified Multi-Purpose ID numbers]"
      ],
      "AllLocalizedNames": [
        "[en-US",
        "Philippines Unified Multi-Purpose ID Number]"
      ],
      "BaseId": "00000000-0000-0000-0000-000000000000",
      "BaseType": "None",
      "Capability": "Standard",
      "Classifier": "Content",
      "Clonable": "Allowed",
      "DefaultCulture": "en-US",
      "DlpSensitiveInformationTypeRuleCollection": "Microsoft Rule Package",
      "FormalName": "",
      "Guidance": null,
      "HighConfidenceLevelEntityDetails": null,
      "IsOutOfBox": true,
      "LastModifiedTime": "2023-01-01T00:00:00Z",
      "LocalizedName": "Philippines Unified Multi-Purpose ID Number",
      "LowConfidenceLevelEntityDetails": null,
      "MediumConfidenceLevelEntityDetails": null,
      "MinEngineVersion": "15.1.191.0",
      "PerfEvaluationState": "NotAvailable",
      "PhysicalInstanceID": null,
      "PrimitiveElementDetails": null,
      "PrimitiveType": 0,
      "RecommendedConfidence": 75,
      "RecommendedConfidenceLevel": "Medium",
      "RulePackId": "00000000-0000-0000-0000-000000000000",
      "State": "Production",
      "ThresholdConfig": null,
      "Type": "Entity",
      "WhenChanged": null
    }
  ]
}

POST /exchange/v1.0/dlpSensitiveInformationTypes

POST /dlpSensitiveInformationTypes - create a custom SIT. Optional body: name, description, fileData (base64), fingerprints, isExact, locale, thresholdConfig. Returns 201 + Location (or 204 if no name was supplied).

Backing cmdlet: New-DlpSensitiveInformationType. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type
`description`	body
`fileData`	body
`fingerprints`	body
`isExact`	body
`locale`	body
`name`	body
`thresholdConfig`	body
`dryRun`	query	bool (switch)

Create a custom DLP sensitive information type

Provision a custom DLP SIT beyond Microsoft’s built-in catalog via New-DlpSensitiveInformationType on the IPPS pool. Two creation modes (cmdlet enforces a parameter-set mutex): (a) fileData mode - upload an XML payload (base64) defining regexes + keywords + confidence levels; (b) fingerprints mode - reference one or more pre-uploaded DlpFingerprint identities. -Name is OPTIONAL per Wiki SYNTAX (positional [[-Name]]); supplying one lets the API return a deterministic Location header.

POST /exchange/v1.0/dlpSensitiveInformationTypes HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "name": "Contoso-Internal-Customer-ID",
  "description": "Pattern: CST-XXXX-XXXX (Contoso internal customer identifier).",
  "fileData": "PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+PFJ1bGVQYWNrYWdlPi4uLjwvUnVsZVBhY2thZ2U+",
  "isExact": false,
  "locale": "en-US"
}

HTTP/1.1 201 Created
Location: /exchange/v1.0/dlpSensitiveInformationTypes/Contoso-Internal-Customer-ID

{
  "@odata.context": "https://api.contoso.com/exchange/v1.0/$metadata#dlpSensitiveInformationTypes/$entity",
  "Id": "sit-contoso-internal-customer-id",
  "Name": "Contoso-Internal-Customer-ID",
  "Identity": "sit-contoso-internal-customer-id",
  "Description": "Pattern: CST-XXXX-XXXX (Contoso internal customer identifier).",
  "Locale": "en-US",
  "IsExact": false,
  "Publisher": "00000003-0000-0ff1-ce00-000000000000",
  "CreatedDateTime": "2026-05-26T10:00:00Z"
}

GET /exchange/v1.0/dlpSensitiveInformationTypes/{key}

Get a single DLP sensitive-information type by Identity. Use ?includeDetails / ?includeElements to expand the matching-logic detail. Returns 404 if absent.

Backing cmdlet: Get-DlpSensitiveInformationType. Role: Compliance.IPPS.Read (Community).

Parameter	In	Type	Required	Description
`includeDetails`	query	bool (switch)		Include full element/pattern detail (regex/keyword/confidence configuration) rather than the summary view.
`includeElements`	query	string		Return only specific primitive matching elements (ClassificationPrimitiveElementType enum, e.g. Func \| Keyword \| Regex). Invalid values are rejected by the cmdlet.

Get a DLP sensitive information type by key

Retrieve a single DLP sensitive information type (SIT) by its identifier, including its localized names, confidence levels, and rule-package metadata.

GET /exchange/v1.0/dlpSensitiveInformationTypes/{key} HTTP/1.1
Authorization: Bearer {token}

HTTP/1.1 200 OK

{
  "@odata.context": "http://localhost:5043/exchange/v1.0/$metadata#dlpSensitiveInformationTypes/$entity",
  "Id": "005b3ef1-47dd-4e68-bb02-c6db484d00f2",
  "Identity": "005b3ef1-47dd-4e68-bb02-c6db484d00f2",
  "Name": "Croatia Driver's License Number",
  "Description": "Detects Croatia Driver's License Number",
  "Locale": null,
  "Publisher": "Microsoft Corporation",
  "IsExact": false,
  "Threshold": null,
  "Fingerprints": [],
  "CreatedDateTime": null,
  "LastModifiedDateTime": null,
  "AllLocalizedDescriptions": [
    "[en-US",
    "Detects Croatia Driver's License Number]"
  ],
  "AllLocalizedNames": [
    "[en-US",
    "Croatia Driver's License Number]"
  ],
  "BaseId": "00000000-0000-0000-0000-000000000000",
  "BaseType": "None",
  "Capability": "Standard",
  "Classifier": "Content",
  "Clonable": "Allowed",
  "DefaultCulture": "en-US",
  "DlpSensitiveInformationTypeRuleCollection": "Microsoft Rule Package",
  "FormalName": "",
  "Guidance": null,
  "HighConfidenceLevelEntityDetails": null,
  "IsOutOfBox": true,
  "LastModifiedTime": "2023-01-01T00:00:00Z",
  "LocalizedName": "Croatia Driver's License Number",
  "LowConfidenceLevelEntityDetails": null,
  "MediumConfidenceLevelEntityDetails": null,
  "MinEngineVersion": "15.20.3150.0",
  "PerfEvaluationState": "NotAvailable",
  "PhysicalInstanceID": null,
  "PrimitiveElementDetails": null,
  "PrimitiveType": 0,
  "RecommendedConfidence": 75,
  "RecommendedConfidenceLevel": "Medium",
  "RulePackId": "00000000-0000-0000-0000-000000000000",
  "State": "Production",
  "ThresholdConfig": null,
  "Type": "Entity",
  "WhenChanged": null
}

PATCH /exchange/v1.0/dlpSensitiveInformationTypes/{key}

PATCH /dlpSensitiveInformationTypes/{key} - partial update. Returns 200 + post-Set SIT.

Backing cmdlet: Set-DlpSensitiveInformationType. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type
`description`	body
`fileData`	body
`fingerprints`	body
`isExact`	body
`locale`	body
`name`	body
`threshold`	body
`thresholdConfig`	body
`dryRun`	query	bool (switch)

Update a custom DLP sensitive information type

Partially update a tenant-defined DLP sensitive-information type. Backed by Set-DlpSensitiveInformationType (IPPS pool); only the supplied fields are changed.

PATCH /exchange/v1.0/dlpSensitiveInformationTypes/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

{
  "description": "EXONAUT sample SIT - updated description for contoso.com policy testing",
  "isExact": false,
  "locale": "en-US"
}

HTTP/1.1 200 OK
Content-Type: application/json

{
  "Id": "exonaut-sample-dlpSensitiveInformationTypes",
  "Identity": "exonaut-sample-dlpSensitiveInformationTypes",
  "Name": "exonaut-sample-dlpSensitiveInformationTypes",
  "Description": "EXONAUT sample SIT - updated description for contoso.com policy testing",
  "IsExact": false,
  "Locale": "en-US"
}

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

DELETE /exchange/v1.0/dlpSensitiveInformationTypes/{key}

DELETE /dlpSensitiveInformationTypes/{key} - remove a custom SIT. Returns 204.

Backing cmdlet: Remove-DlpSensitiveInformationType. Role: Compliance.IPPS.ReadWrite (Enterprise).

Parameter	In	Type	Required	Description
`dryRun`	query	bool (switch)

Delete a custom DLP sensitive information type

Remove a tenant-defined DLP sensitive-information type by Identity. Backed by Remove-DlpSensitiveInformationType (IPPS pool). Returns 204 No Content on success.

DELETE /exchange/v1.0/dlpSensitiveInformationTypes/{key} HTTP/1.1
Authorization: Bearer {token}
Content-Type: application/json

HTTP/1.1 204 No Content

Notes: Doc-derived from Wiki + write-param allowlist; not live-captured. Body fields are Wiki-valid; values are illustrative.

?dryRun=true previews of any write stay on Community.