runtime dlp patterns

runtime dlp patterns list

List data patterns

airs runtime dlp patterns list [options]

Options

Flag	Required	Default	Description
--limit <n>	No	—	Max results per page (API page size)
--offset <n>	No	—	Starting offset — rounds down to a page boundary
--sort <field,dir>	No	—	Sort criteria (repeatable)
--output <fmt>	No	pretty	Output format

Examples

Pretty output (default)

airs runtime dlp patterns list --limit 2 --sort name,asc

Data Patterns:

000000000000000000000001
  API Credentials Client ID - Amazon Web Services AWS  predefined  disabled regex v1
000000000000000000000002
  API Credentials Client ID - Bitly  predefined  disabled regex v1

page=0 size=2 returned=2 total=1126

JSON output

airs runtime dlp patterns list --limit 2 --sort name,asc --output json

{
  "items": [
    {
      "id": "000000000000000000000001",
      "name": "API Credentials Client ID - Amazon Web Services AWS",
      "type": "predefined",
      "status": "disabled",
      "technique": "regex",
      "version": 1
    },
    {
      "id": "000000000000000000000002",
      "name": "API Credentials Client ID - Bitly",
      "type": "predefined",
      "status": "disabled",
      "technique": "regex",
      "version": 1
    }
  ],
  "page": {
    "number": 0,
    "size": 2,
    "total": 1126,
    "returned": 2
  }
}

YAML output

airs runtime dlp patterns list --limit 2 --sort name,asc --output yaml

items:
  - id: 000000000000000000000001
    name: API Credentials Client ID - Amazon Web Services AWS
    type: predefined
    status: disabled
    technique: regex
    version: 1
  - id: 000000000000000000000002
    name: API Credentials Client ID - Bitly
    type: predefined
    status: disabled
    technique: regex
    version: 1
page:
  number: 0
  size: 2
  total: 1126
  returned: 2

---

runtime dlp patterns create

Create a data pattern

airs runtime dlp patterns create [options]

Options

Flag	Required	Default	Description
--name <s>	No	—	Pattern name (required unless --body-file)
--type <s>	No	—	Pattern type: predefined
--description <s>	No	—	Pattern description
--technique <s>	No	—	Detection technique (default: regex)
--confidence-levels <csv>	No	—	Confidence levels CSV: e.g. high,low
--regex <pattern>	No	—	Regex with weight=1 (repeatable)
`--weighted-regex <PATTERN	N>`	No	—
--delimiter <s>	No	—	Delimiter for proximity matching
--proximity-distance <n>	No	—	Proximity window (2..1000)
--proximity-keyword <s>	No	—	Proximity keyword (repeatable)
--tag <k=v>	No	—	Tag (repeatable, value can be CSV)
`--body <json	->`	No	—
--body-file <path>	No	—	Raw JSON body file (escape hatch)
--output <fmt>	No	pretty	Output format

Examples

Create a custom regex pattern with --name + --regex flags

airs runtime dlp patterns create --name docs-example-pattern --regex '\bACME-\d{6}\b' --output json

{
  "action": "created",
  "id": "000000000000000000000003",
  "name": "docs-example-pattern",
  "type": "custom",
  "status": "active",
  "version": 1
}

---

runtime dlp patterns get

Get a data pattern by id

airs runtime dlp patterns get [options] <id>

Arguments

• id (required) —

Options

Flag	Required	Default	Description
--output <fmt>	No	pretty	Output format

Examples

Pretty output (default — predefined pattern)

airs runtime dlp patterns get 000000000000000000000001

Data Pattern:

  ID           000000000000000000000001
  Name         API Credentials Client ID - Amazon Web Services AWS
  Description  This pattern identifies an Amazon Web Services client ID.
  Type         predefined
  Status       disabled
  Technique    regex
  Confidence   high, low
  Version      1
  Updated      2026-05-25T15:50:58.037Z

JSON output

airs runtime dlp patterns get 000000000000000000000001 --output json

{
  "id": "000000000000000000000001",
  "name": "API Credentials Client ID - Amazon Web Services AWS",
  "description": "This pattern identifies an Amazon Web Services client ID.",
  "type": "predefined",
  "status": "disabled",
  "technique": "regex",
  "confidence": "high, low",
  "version": 1,
  "updated": "2026-05-25T15:50:58.037Z"
}

YAML output

airs runtime dlp patterns get 000000000000000000000001 --output yaml

id: 000000000000000000000001
name: API Credentials Client ID - Amazon Web Services AWS
description: This pattern identifies an Amazon Web Services client ID.
type: predefined
status: disabled
technique: regex
confidence: high, low
version: 1
updated: '2026-05-25T15:50:58.037Z'

---

runtime dlp patterns replace

Full-replace a data pattern (PUT)

airs runtime dlp patterns replace [options] <id>

Arguments

• id (required) —

Options

Flag	Required	Default	Description
--name <s>	No	—	Pattern name (required unless --body-file)
--type <s>	No	—	Pattern type: predefined
--description <s>	No	—	Pattern description
--technique <s>	No	—	Detection technique (default: regex)
--confidence-levels <csv>	No	—	Confidence levels CSV: e.g. high,low
--regex <pattern>	No	—	Regex with weight=1 (repeatable)
`--weighted-regex <PATTERN	N>`	No	—
--delimiter <s>	No	—	Delimiter for proximity matching
--proximity-distance <n>	No	—	Proximity window (2..1000)
--proximity-keyword <s>	No	—	Proximity keyword (repeatable)
--tag <k=v>	No	—	Tag (repeatable, value can be CSV)
`--body <json	->`	No	—
--body-file <path>	No	—	Raw JSON body file (escape hatch)
--output <fmt>	No	pretty	Output format

Examples

Full-replace a custom pattern from a body fixture (see docs/cli/examples/dlp/patterns/replace.json). API returns the new version.

airs runtime dlp patterns replace 000000000000000000000099 --body-file docs/cli/examples/dlp/patterns/replace.json --output json

{
  "action": "replaced",
  "id": "000000000000000000000099",
  "name": "docs-example-pattern",
  "type": "custom",
  "status": "active",
  "version": 2
}

---

runtime dlp patterns patch

JSON Merge Patch. Use --body-file for nested fields. --set/--clear coerce values: numbers/booleans/JSON literals. To force a string, quote: --set count='"5"'.

airs runtime dlp patterns patch [options] <id>

Arguments

• id (required) —

Options

Flag	Required	Default	Description
--body-file <path>	No	—	JSON merge-patch body file
--set <k=v...>	No	—	Set scalar field (repeatable)
--clear <key...>	No	—	Clear field via merge-patch null (repeatable)
--output <fmt>	No	pretty	Output format

Examples

Merge-patch a pattern's description from a body fixture (see docs/cli/examples/dlp/patterns/patch.json). Omitted fields are unchanged.

airs runtime dlp patterns patch 000000000000000000000099 --body-file docs/cli/examples/dlp/patterns/patch.json --output json

{
  "action": "patched",
  "id": "000000000000000000000099",
  "name": "docs-example-pattern",
  "type": "custom",
  "status": "active",
  "version": 2
}

Merge-patch inline via --set (scalar fields only; quote regex/JSON literals as needed)

airs runtime dlp patterns patch 000000000000000000000099 --set description='docs example' --output json

{
  "action": "patched",
  "id": "000000000000000000000099",
  "name": "docs-example-pattern",
  "type": "custom",
  "status": "active",
  "version": 2
}

---

runtime dlp patterns delete

Soft-delete (archive) a data pattern

airs runtime dlp patterns delete [options] <id>

Arguments

• id (required) —

Examples

Soft-delete (archive) a data pattern by id

airs runtime dlp patterns delete 000000000000000000000003

archived 000000000000000000000003