> ## Documentation Index > Fetch the complete documentation index at: https://docs.databunker.org/llms.txt > Use this file to discover all available pages before exploring further. # Format-preserving tokenization Databunker Pro provides **two distinct tokenization engines**, each designed for a different job: * **PII tokenization** (`UserCreate` / `UserGet`) — stores a complete user profile (JSON, N fields) as one encrypted record and returns a single UUID token representing the whole profile. Builds secure hashed search indexes over `email`, `phone`, `login`, and a `custom` field for efficient lookups. This is the *user-table replacement* pattern; see the [PII Vault](/pro/get-started/pii-vault) page for full detail. * **Format-preserving tokenization** (`TokenCreate` / `TokenGet`) — tokenizes individual sensitive values such as `credit-card numbers` (Luhn-valid) and Unix timestamps. Returns both a UUID and a format-preserving token in the same response. This is the *PCI / single-value* pattern, covered in the rest of this page. Both engines share the same vault, encryption, multi-tenancy, and access-control layers — so the same auditability, key management, and CRBAC policies apply to either flow. Databunker Pro was built with the latest data privacy requirements in mind, such as data minimization, and is engineered to handle millions of data tokenization requests. The API supports bulk tokenization for efficient batch operations. ## Supported data types | Original Record Type | Format Preservation | Generated Token Format | | --------------------- | ------------------- | ------------------------------- | | Credit Card Number | ✅ (with Luhn check) | Format-preserving or UUID token | | Unix timestamp record | ✅ | Format-preserving or UUID token | | Text string | ❌ | UUID token | ## Key features ### Automatic Expiration In Databunker Pro, expiration allows you to set a lifespan for sensitive data tokens, ensuring they automatically expire after a defined period. Use `slidingtime` for a relative window (e.g. `30d`, `1h`) or `finaltime` for an absolute Unix-timestamp expiry. ```json theme={null} // Set a 30-day sliding expiration for a tokenized record { "tokentype": "creditcard", "record": "4532015112830366", "slidingtime": "30d" } ``` ### Unique Record Support This unique flag is used for data deduplication. It ensures that each record is saved only once, and the same token value is returned for identical records. If the original record has an expiration flag set, its expiration countdown will be reset from the beginning. ```json theme={null} // Same input generates same token when enabled { "tokentype": "creditcard", "record": "4532015112830366", "unique": true } ``` ### Dual Token Generation By default, Databunker Pro generates two tokens: one in UUID format and another in a format-preserving manner. ```json theme={null} // Example response for credit card tokenization { "status": "ok", "tokenuuid": "550e8400-e29b-41d4-a716-446655440000", "tokenbase": "4111111111111111" // Format-preserving token (Luhn-valid, same length) } ``` ## Getting started ```bash theme={null} # Example API call for tokenization curl -X POST https://databunker.pro/v2/TokenCreate \ -H "X-Bunker-Token: " \ -H "X-Bunker-Tenant: " \ -H "Content-Type: application/json" \ -d '{ "tokentype": "creditcard", "record": "4532015112830366", "slidingtime": "30d", "unique": true }' ``` Output: ```json theme={null} { "status": "ok", "tokenuuid": "550e8400-e29b-41d4-a716-446655440000", "tokenbase": "4111111111111111" // Format-preserving token (Luhn-valid, same length) } ``` ## Bulk tokenization For batch workloads — migrations, nightly imports, mass detokenization — Databunker Pro creates, reads, and deletes many tokens in a single call. ### Create tokens in bulk `TokenCreateBulk` takes an array of records and returns a token pair for each. `slidingtime` / `finaltime` and `unique` apply to the whole batch. ```bash theme={null} curl -X POST https://databunker.pro/v2/TokenCreateBulk \ -H "X-Bunker-Token: " \ -H "X-Bunker-Tenant: " \ -H "Content-Type: application/json" \ -d '{ "records": [ { "tokentype": "creditcard", "record": "4532015112830366" }, { "tokentype": "creditcard", "record": "5467047429390590" } ], "unique": true }' ``` Output: ```json theme={null} { "status": "ok", "created": [ { "tokenuuid": "550e8400-e29b-41d4-a716-446655440000", "tokenbase": "4111111111111111", "record": "4532015112830366", "tokentype": "creditcard" }, { "tokenuuid": "6ba7b810-9dad-11d1-80b4-00c04fd430c8", "tokenbase": "5500005555555559", "record": "5467047429390590", "tokentype": "creditcard" } ] } ``` ### Read and delete in bulk Bulk read and delete return or destroy plaintext for many records at once, so they require a short-lived **[unlock UUID](/pro/api/authentication#bulk-unlock-uuid)** as an extra authorization step. Call `BulkListUnlock` first, then pass the returned `unlockuuid` to `BulkListTokens` or `BulkDeleteTokens` along with the token UUIDs. ```bash theme={null} # 1. Obtain an unlock UUID curl -X POST https://databunker.pro/v2/BulkListUnlock \ -H "X-Bunker-Token: " \ -H "X-Bunker-Tenant: " # -> { "status": "ok", "unlockuuid": "e1f2a3b4-..." } # 2. Retrieve the original values curl -X POST https://databunker.pro/v2/BulkListTokens \ -H "X-Bunker-Token: " \ -H "X-Bunker-Tenant: " \ -H "Content-Type: application/json" \ -d '{ "unlockuuid": "e1f2a3b4-...", "tokens": ["550e8400-e29b-41d4-a716-446655440000", "6ba7b810-9dad-11d1-80b4-00c04fd430c8"] }' # -> { "status": "ok", "rows": [ { "tokenuuid": "...", "tokenbase": "...", "record": "...", "tokentype": "creditcard" }, ... ] } # 3. Delete tokens curl -X POST https://databunker.pro/v2/BulkDeleteTokens \ -H "X-Bunker-Token: " \ -H "X-Bunker-Tenant: " \ -H "Content-Type: application/json" \ -d '{ "unlockuuid": "e1f2a3b4-...", "tokens": ["550e8400-e29b-41d4-a716-446655440000", "6ba7b810-9dad-11d1-80b4-00c04fd430c8"] }' # -> { "status": "ok", "deleted": 2 } ``` ## Compliance and scale Format-preserving tokenization addresses three concerns at once: | Concern | What tokenization gives you | | ------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Privacy & compliance** | Supports GDPR data minimization and reduces PCI DSS scope — real card numbers never reach your application databases, logs, or analytics systems. | | **Legacy compatibility** | Tokens keep the original format and validation rules (e.g. the Luhn check for cards), so they drop into existing schemas, validators, and downstream systems without changes. | | **Scale** | Data partitioning and bulk endpoints handle millions of records at high throughput. |