Quickstart: Using the command-line tool

This page shows you how to perform basic tasks in the Cloud Data Loss Prevention API using a command-line interface. Specifically, this quickstart covers sending a short string to the DLP API for inspection.

Before you begin

Sign in to your Google Account.
If you don't already have one, sign up for a new account.
In the Google Cloud Console, on the project selector page, select or create a Google Cloud project.

Note: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.

Go to the project selector page
Make sure that billing is enabled for your Cloud project. Learn how to confirm that billing is enabled for your project.
Enable the DLP API.
Enable the API

Set up authentication:
1. In the Cloud Console, go to the Create service account key page.
  Go to the Create Service Account Key page
2. From the Service account list, select New service account.
3. In the Service account name field, enter a name.
4. From the Role list, select Project > Owner.
  
  Note: The Role field affects which resources your service account can access in your project. You can revoke these roles or grant additional roles later. In production environments, do not grant the Owner, Editor, or Viewer roles. For more information, see Granting, changing, and revoking access to resources.
5. Click Create. A JSON file that contains your key downloads to your computer.
Set the environment variable GOOGLE_APPLICATION_CREDENTIALS to the path of the JSON file that contains your service account key. This variable only applies to your current shell session, so if you open a new session, set the variable again.
Example: Linux or macOS

Replace [PATH] with the path of the JSON file that contains your service account key.
```
export GOOGLE_APPLICATION_CREDENTIALS="[PATH]"
```
For example:
```
export GOOGLE_APPLICATION_CREDENTIALS="/home/user/Downloads/service-account-file.json"
```
Example: Windows

Replace [PATH] with the path of the JSON file that contains your service account key.

With PowerShell:
```
$env:GOOGLE_APPLICATION_CREDENTIALS="[PATH]"
```
For example:
```
$env:GOOGLE_APPLICATION_CREDENTIALS="C:\Users\username\Downloads\my-key.json"
```
With command prompt:
```
set GOOGLE_APPLICATION_CREDENTIALS=[PATH]
```
Download and install Node.js and NPM.

Permissions

Inspecting content requires the serviceusage.services.use permission for the project that's specified in parent. The roles/editor, roles/owner, and roles.dlp.user roles contain the required permission or you can define your own custom role.

To give your user the dlp.user role at the project level:

Web UI

Open the IAM page in the Google Cloud Console.
Open the IAM page
If a project hasn't already been selected, click Select a project in the project selector.
Select your project and click Open.
On the IAM page:
- To add a new user, click Add.
- To add the dlp.user role to an existing user, click Edit member for that user, and then click Add another role in the Edit permissions pane.
In the Add members pane:
- In the New members field, type the email address of the user you're adding—for example, test@example.com.
- For Roles, click Select a role and choose Cloud DLP > DLP User.
Click Add.

For more information, see Grant an IAM role.

Command-line

To add a single binding to the project's IAM policy, type the following command. Replace PROJECT-ID with your project ID and SERVICE-ID with the service account to be used.
```
gcloud projects add-iam-policy-binding PROJECT-ID --member serviceAccount:SERVICE-ID --role roles/dlp.user
```
The following command writes the updated policy to the console window. Replace the email address with that of the user you're adding.

bindings:
- members:
  - group: test@example.com
    role: roles/dlp.user

Set up Cloud DLP CLI app

Clone or download a ZIP file of the Node.js DLP client library, and then expand the downloaded file.
Open a command-line tool and navigate to the samples directory within the expanded directory.
Install the app dependencies by running npm install while in the samples directory.
If you haven't done so already, create the GCLOUD_PROJECT environment variable and set it to the project ID of the Google Cloud project you set up to use with Cloud DLP:
Linux or macOS
```
export GCLOUD_PROJECT="[PROJECT-ID]"
```
Windows

With PowerShell:
```
$env:GCLOUD_PROJECT="[PROJECT-ID]"
```
With command prompt:
```
set GCLOUD_PROJECT=[PROJECT-ID]
```

Inspect a string for sensitive information

This section shows you how to ask the service to scan sample text using the inspectString example Node.js script. If you haven't already, open a command-line tool and navigate to the samples folder of the Node.js samples repository you downloaded and expanded in the previous section.

Run the following command, replacing PROJECT-ID with your project ID:

node inspectString.js PROJECT-ID "My email address is joe@example.com."

You receive the following output:

  Findings:
    Quote: joe@example.com
    Info type: EMAIL_ADDRESS
    Likelihood: LIKELY

You've just sent your first request to the DLP API.

What's next?

Read how-to guides to get started with inspecting text and images, as well as redacting sensitive data from text.
Read Concepts to better understand inspection, redaction, Infotypes and likelihood.
Take a look at the Service API Reference and the Node.js client library API Reference.