Description

The masked keyword has been removed from CDL in CDS compiler v7 (CDS 10). The keyword was used in data model definitions to mark elements as masked (hidden from certain queries or serialization contexts). Any CDL file that uses masked as a keyword will cause a hard compiler parse error after the upgrade. The feature must be modeled using an alternative approach — typically an annotation or a view-based projection that excludes the element — depending on what the masked keyword was intended to achieve in the specific model.

How to Check

• [ ] Run cds compile against the project — if masked is used, the compiler will emit a parse error identifying the file and line.
• [ ] Search all .cds files for the pattern \bmasked\b to locate usages before compiling.

Migration Steps

1. Locate all masked usages in CDL files:

   entity Employees {
     key ID    : UUID;
     name      : String;
   - salary    : masked Decimal;
   }

2. Replace with an annotation-based approach to mark the element as sensitive, and create a restricted projection that excludes it for consumers that should not see it:

   entity Employees {
     key ID    : UUID;
     name      : String;
   + @PersonalData.IsPotentiallySensitive: true
     salary    : Decimal;
   }
   
   + @restrict: [{ grant: 'READ', to: 'HR' }]
   + entity EmployeesPublic as projection on Employees { ID, name };

3. Update service definitions to expose the restricted projection instead of the full entity where salary visibility is not required:

   service EmployeeService {
   - entity Employees as projection on db.Employees;
   + entity Employees    as projection on db.Employees;
   + entity EmployeesPublic as projection on db.EmployeesPublic;
   }

Notes

The appropriate replacement for masked depends on the original intent. If masked was used purely as a compile-time directive to exclude elements from generated views, a projection-based approach is the direct equivalent. If it served as a runtime data protection marker, the @PersonalData annotation family (used with SAP Data Privacy Integrator) is the recommended alternative.