databricks Databricks Release Notes ·

Databricks Masks Query Text by Default in System Tables and APIs

securitydatabricksgaengineer
feature security

Databricks has implemented default masking of SQL query text within `system.query.history`, the Query History API, and the List Queries API. This change enhances data privacy and security by preventing sensitive information in SQL statements from being exposed. Account administrators and members of the `databricks_pii_access` group retain the ability to view unmasked query text. Access to unmasked data is managed by account admins, who create the group and assign members.

Security (1)
  • Query Text Masking in System Tables and APIs

    Databricks now masks query text by default in `statement_text` within `system.query.history`, `query_text` in the Query History API and List Queries API, and omits SQL definitions from `request_params` in `system.access.audit`. This measure protects sensitive information contained in SQL statements. Account admins and members of the `databricks_pii_access` account group can still read unmasked query text, with group creation and member assignment managed by account admins.

Read the original announcement →

https://docs.databricks.com/aws/en/release-notes/product/2026/august#query-text-is-now-masked-by-default-in-system-tables-and-apis

Related releases