Certified MuleSoft Platform Integration Architect

A leading eCommerce giant plans to use MuleSoft APIs on Runtime Fabric (RTF) to process customer orders. Some customer-sensitive information, including credit card information, is required in request payloads or appears in response payloads for certain APIs. Other API requests and responses are not authorized to access some of this customer-sensitive information, but they have been implemented to validate and transform it according to the structure and format of that information (such as account IDs, phone numbers, and postal codes).

Which approach configures an API gateway to conceal sensitive data exchanged between API consumers and API implementations, while allowing tokenized fields to be converted back to their original values for other API requests or responses, without recoding the API implementations?