> ## Documentation Index > Fetch the complete documentation index at: https://docs.operata.com/llms.txt > Use this file to discover all available pages before exploring further. # Update redaction config > Replace the active CTR redaction config for your Operata account with a new allow-list or deny-list document. Replaces the redaction config for your Operata account with the body you send. It's a full replace, not a patch — the document on disk after the call equals the document you sent. Use it to apply a new allow-list, switch from an allow-list to a deny-list, or extend the field set on an existing config. ## Endpoint ```http theme={null} PUT https://api.operata.io/v1/config/json ``` ## Parameters ### Headers | Name | Type | Required | Description | | ----------------- | ------ | ------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Content-Type` | string | yes | `application/json`. | | `Idempotency-Key` | string | no, not yet honored | Reserved for a future contract. The endpoint is already idempotent — sending the same body twice yields the same final state. See [Idempotency](/docs/api-idempotency). | ### Body | Name | Type | Required | Description | | -------------- | --------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `key` | string | yes | Always `REDACTION_CONFIG`. | | `value` | object | yes | The config document. | | `value.type` | string | yes | `WHITELIST` for an allow-list, `BLACKLIST` for a deny-list. One config per account; the two are mutually exclusive. | | `value.fields` | array of string | yes | CTR field paths to include (allow-list) or exclude (deny-list). Use dot notation matching the [CTR data model](/docs/contact-trace-records). An empty array on a deny-list sends the full CTR; an empty array on an allow-list sends only the mandatory fields. | The Cloud Collector always ships the mandatory CTR fields (for example `ContactId`, `InitiationTimestamp`, `Queue.Name`) regardless of config. You cannot remove them with a deny-list or omit them from an allow-list. `PUT /v1/config/json` is idempotent. Sending the same body twice yields the same final state — the document on disk after the second call equals the one on disk after the first. Retry safely. See [Idempotency](/docs/api-idempotency) for the per-method contract across the API. ## Response `200 OK` with a plain-text body `REDACTION_CONFIG updated`. ```text theme={null} REDACTION_CONFIG updated ``` The config is durable as soon as the call returns, but propagation across all collection points can take up to 30 minutes. CTRs from contacts that end before propagation completes may still apply the previous config. ## Example A deny-list that strips one PII attribute from every CTR: ```bash curl theme={null} curl -X PUT -u "$OPERATA_GROUP_ID:$OPERATA_API_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "key": "REDACTION_CONFIG", "value": { "type": "BLACKLIST", "fields": ["Attributes.CustomerDetails"] } }' \ "https://api.operata.io/v1/config/json" ``` ```javascript Node.js theme={null} const groupId = process.env.OPERATA_GROUP_ID; const apiToken = process.env.OPERATA_API_TOKEN; const auth = Buffer.from(`${groupId}:${apiToken}`).toString("base64"); const body = { key: "REDACTION_CONFIG", value: { type: "BLACKLIST", fields: ["Attributes.CustomerDetails"], }, }; const response = await fetch("https://api.operata.io/v1/config/json", { method: "PUT", headers: { Authorization: `Basic ${auth}`, "Content-Type": "application/json", }, body: JSON.stringify(body), }); ``` ```python Python theme={null} import os, requests body = { "key": "REDACTION_CONFIG", "value": { "type": "BLACKLIST", "fields": ["Attributes.CustomerDetails"], }, } response = requests.put( "https://api.operata.io/v1/config/json", auth=(os.environ["OPERATA_GROUP_ID"], os.environ["OPERATA_API_TOKEN"]), headers={"Content-Type": "application/json"}, json=body, ) response.raise_for_status() ``` ## Errors | Status | Code | When | Recover | | ------ | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | | 400 | `invalid_config` | The body failed validation. Today the wire response is `text/plain` `REDACTION_CONFIG not valid`. Common causes: misspelled `type` (must be exactly `WHITELIST` or `BLACKLIST`), a field path that does not exist in the CTR data model, or malformed JSON. | Check `type`, check each entry in `fields` against the [CTR data model](/docs/contact-trace-records), and re-send. | See [Errors](/docs/api-errors) for shared codes such as `401 unauthorized`, `429 rate_limited`, and the `5xx` family. ## Related * [Data redaction](/docs/api-data-redaction) — what redaction does and how the three endpoints fit together. * [Get redaction config](/docs/api-get-redaction-config) — fetch the current config before you replace it. * [Delete redaction config](/docs/api-delete-redaction-config) — remove the config and revert to the default. * [Configure CTR redaction](/docs/guides-configure-ctr-redaction) — the step-by-step rollout guide. * [Errors](/docs/api-errors) — shared status codes and recovery patterns. * [Rate limits](/docs/api-rate-limits) — per-token request budget. * [Idempotency](/docs/api-idempotency) — `PUT` is idempotent; sending the same body twice yields the same final state. * [Versioning](/docs/api-versioning) — this endpoint lives under `/v1`. ## OpenAPI ````yaml PUT /v1/config/json openapi: 3.0.3 info: title: operata-api version: '1' servers: - url: https://api.operata.io/ security: - sec0: [] paths: /v1/config/json: put: summary: Update Redaction Config description: >- Define the redaction configuration to include or exclude sensitive data before it is sent to Operata operationId: update-redaction-configuration requestBody: content: application/json: schema: type: object required: - RAW_BODY properties: RAW_BODY: type: string description: REDACTION_CONFIG object default: >- { "key": "REDACTION_CONFIG", "value": { "type":"BLACKLIST", "fields":[ "Attributes.CustomerDetails" ] } } format: json responses: '200': description: '200' content: text/plain: examples: Result: value: REDACTION_CONFIG updated '400': description: '400' content: text/plain: examples: Result: value: REDACTION_CONFIG not valid deprecated: false components: securitySchemes: sec0: type: http scheme: basic ````