> ## Documentation Index
> Fetch the complete documentation index at: https://docs.operata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Contact Flow Log redaction schema

> Field tiers, mandatory keep-list, and processing order for the Contact Flow Log redaction Lambda that runs in your AWS account.

The Contact Flow Log redaction Lambda enforces this schema. The Lambda runs
inside your AWS account, applies these rules to every event read from
CloudWatch, and ships only the surviving payload to Operata.

For the model behind the schema and the rollout procedure, see
[Concept: Privacy and redaction](/docs/concepts-privacy-and-redaction)
and [Configure Contact Flow Log redaction](/docs/guides-configure-contact-flow-log-redaction).

<Warning>
  This schema applies to the Contact Flow Log integration only. Lex
  and CTR integrations have their own schemas.
</Warning>

## Field tiers

Every field in an event payload belongs to exactly one of six tiers.

| Tier      | Behavior                                                                               | Controlled by |
| --------- | -------------------------------------------------------------------------------------- | ------------- |
| Mandatory | Key and value transmitted unchanged. Cannot be denied, hashed, encrypted, or redacted. | Operata       |
| Allow     | Key and value transmitted unchanged. Customer-declared.                                | Customer      |
| Deny      | Key and value removed entirely. Operata never sees the field.                          | Customer      |
| Encrypt   | Key retained, value replaced with a hash or ciphertext.                                | Customer      |
| Transform | Key retained, value replaced with derived or calculated data.                          | Customer      |
| Default   | Key retained, value nullified.                                                         | Customer      |

The four customer-configurable tiers (Allow, Deny, Encrypt, Transform)
are mutually exclusive: any one field appears in at most one tier.

<Warning>
  Today only the Mandatory tier is enforced end to end. Allow, Deny,
  Encrypt, and Transform are accepted in the config but applied as
  pass-through. Follow the [Operata changelog](/docs/changelog) for
  rollout.
</Warning>

## Processing order

The Lambda processes every event in four passes, in order.

1. **Mandatory override.** Check each field path against the mandatory
   list. If a mandatory field sits under a denied parent, retain the
   parent and prune all non-mandatory siblings. Mandatory always wins.
2. **Deny.** Evaluate every remaining field path against the deny
   list. Mark matched fields for removal.
3. **Allow, Encrypt, Transform.** Apply the customer-declared tiers
   to remaining fields.
4. **Default nullify.** Every field not covered by the previous three
   passes keeps its key, value becomes `null`.

## Path notation

Both lists use dot notation.

* `Parameters` matches the entire object at the `Parameters` key.
* `Parameters.LexVersion` matches only that subfield.

Rules apply at every depth consistently. Deny-with-mandatory-preservation
works the same at any nesting depth.

## Parent-key behavior

When a deny entry targets a parent (for example, `Parameters`) and no
mandatory entry references any child of that parent, the Lambda
removes the entire `Parameters` key. The key is absent from the
output — not an empty object.

When a deny entry targets a parent and the mandatory, allow, encrypt,
or transform list references one or more children of that parent, the
Lambda retains the parent containing only those referenced children.
Every other child is removed regardless of whether it also appears
explicitly in the deny list.

## Data flow

```text theme={null}
CloudWatch (raw Contact Flow Log)
  ↓
Redaction Lambda (in your AWS account)
  ├─ Pass 1: Mandatory override
  ├─ Pass 2: Deny
  ├─ Pass 3: Allow / Encrypt / Transform
  └─ Pass 4: Default nullify
  ↓
Operata API (filtered payload only)
```

## Mandatory keep-list

The redaction Lambda always preserves these fields, regardless of
deny, encrypt, or transform configuration.

```text theme={null}
ContactFlowId
ContactFlowModuleType
ContactFlowName
ContactId
ErrorDetails
ErrorDetails.ErrorCode
ErrorDetails.Message
ExternalResults.error
ExternalResults.status
ExternalResults.statusCode
ExternalResults.statusMessage
Identifier
ModuleExecutionStack
Parameters.AudioPrompt
Parameters.BotAliasArn
Parameters.ContactFlowId
Parameters.FlowModuleId
Parameters.FunctionArn
Parameters.InvocationType
Parameters.LexVersion
Parameters.NoInputTimeout
Parameters.Parameter.x-amz-lex:*
Parameters.Queue
Parameters.ResponseValidation
Parameters.TextLexTimeoutSeconds
Parameters.TextToSpeechType
Parameters.Timeout
Parameters.TimeoutSeconds
Parameters.Type
Parameters.ViewResourceId
Timestamp
```

## Example

Raw log emitted by Amazon Connect:

```json theme={null}
{
  "ContactFlowName": "CustomerService",
  "ContactId": "abc123",
  "Parameters": {
    "CustomerCardNumber": "4111-1111-1111-1111",
    "Queue": "billing",
    "TextInput": "I want to renew"
  }
}
```

Customer configuration applied by the Lambda:

```text theme={null}
Deny:    Parameters.CustomerCardNumber
Allow:   Parameters.Queue
Encrypt: Parameters.TextInput
```

Payload Operata receives after filtering:

```json theme={null}
{
  "ContactFlowName": "CustomerService",
  "ContactId": "abc123",
  "Parameters": {
    "Queue": "billing",
    "TextInput": "8d3a2f9b2c1e..."
  }
}
```

## Common configurations

| Goal                                         | Configuration                                                                            |
| -------------------------------------------- | ---------------------------------------------------------------------------------------- |
| Drop agent-notes parameters.                 | `Deny: Parameters.AgentNotes`                                                            |
| Keep queue names, drop customer IDs.         | `Allow: Parameters.Queue` and `Deny: Parameters.CustomerId`                              |
| Hash phone-digit inputs, keep flow analysis. | `Encrypt: Parameters.PhoneDigitsEntered`, `Allow: Parameters.Queue, Parameters.FlowName` |

## Related

* [Configure Contact Flow Log redaction](/docs/guides-configure-contact-flow-log-redaction) — step-by-step rollout.
* [Concept: Privacy and redaction](/docs/concepts-privacy-and-redaction) — the cross-integration model.
* [Lex redaction schema](/docs/lex-privacy) — the sibling schema for Amazon Lex conversation logs.
* [Install Contact Flow Logs collection](/docs/contact-flow-logs) — the integration this schema applies to.