Skip to main content

​
Controlling data sent to Operata

Configure an allow-list or deny-list via the Operata API to control which Contact Trace Record (CTR) fields reach Operata. CTR data can contain sensitive information or personally identifiable information (PII); the configuration lets you redact specific fields before Operata receives them. The configuration supports either an allow-list or a deny-list.

​
Privacy-first default

Operata operates on a privacy-first basis. When deployed without any redaction configuration, only the minimum required set of CTR fields is sent to Operata. You can then progressively expand the data sent by configuring an allow-list. To send additional fields beyond the default minimum payload, configure an allow-list:
The configuration above sends Attributes.myCustomField in addition to the default minimum payload. To send the entire CTR payload, explicitly define an empty deny-list:

​
Scope

Privacy controls apply to Contact Trace Record data collected by the CTR Collection stack. Data collected from other sources (IVR Flow Logs, Amazon Lex) may also contain PII — particularly in utterance text, slot values, and AI-generated responses. Contact Operata Support to discuss the appropriate redaction configuration for these data sources.

​
Using the Operata API

Configure the redaction behavior programmatically using an allow-list or deny-list:
  • Allow-list — sends only the mandatory fields plus the fields you specify.
  • Deny-list — sends all CTR fields except those you specify.
Only one configuration is supported at a time — either an allow-list or a deny-list, never both.
The following fields are mandatory and cannot be added to the deny-list or omitted from the allow-list. Mandatory fields
Full documentation for the Contact Trace Records data model is available in the AWS documentation.

​
Defining the redaction configuration

The redaction configuration payload consists of:
  1. The type — either BLACKLIST or WHITELIST.
  2. The fields to be either included or excluded.
Choose an allow-list or deny-list, then define the fields to include or exclude. An allow-list includes only the mandatory fields plus the fields you specify; a deny-list excludes the fields you specify. Fields are only included or excluded if they exist in the CTR.

​
Example deny-list

In this example, the CustomerDetails field within Attributes contains sensitive PII data and is removed before transmission to Operata. All other fields within Attributes are included.

​
Example allow-list

In this example, InitiationMethod and AnsweringMachineDetectionStatus are the only top-level fields included within the CTR. RoutingProfile within Agent is also included, while all other fields within Agent are excluded.

​
Updating the redaction configuration

The Operata REST API provides endpoints to fetch (GET), set (PUT), and remove (DELETE) the redaction configuration.
While the configuration is updated immediately, there may be up to a 30-minute delay before the change propagates across all collection points.

​
Support

Contact Operata for support.