> ## Documentation Index
> Fetch the complete documentation index at: https://docs.operata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# API — Data Privacy Controls

> Control which Contact Trace Record fields reach Operata by configuring an allow-list or deny-list through the Operata API.

## Controlling data sent to Operata

Configure an allow-list or deny-list via the Operata API to control which Contact Trace Record (CTR) fields reach Operata. CTR data can contain sensitive information or personally identifiable information (PII); the configuration lets you redact specific fields before Operata receives them. The configuration supports either an allow-list or a deny-list.

## Privacy-first default

Operata operates on a privacy-first basis. When deployed without any redaction configuration, only the minimum required set of CTR fields is sent to Operata. You can then progressively expand the data sent by configuring an allow-list.

To send additional fields beyond the default minimum payload, configure an allow-list:

```json theme={null}
{
  "key": "REDACTION_CONFIG",
  "value": {
    "type": "WHITELIST",
    "fields": [
      "Attributes.myCustomField"
    ]
  }
}
```

The configuration above sends `Attributes.myCustomField` in addition to the default minimum payload.

To send the **entire CTR payload**, explicitly define an empty deny-list:

```json theme={null}
{
  "key": "REDACTION_CONFIG",
  "value": {
    "type": "BLACKLIST",
    "fields": []
  }
}
```

## Scope

Privacy controls apply to Contact Trace Record data collected by the CTR Collection stack. Data collected from other sources (IVR Flow Logs, Amazon Lex) may also contain PII — particularly in utterance text, slot values, and AI-generated responses. Contact [Operata Support](mailto:support@operata.com) to discuss the appropriate redaction configuration for these data sources.

## Using the Operata API

Configure the redaction behavior programmatically using an allow-list or deny-list:

* **Allow-list** — sends only the mandatory fields plus the fields you specify.
* **Deny-list** — sends all CTR fields except those you specify.

<Warning>
  Only one configuration is supported at a time — **either an allow-list or a deny-list, never both**.
</Warning>

The following fields are mandatory and cannot be added to the deny-list or omitted from the allow-list.

**Mandatory fields**

```json theme={null}
{
  "key": "REDACTION_CONFIG",
  "value": {
    "type": "WHITELIST",
    "fields": [
      "Agent",
      "Agent.NumberOfHolds",
      "Agent.DeviceInfo",
      "Agent.CustomerHoldDuration",
      "Agent.Username",
      "Agent.LongestHoldDuration",
      "Agent.AgentInteractionDuration",
      "Agent.AfterContactWorkStartTimestamp",
      "Agent.ConnectedToAgentTimestamp",
      "Agent.AfterContactWorkDuration",
      "Agent.AfterContactWorkEndTimestamp",
      "Agent.HierarchyGroups",
      "AgentConnectionAttempts",
      "AnsweringMachineDetectionStatus",
      "AWSAccountId",
      "AWSContactTraceRecordFormatVersion",
      "Channel",
      "ConnectedToSystemTimestamp",
      "ContactId",
      "NextContactId",
      "PreviousContactId",
      "DisconnectReason",
      "InitialContactId",
      "InitiationMethod",
      "LastUpdateTimestamp",
      "DisconnectTimestamp",
      "InitiationTimestamp",
      "InstanceARN",
      "QualityMetrics",
      "Queue",
      "Queue.Name",
      "Queue.Duration",
      "Queue.DequeueTimestamp",
      "Queue.EnqueueTimestamp",
      "SystemEndpoint",
      "SystemEndpoint.Type",
      "SystemEndpoint.Address",
      "TransferCompletedTimestamp",
      "TransferredToEndpoint"
    ]
  }
}
```

Full documentation for the Contact Trace Records data model is available in the [AWS documentation](https://docs.aws.amazon.com/connect/latest/adminguide/ctr-data-model.html).

## Defining the redaction configuration

The redaction configuration payload consists of:

1. The `type` — either `BLACKLIST` or `WHITELIST`.
2. The `fields` to be either included or excluded.

Choose an allow-list or deny-list, then define the fields to include or exclude. An allow-list includes only the mandatory fields plus the fields you specify; a deny-list excludes the fields you specify. Fields are only included or excluded if they exist in the CTR.

### Example deny-list

In this example, the `CustomerDetails` field within `Attributes` contains sensitive PII data and is removed before transmission to Operata. All other fields within `Attributes` are included.

```json theme={null}
{
  "key": "REDACTION_CONFIG",
  "value": {
    "type": "BLACKLIST",
    "fields": [
      "Attributes.CustomerDetails"
    ]
  }
}
```

### Example allow-list

In this example, `InitiationMethod` and `AnsweringMachineDetectionStatus` are the only top-level fields included within the CTR. `RoutingProfile` within `Agent` is also included, while all other fields within `Agent` are excluded.

```json theme={null}
{
  "key": "REDACTION_CONFIG",
  "value": {
    "type": "WHITELIST",
    "fields": [
      "InitiationMethod",
      "AnsweringMachineDetectionStatus",
      "Agent.RoutingProfile"
    ]
  }
}
```

### Updating the redaction configuration

The Operata REST API provides endpoints to fetch (`GET`), set (`PUT`), and remove (`DELETE`) the redaction configuration.

<Note>
  While the configuration is updated immediately, there may be up to a 30-minute delay before the change propagates across all collection points.
</Note>

## Support

Contact Operata for support.

| Channel           | Details                                                   |
| ----------------- | --------------------------------------------------------- |
| Have an issue?    | In-app messenger                                          |
| External web form | [Operata Help](https://operata.typeform.com/Operata-Help) |