Operata - Genesys Cloud Integration

Security and Architecture Overview

1. Integration Overview

Operata integrates with Genesys Cloud to provide CX observability using:

1. Amazon EventBridge (primary ingestion path)

   • Near real-time delivery of analytics, operational, and platform events from Genesys Cloud directly to Operata's AWS account.

2. Genesys Cloud REST APIs (secondary/enrichment path)

   • Used for historical analytics, aggregation, and enrichment of event data.

Operata does not require access to audio media or agent desktops.

2. High-Level Architecture

Genesys Cloud -> Amazon EventBridge (Operata AWS Account) -> EventBridge Rules -> Operata Ingestion Endpoint (HTTPS) -> REST API calls to Genesys Cloud

Notes:

• All events originate from Genesys Cloud.
• Events are delivered to Operata's AWS account.
• Operata does not receive events unless the customer enables them.

3. EventBridge Topics Enabled

Operata subscribes to the following Genesys Cloud EventBridge topics. These are metadata and analytics events only.

4. REST APIs Accessed

EventBridge provides signals and deltas. REST APIs are used for querying, aggregation, and enrichment.

4.1 Analytics APIs (Read-Only)

• POST /api/v2/analytics/queues/aggregates/query Purpose: Queue KPIs (ASA, SL, abandons, volume)

• POST /api/v2/analytics/users/aggregates/query Purpose: Agent KPIs (AHT, handled, occupancy-style metrics)

• POST /api/v2/analytics/conversations/aggregates/query Purpose: KPIs across interactions

• GET /api/v2/analytics/conversations/{conversationId}/details Purpose: Canonical call summary (CDR equivalent)

• POST /api/v2/analytics/conversations/details/query Purpose: Bulk query for conversation detail records (backfill, reconciliation)

4.2 Conversation Metadata (Optional Enrichment)

• GET /api/v2/conversations/calls/{conversationId} Purpose: Additional conversation metadata enrichment (not the CDR itself)

4.3 Configuration/Reference Data (Read-Only)

• GET /api/v2/routing/queues Purpose: Queue name/config lookup

• GET /api/v2/flows Purpose: Flow/IVR name resolution

• GET /api/v2/users Purpose: User/agent identity resolution

• GET /api/v2/telephony/providers/edges Purpose: Telephony context

• GET /api/v2/telephony/siptrunks Purpose: Trunk context

4.4 Quality/Analytics (Optional)

• GET /api/v2/recordings/conversations/{conversationId} Purpose: Recording metadata only (no audio download)

• /api/v2/speechandtextanalytics/* Purpose: Sentiment/topics/transcript-derived analytics (if enabled)

• /api/v2/quality/evaluations Purpose: QM scores (if enabled)

4.5 Audit (Optional)

• GET /api/v2/audit/organization/configuration Purpose: Configuration change history

5. Conversation Record Retrieval

Genesys Cloud does not expose a single "CDR" or "CTR" object. The Conversation Detail record from the Analytics Conversations API is the canonical equivalent.

5.1 Primary Endpoint (Authoritative)

Endpoint:

• GET /api/v2/analytics/conversations/{conversationId}/details

Used as the system of record for completed interactions.

5.2 Bulk/Search Access

Endpoint:

• POST /api/v2/analytics/conversations/details/query

Use cases:

• Initial backfill
• Periodic reconciliation
• Historical reporting
• Recovery if events are missed

5.3 How Retrieval Is Triggered

• Operata subscribes to Analytics Detail Events via EventBridge:
  • v2.detail.events.conversation.{conversationId}.*
• On completion detection, Operata retrieves:
  • GET /api/v2/analytics/conversations/{conversationId}/details

6. Required OAuth Scopes/Permissions

Operata uses client-credentials OAuth with least-privilege scopes.

Core required (minimum for core observability):

• analytics:read
• routing:read
• users:read

Common optional enrichment:

• conversations:read

Optional (feature-dependent):

• speechTextAnalytics:read
• recording:read (metadata only)
• quality:read
• telephony:read
• audit:read

Operata does not require write permissions.

7. Data Handling and Security

• No audio media is collected unless explicitly agreed.
• Credentials are not stored beyond OAuth tokens.
• Data in transit is encrypted (TLS).
• Customer controls the Genesys Cloud EventBridge integration configuration.
• Customer can disable or remove the integration at any time via the Genesys Cloud admin console.

8. What Operata Does NOT Access

• No call audio streams by default
• No agent desktops or screen recordings
• No write or configuration APIs in Genesys Cloud

9. Summary (For Security Review)

• Primary ingestion: Amazon EventBridge (Genesys Cloud to Operata AWS account)
• Secondary access: Read-only Genesys Cloud REST APIs
• Access model: OAuth 2.0 client credentials, least-privilege scopes
• Data type: Analytics, metadata, operational events
• No media access by default.

10. Mandatory fields for Operata Observability Analytics

For Operata to provide proper observability functionality with Genesys, the following fields are required: