> ## Documentation Index
> Fetch the complete documentation index at: https://docs.operata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Genesys Cloud redaction schema

> Field tiers, processing order, and the mandatory keep-list the Operata Fetcher Service enforces when it ingests Genesys Cloud Conversation data.

The Operata Fetcher Service enforces these field-tier rules when it ingests Genesys Cloud Conversation data. The Fetcher Service runs in Operata's managed infrastructure, polls the Genesys Cloud API on conversation end, and ships only the surviving payload to Operata.

For the model behind the schema and the rollout procedure, see
[Concept: Privacy and redaction](/docs/concepts-privacy-and-redaction)
and [Configure Genesys Cloud redaction](/docs/guides-configure-genesys-redaction).

<Warning>
  This schema applies to the Genesys Cloud integration only. Amazon
  Connect CTR, Contact Flow Log, and Lex integrations have their own
  schemas.
</Warning>

## Field tiers

Every field in a Genesys Cloud event or API response belongs to exactly one of six tiers.

| Tier      | Behavior                                                                               | Controlled by |
| --------- | -------------------------------------------------------------------------------------- | ------------- |
| Mandatory | Key and value transmitted unchanged. Cannot be denied, hashed, encrypted, or redacted. | Operata       |
| Allow     | Key and value transmitted unchanged. Customer-declared.                                | Customer      |
| Deny      | Key and value removed entirely. Operata never sees the field.                          | Customer      |
| Encrypt   | Key retained, value replaced with a hash or ciphertext.                                | Customer      |
| Transform | Key retained, value replaced with derived or calculated data.                          | Customer      |
| Default   | Key retained, value nullified.                                                         | Default       |

The four customer-configurable tiers (Allow, Deny, Encrypt, Transform) are mutually exclusive: any one field appears in at most one tier.

## Processing order

The Fetcher Service processes every event in four passes, in order.

1. **Mandatory override.** Check each field path against the mandatory
   list. If a mandatory field sits under a denied parent, retain the
   parent and prune all non-mandatory siblings. Mandatory always wins.
2. **Deny.** Evaluate every remaining field path against the deny list.
   Mark matched fields for removal.
3. **Allow, Encrypt, Transform.** Apply the customer-declared tiers to
   the remaining fields.
4. **Default nullify.** Every field outside the previous three passes
   keeps its key; its value becomes `null`.

## Path notation

All lists use dot notation against the JSON payload.

* A top-level key such as `conversation` matches the entire object at that key.
* A nested path such as `conversation.participants.name` matches only that specific subfield.

Rules apply at every depth consistently.

## Parent-key behavior

When a deny entry targets a parent and no mandatory entry references any child of that parent, the Fetcher Service removes the entire parent key. The key is absent from the output — not an empty object.

When a deny entry targets a parent and the mandatory, allow, encrypt, or transform list references one or more children of that parent, the Fetcher Service retains the parent containing only those referenced children. Every other child is removed regardless of whether it also appears in the deny list.

## Data flow

```text theme={null}
Genesys Cloud API
  ↓ (polled by Operata Fetcher Service)
Operata Fetcher Service
  ├─ Pass 1: Mandatory override
  ├─ Pass 2: Deny
  ├─ Pass 3: Allow / Encrypt / Transform
  └─ Pass 4: Default nullify
  ↓ (filtered payload only)
Operata platform
```

## Policy caching

The Fetcher Service fetches the active redaction config from the Operata Config API and caches it for 30 minutes. If the API is unreachable or returns an invalid policy, the service falls back to the last valid policy in Operata's secure storage.

| Condition                           | Cached?      | Fallback to stored policy? |
| ----------------------------------- | ------------ | -------------------------- |
| `200 OK` plus valid policy          | Yes (30 min) | No                         |
| `200 OK` plus empty or invalid body | No           | Yes                        |
| `404 Not Found`                     | Yes          | Yes                        |
| `5xx` server error                  | No           | Yes                        |
| Network error                       | No           | Yes                        |

If no valid policy exists in either location, the Fetcher Service marks the batch as failed until a valid config is available.

## Mandatory keep-list

The Fetcher Service always preserves these fields. The list is hard-coded; the redaction API rejects any rule that targets a mandatory field with `400 Bad Request`.

**EventBridge — conversation end event**

```text theme={null}
Event.Conversation.data.source
Event.Conversation.data.timestamp
Event.Conversation.data.conversationId
```

**API — `GET /users/{id}`**

```text theme={null}
API.Users.username
```

**API — `GET /conversations/{id}/details`**

```text theme={null}
API.Conversation.participants[purpose=*].sessions[*].edgeId
API.Conversation.participants[purpose=agent]
API.Conversation.divisionIds
API.Conversations.participants[purpose=customer].sessions[*].segments[type=interact].disconnectType
API.Conversations.participants[purpose=external].sessions[*].segments[type=interact].disconnectType
API.Conversation.conversationId
API.Conversation.originatingDirection
API.Conversation.conversationStart
API.Conversation.conversationEnd
API.Conversation.participants[purpose=acd]
API.Conversations.participants[*].sessions[*].mediaEndpointStats
API.Conversation.mediaStatsMinConversationMos
API.Conversation.mediaStatsMinConversationRFactor
API.Conversations.participants[*].sessions[*].mediaType
API.Conversation.participants[purpose=customer].sessions[*].dnis
API.Conversation.participants[purpose=external].sessions[*].dnis
```

## Common configurations

| Goal                                              | Configuration                                           |
| ------------------------------------------------- | ------------------------------------------------------- |
| Drop customer phone numbers from the audit trail. | `Deny: customerPhone`                                   |
| Keep queue names, drop agent emails.              | `Allow: callDuration, queueName` and `Deny: agentEmail` |
| Hash customer identifiers, keep aggregates.       | `Encrypt: customerId`, `Allow: queueName, callDuration` |

## Related

* [Configure Genesys Cloud redaction](/docs/guides-configure-genesys-redaction) — step-by-step rollout against the Operata Config API.
* [Concept: Privacy and redaction](/docs/concepts-privacy-and-redaction) — the cross-integration model.
* [Genesys Cloud integration overview](/docs/genesys-overview) — the EventBridge topics and REST endpoints the schema applies to.
* [Install the Genesys Cloud integration](/docs/genesys-installation) — required before redaction config has any effect.