> ## Documentation Index
> Fetch the complete documentation index at: https://docs.operata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Genesys Cloud redaction

> Apply a redaction policy to the Operata Fetcher Service so PII is stripped from Genesys Cloud Conversation data before it reaches the Operata platform.

Configure the Operata Fetcher Service to apply your redaction policy to every Genesys Cloud Conversation it polls, shipping only the surviving payload to Operata.

## Before you start

* The [Genesys Cloud integration](/docs/genesys-installation) installed against your Operata account.
* An Operata API token with admin permissions. See [Authentication](/docs/api-authentication).
* The list of Genesys Cloud field paths you want to allow, deny, encrypt, or transform. The schema and the mandatory keep-list live in [Genesys Cloud redaction schema](/docs/genesys-privacy).

## Steps

### 1. Read the current policy

Inspect what the Fetcher Service is enforcing today before you replace it.

```bash theme={null}
curl -u "$OPERATA_GROUP_ID:$OPERATA_API_TOKEN" \
  "https://api.operata.io/v1/config/source/genesys/gcd/redaction"
```

The response carries the full policy across all tiers — `MANDATORY`, `ALLOW`, `DENY`, `ENCRYPT`, `TRANSFORM`.

### 2. Draft your rules

The four customer-configurable tiers are mutually exclusive: any one field appears in at most one tier. Path notation is dot-delimited against the JSON payload, applied at every depth.

Each rule is a `{ "type", "field" }` pair. Common drafts:

```json theme={null}
{
  "rules": [
    { "type": "DENY",    "field": "customerPhone" },
    { "type": "DENY",    "field": "agentEmail" },
    { "type": "ALLOW",   "field": "callDuration" },
    { "type": "ALLOW",   "field": "queueName" },
    { "type": "ENCRYPT", "field": "customerId" }
  ]
}
```

Rules that target a mandatory field cause the API to reject the policy with `400`.

### 3. Post the policy

`POST` replaces the active policy in full. Any rule you omit drops out of the policy.

```bash theme={null}
curl -X POST -u "$OPERATA_GROUP_ID:$OPERATA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "rules": [
      { "type": "DENY",  "field": "customerPhone" },
      { "type": "ALLOW", "field": "queueName" }
    ]
  }' \
  "https://api.operata.io/v1/config/source/genesys/gcd/redaction"
```

A `200 OK` confirms the new policy is durable. A `400` means a rule targeted a mandatory field or the body failed validation.

### 4. Wait for the cache to refresh

The Fetcher Service caches the policy for 30 minutes. Conversations that end inside that window may still ship under the previous policy. The new policy has no effect on conversations the Fetcher Service already collected — redaction runs at ingest time, not retroactively.

## Result

Wait for a real Genesys Cloud conversation to end, then read the resulting contact back through the Operata API. Denied fields are absent from the payload, encrypted fields appear as opaque ciphertext, allowed fields pass through unchanged, and every other field's value is `null`.

```bash theme={null}
curl -u "$OPERATA_GROUP_ID:$OPERATA_API_TOKEN" \
  "https://api.operata.io/v1/data/calls?fromTime=2026-05-18T00:00:00Z&toTime=2026-05-18T23:59:59Z&size=1"
```

## Related

* [Genesys Cloud redaction schema](/docs/genesys-privacy) — field tiers, mandatory keep-list, processing order, and the cache-fallback table.
* [Privacy and redaction](/docs/concepts-privacy-and-redaction) — the cross-integration model.
* [Genesys Cloud integration overview](/docs/genesys-overview) — the EventBridge topics and REST endpoints the schema applies to.