> ## Documentation Index
> Fetch the complete documentation index at: https://docs.operata.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure Amazon Lex redaction

> Apply a redaction policy to the Amazon Lex Lambda so PII is stripped from every Lex conversation event before it reaches Operata.

Configure the Amazon Lex redaction Lambda to apply your rules to every Amazon Lex conversation event it reads from CloudWatch, shipping only the surviving payload to Operata.

## Before you start

* The [Amazon Lex integration](/docs/lex-integration) stack deployed against your Amazon Connect instance.
* An Operata API token with admin permissions. See [Authentication](/docs/api-authentication).
* The list of Amazon Lex field paths you want to allow, deny, encrypt, or transform. The schema and the mandatory keep-list live in [Lex redaction schema](/docs/lex-privacy).

<Warning>
  Today only the Mandatory tier is enforced end to end. Allow, Deny, Encrypt, and Transform rules are accepted in the config but applied as pass-through. Follow the [Operata changelog](/docs/changelog) for rollout.
</Warning>

## Steps

### 1. Draft your rules

Path notation is dot-delimited against the Lex V2 conversation log JSON payload. Rules apply at every depth. A wildcard segment such as `interpretations.intent.slots.*.shape` matches every slot name.

Common drafts:

```json theme={null}
{
  "rules": [
    { "type": "DENY",    "field": "interpretations.intent.slots.cardNumber" },
    { "type": "ALLOW",   "field": "interpretations.intent.name" },
    { "type": "ENCRYPT", "field": "transcriptions.transcript" }
  ]
}
```

Rules that target a mandatory field are rejected. The mandatory keep-list includes `sessionId`, `bot`, `interpretations.intent.name`, and the `x-amz-lex:*` session attributes — see [Lex redaction schema](/docs/lex-privacy#mandatory-keep-list) for the full list.

### 2. Send the policy to Operata Support

The customer-facing API for Lex redaction policies is not yet public. Send your drafted ruleset to [Operata Support](mailto:support@operata.com) with the Operata Group ID you want it applied to. Operata installs the policy against your Lambda and confirms when it is live.

### 3. Wait for the Lambda to pick up the new policy

The redaction Lambda reads the active policy on each invocation. Allow up to a minute for in-flight events to drain under the previous policy. The new policy has no effect on events the Lambda already collected — redaction runs at ingest time, not retroactively.

## Result

Place a test contact that routes through your Lex bot, then read the matching contact back through the Operata API. Denied slot or transcript fields drop from the response, the mandatory keep-list survives, and every other field's value is `null` until Allow, Encrypt, and Transform reach end-to-end enforcement.

```bash theme={null}
curl -u "$OPERATA_GROUP_ID:$OPERATA_API_TOKEN" \
  "https://api.operata.io/v1/data/calls?fromTime=2026-05-18T00:00:00Z&toTime=2026-05-18T23:59:59Z&size=1"
```

## Related

* [Lex redaction schema](/docs/lex-privacy) — field tiers, mandatory keep-list, and processing order.
* [Privacy and redaction](/docs/concepts-privacy-and-redaction) — the cross-integration model.
* [Configure Contact Flow Log redaction](/docs/guides-configure-contact-flow-log-redaction) — the sibling rollout for Contact Flow Log data.