url.query

Sensitive content provided in url.query SHOULD be scrubbed when instrumentations can identify it.

!Development Query string values for the following keys SHOULD be redacted by default and replaced by the value REDACTED:

* X-Amz-Signature * X-Amz-Credential * X-Amz-Security-Token * sig * X-Goog-Signature

This list is subject to change over time.

Matching of query parameter keys against the sensitive list SHOULD be case-sensitive.

Instrumentation MAY provide a way to override this list via declarative configuration. If so, it SHOULD use the sensitive_query_parameters property (an array of case-sensitive strings with minimum items 0) under .instrumentation/development.general.sanitization.url. This list is a full override of the default sensitive query parameter keys, it is not a list of keys in addition to the defaults.

When a query string value is redacted, the query string key SHOULD still be preserved, e.g. q=OpenTelemetry&sig=REDACTED.