Request and response export
Export the content an endpoint received and returned to your OpenTelemetry (OTel) tool, with sensitive values masked.
How body export works
Traces and API request details don't carry the payloads received and returned by endpoints. To inspect them, enable body export, as described in Enable OTel export. The request and response bodies go only to your observability tool. The export masks sensitive data such as payment card numbers. SnapLogic doesn't store request or response body content, so it doesn't appear in Groundplex log files or in the SnapLogic UI.
The export includes only text bodies: JSON, XML, URL-encoded form data, and
text/*. For any other body, including binary, the export records the
content type and the size but not the content.
The export captures 2048 bytes from each body by default and truncates anything longer, marking it as truncated. You can raise that limit to 16384 bytes, and you can mask field names beyond the built-in list. Refer to Enable OTel export.
What masking covers
The export masks a sensitive value whether or not its field name reveals it. Masking
replaces the value with four asterisks (****), and covers:
- The value of any field whose name matches the built-in list, which covers names such as
password,token,authorization,apikey,cardnumber,accountnumber,iban,cvv, andssn. You can add your own names to that list. - Any payment card number, wherever it appears in the body, including in free text and in fields with innocuous names. Masking covers Visa, Mastercard, American Express, Discover, Diners Club, JCB, and UnionPay. It recognizes a card number by its format, so it also masks any other number that shares that format, such as an internal identifier.
The following table describes masking and replacement in each body format.
| Body format | Result |
|---|---|
| JSON | In a string, masking replaces only the card number and keeps the text around it. In a
numeric field, it replaces the whole value. CAUTION: When a card number appears
in a JSON numeric field, the field becomes the string "****" so
that the body stays valid JSON. The field changes type, so a consumer
that validates the exported body against a strict schema can reject it. |
| XML | Masking covers text nodes, CDATA sections, comments, and attribute values. Masking a sensitive element masks its nested elements too. |
| Form data | Masking decodes each parameter value first. |
| Plain text | Masking covers card numbers anywhere in the body. |
Limitations:
- Masking applies only to exported request and response bodies. It doesn't apply to the other fields of the API request details, to traces, or to metrics, because none of those carry a body.
- Masking covers payment card numbers and the built-in field names. It doesn't detect other personal data, such as national identification numbers or email addresses, in free text.
- Masking stops at the point of truncation. In XML, if truncation falls inside a sensitive element, the export drops the rest of that element.