add http.{request,response}.body.content by SylvainJuge · Pull Request #3521 · open-telemetry/semantic-conventions

SylvainJuge · 2026-03-09T16:43:36Z

Part of #857

adds http.{request,response}.body.content attribute as type any.
recommend to capture value as string whenever possible using heuristics

Covers both the request and response, however the implementation is likely to focus on the server request first:

I am currently focusing on this aspect with Java PoC implementation in [wip] capture servlet request body opentelemetry-java-instrumentation#16006
the response body is similar to
both client and server spans are supported, in practice both should not be used at the same time to prevent duplication.

… into http-request-response-body

github-actions · 2026-03-09T16:44:05Z

This PR contains changes to area(s) that do not have an active SIG/project and will be auto-closed:

http

Such changes may be rejected or put on hold until a new SIG/project is established.

Please refer to the Semantic Convention Areas
document to see the current active SIGs and also to learn how to kick start a new one.

SylvainJuge · 2026-03-10T08:14:09Z

@trask can you re-open this ? Should we create a dedicated SIG/project to handle that ?

… into http-request-response-body

SylvainJuge · 2026-03-13T11:55:04Z

Update: updating to cover request + response (as suggested here) and also making it client+server.

Co-authored-by: Liudmila Molkova <neskazu@gmail.com>

github-actions · 2026-05-06T04:25:28Z

This PR has been labeled as stale due to lack of activity. It will be automatically closed if there is no further activity over the next 7 days.

… into http-request-response-body

github-actions · 2026-05-21T04:43:31Z

This PR has been labeled as stale due to lack of activity. It will be automatically closed if there is no further activity over the next 7 days.

… into http-request-response-body

lmolkova · 2026-07-01T23:33:08Z

+
+To prevent excessive overhead and storage by default, instrumentations MUST issue a warning when the feature is used without an explicit `AttributeValueLengthLimit` configuration option.
+
+Instrumentations MUST disable capture by default and provide an opt-in configuration option to enable it as it can capture sensitive information and cause performance overhead.


Suggested change

Instrumentations MUST disable capture by default and provide an opt-in configuration option to enable it as it can capture sensitive information and cause performance overhead.

Instrumentations MUST NOT capture this attribute by default and MAY provide an option to enable it.

> [!WARNING]

> This attribute may contain sensitive information.

a bit more clarity and also this is a standard incantation we use in semconv to mark sensitive things.

it seems it was lost since it was applied to md and regenerated from yaml, adding comment to yaml, please make sure to update response body too

Co-authored-by: Liudmila Molkova <neskazu@gmail.com>

… into http-request-response-body

hegerchr · 2026-07-13T12:35:05Z

Hi maintainers (@AlexanderWert , @arminru , @kamphaus , @joaopgrassi , @jsuereth , @lmolkova , @trask ), is there anything that's blocking progress on this? Would be really great to get the sem conv merged to unblock implementations.

lmolkova

A few minor suggestions, looks good otherwise!

lmolkova · 2026-07-17T18:17:50Z

+        note: |
+          Captured value MAY be limited in size and thus value is expected to be truncated in many cases.
+
+          Instrumentations MUST disable capture by default and provide an opt-in configuration option to enable it as it can capture sensitive information and cause performance overhead.


Suggested change

Instrumentations MUST disable capture by default and provide an opt-in configuration option to enable it as it can capture sensitive information and cause performance overhead.

Instrumentations MUST NOT capture this attribute by default and MAY provide an option to enable it.

> [!WARNING]

> This attribute may contain sensitive information.

lmolkova · 2026-07-17T18:19:13Z

+
+          Instrumentations MUST disable capture by default and provide an opt-in configuration option to enable it as it can capture sensitive information and cause performance overhead.
+
+          Instrumentations SHOULD capture the body as string whenever possible as it makes it easier to use in human-readable form, also it allows to implement sanitization if needed.


Suggested change

Instrumentations SHOULD capture the body as string whenever possible as it makes it easier to use in human-readable form, also it allows to implement sanitization if needed.

When instrumentations record body, they SHOULD capture the body as string whenever possible as it makes it easier to use in human-readable form, also it allows to implement sanitization if needed.

lmolkova · 2026-07-17T18:21:12Z

+          Instrumentations that implement request body recording MUST NOT intentionally introduce side effects such as changing stream position or closing body stream independently from the
+          application.
+
+          When body is recorded on HTTP client or server spans, the instrumentation SHOULD record part of the body that was sent or received at the time HTTP span has ended.


nit: we might want to stamp them on logs in the future

Suggested change

When body is recorded on HTTP client or server spans, the instrumentation SHOULD record part of the body that was sent or received at the time HTTP span has ended.

When body is recorded, the instrumentation SHOULD record part of the body that was sent or received at the time HTTP call has ended.

lmolkova · 2026-07-17T18:27:23Z

+
+To prevent excessive overhead and storage by default, instrumentations MUST issue a warning when the feature is used without an explicit `AttributeValueLengthLimit` configuration option.
+
+Instrumentations MUST disable capture by default and provide an opt-in configuration option to enable it as it can capture sensitive information and cause performance overhead.


it seems it was lost since it was applied to md and regenerated from yaml, adding comment to yaml, please make sure to update response body too

lmolkova · 2026-07-17T18:28:02Z

+        note: |
+          Captured value MAY be limited in size and thus value is expected to be truncated in many cases.
+
+          Instrumentations MUST disable capture by default and provide an opt-in configuration option to enable it as it can capture sensitive information and cause performance overhead.


see comment on request body

lmolkova · 2026-07-17T18:28:42Z

+          Instrumentations that implement response body recording MUST NOT intentionally introduce side effects such as changing stream position or closing body stream independently from the
+          application.
+
+          When body is recorded on HTTP client or server spans, the instrumentation SHOULD record part of the body that was sent or received at the time HTTP span has ended.


please sync with suggestion on request body (let's not focus on spans)

opentelemetry-pr-dashboard · 2026-07-21T12:38:54Z

Pull request dashboard status

Status last refreshed: 2026-07-25 11:59:44 UTC.

Waiting on: Author
Next step: Address or respond to 5 review feedback items:
- Inline threads: 1, 2, 3, 4, 5
- For each item, reply to move the discussion forward, e.g. link to the commit that addresses it, explain why no change is needed, or ask a follow-up question.

This automated status or its linked feedback items may be incorrect. If something looks wrong, please report it with the result you expected. If you believe this pull request is incorrectly routed as waiting on the author, comment /dashboard route:reviewers to route it from waiting on the author to waiting on reviewers. If the last refreshed time above predates your latest reply or push, the dashboard hasn't processed it yet.

SylvainJuge added 3 commits March 9, 2026 17:36

add http request body content

f59225d

add changelog

f3414ad

Merge branch 'main' of github.com:open-telemetry/semantic-conventions…

b2b3712

… into http-request-response-body

SylvainJuge self-assigned this Mar 9, 2026

github-actions Bot added enhancement New feature or request area:http labels Mar 9, 2026

github-actions Bot added the triage:rejected:declined label Mar 9, 2026

github-actions Bot closed this Mar 9, 2026

SylvainJuge mentioned this pull request Mar 9, 2026

Capture request and response bodies #857

Open

trask added triage:accepted:ready and removed triage:rejected:declined labels Mar 10, 2026

trask reopened this Mar 10, 2026

SylvainJuge added 2 commits March 13, 2026 12:53

update to cover request+response client+server

2e6d1ba

Merge branch 'main' of github.com:open-telemetry/semantic-conventions…

bb74689

… into http-request-response-body

SylvainJuge changed the title ~~add http.request.body.content~~ add http.{request,response}.body.content Mar 13, 2026

SylvainJuge added 3 commits March 13, 2026 13:01

update markdown

d9480af

use note to fix markdown table length

050b639

update registry

c5e0d54

SylvainJuge marked this pull request as ready for review March 13, 2026 12:40

SylvainJuge requested review from a team as code owners March 13, 2026 12:40

AlexanderWert added this to Semantic Conventions Triage Mar 23, 2026

github-project-automation Bot moved this to Untriaged in Semantic Conventions Triage Mar 23, 2026

AlexanderWert moved this from Untriaged to Awaiting codeowners approval in Semantic Conventions Triage Mar 23, 2026

lmolkova reviewed Mar 27, 2026

View reviewed changes

Comment thread model/http/registry.yaml Outdated

Comment thread model/http/registry.yaml Outdated

Comment thread model/http/registry.yaml Outdated

Comment thread model/http/registry.yaml

Apply suggestions from code review

0ddac78

Co-authored-by: Liudmila Molkova <neskazu@gmail.com>

update markdown

56bacd9

github-actions Bot added the Stale label May 6, 2026

Merge branch 'main' of github.com:open-telemetry/semantic-conventions…

96ae701

… into http-request-response-body

github-actions Bot removed the Stale label May 7, 2026

github-actions Bot added the Stale label May 21, 2026

Merge branch 'main' of github.com:open-telemetry/semantic-conventions…

845e305

… into http-request-response-body

github-actions Bot removed the Stale label May 26, 2026

SylvainJuge added 4 commits June 4, 2026 10:03

Merge branch 'main' of github.com:open-telemetry/semantic-conventions…

b840946

… into http-request-response-body

modify http body limit

e21fdfe

add mention of brittle HTTP body capture

4fe735c

re-generate content & fix formatting

504e42e

jsuereth reviewed Jun 8, 2026

View reviewed changes

Comment thread model/http/registry.yaml Outdated

lmolkova mentioned this pull request Jun 8, 2026

Introduce annotations for large attributes #3773

Open

trask reviewed Jun 15, 2026

View reviewed changes

Comment thread model/http/registry.yaml Outdated

SylvainJuge added 2 commits June 23, 2026 09:48

Merge branch 'main' of github.com:open-telemetry/semantic-conventions…

7130a7f

… into http-request-response-body

simplify max captured body size

a39747c

lmolkova reviewed Jul 1, 2026

View reviewed changes

SylvainJuge and others added 7 commits July 2, 2026 10:00

Apply suggestion from @lmolkova

5f12bf5

Co-authored-by: Liudmila Molkova <neskazu@gmail.com>

post-review changes

332ffef

fix yamllint

93e0f5d

try to fix things

ec37ec1

Merge branch 'main' of github.com:open-telemetry/semantic-conventions…

5948a1f

… into http-request-response-body

Merge branch 'main' of github.com:open-telemetry/semantic-conventions…

d5cdcda

… into http-request-response-body

remove few paragraphs

7d5fedf

lmolkova reviewed Jul 17, 2026

View reviewed changes

opentelemetry-pr-dashboard Bot mentioned this pull request Jul 21, 2026

Pull Request Dashboard #3912

Open


		To prevent excessive overhead and storage by default, instrumentations MUST issue a warning when the feature is used without an explicit `AttributeValueLengthLimit` configuration option.

		Instrumentations MUST disable capture by default and provide an opt-in configuration option to enable it as it can capture sensitive information and cause performance overhead.

-Instrumentations MUST disable capture by default and provide an opt-in configuration option to enable it as it can capture sensitive information and cause performance overhead.
+Instrumentations MUST NOT capture this attribute by default and MAY provide an option to enable it.
+> [!WARNING]
+> This attribute may contain sensitive information.


		Instrumentations MUST disable capture by default and provide an opt-in configuration option to enable it as it can capture sensitive information and cause performance overhead.

		Instrumentations SHOULD capture the body as string whenever possible as it makes it easier to use in human-readable form, also it allows to implement sanitization if needed.

	Instrumentations SHOULD capture the body as string whenever possible as it makes it easier to use in human-readable form, also it allows to implement sanitization if needed.
	When instrumentations record body, they SHOULD capture the body as string whenever possible as it makes it easier to use in human-readable form, also it allows to implement sanitization if needed.

	When body is recorded on HTTP client or server spans, the instrumentation SHOULD record part of the body that was sent or received at the time HTTP span has ended.
	When body is recorded, the instrumentation SHOULD record part of the body that was sent or received at the time HTTP call has ended.

Uh oh!

Conversation

SylvainJuge commented Mar 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Mar 9, 2026

Uh oh!

SylvainJuge commented Mar 10, 2026

Uh oh!

SylvainJuge commented Mar 13, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented May 6, 2026

Uh oh!

github-actions Bot commented May 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

hegerchr commented Jul 13, 2026

Uh oh!

lmolkova left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

opentelemetry-pr-dashboard Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull request dashboard status

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

SylvainJuge commented Mar 9, 2026 •

edited

Loading

opentelemetry-pr-dashboard Bot commented Jul 21, 2026 •

edited

Loading