Mask Span Attributes: Redact Sensitive Trace Data

About

Traces often contain sensitive data: user messages, API responses, PII, or large base64-encoded images. Sending all of this to a trace backend creates privacy and compliance problems. Masking span attributes removes this data before it leaves the application: it only truncates for one field, base64_image_max_length, which caps the length of base64-encoded images. Everything else is either sent in full or hidden completely; there is no general truncation. To cap the size of arbitrary attribute values (large prompts, tool outputs), see Cap attribute size instead. Configuration is available at two levels: environment variables for defaults across instrumentors that support TraceConfig, and TraceConfig in code for per-instrumentor control. These settings are not an exporter-wide filter for native OpenTelemetry spans; follow the integration’s own privacy instructions.

When to use

• Privacy and compliance: Hide user inputs and LLM outputs to prevent sensitive data from being stored in trace backends.
• Image redaction: Suppress base64-encoded images from input messages or cap their length to reduce payload size.
• Selective masking: Hide only specific parts of a span (e.g. input text but not output messages) while keeping the rest visible.
• Error text: A provider error body can quote your prompt back, and a framework error can include a traceback with local file paths. Hiding inputs or outputs hides error details too; see Errors and privacy to keep or drop them independently.
• Environment-specific config: Use environment variables for deployment-level defaults and TraceConfig in code for per-instrumentor overrides.

How to

from fi_instrumentation import TraceConfig

config = TraceConfig(
    hide_inputs=False,
    hide_outputs=False,
    hide_input_messages=False,
    hide_output_messages=False,
    hide_input_images=False,
    hide_input_text=False,
    hide_output_text=False,
    hide_embedding_vectors=False,
    base64_image_max_length=32000,
)

from traceai_openai import OpenAIInstrumentor
OpenAIInstrumentor().instrument(
    tracer_provider=trace_provider,
    config=config,
)

const { OpenAIInstrumentation } = require("@traceai/openai");

const instrumentation = new OpenAIInstrumentation({
    traceConfig: {
        hideInputs: false,
        hideOutputs: false,
        hideInputMessages: false,
        hideOutputMessages: false,
        hideInputImages: false,
        hideInputText: false,
        hideOutputText: false,
        hideEmbeddingVectors: false,
        base64ImageMaxLength: 32000,
    },
});

Key concepts

• TraceConfig: An object accepted by supporting traceAI instrumentors. Use it to specify masking settings directly in code, scoped to a single instrumentor.
• Environment variables: Defaults shared by instrumentors that support these settings. Useful for deployment-level configuration without changing code.
• Precedence order:TraceConfig in code → environment variables → default values. More specific settings always win.
• hide_inputs / hide_outputs:Broad flags that hide all input/output values and messages in one setting.
• base64_image_max_length:Caps the logged length of base64-encoded images. Default is 32,000 characters.
• hide_error_details: Drops the status description, exception message, and stack trace from failed spans while keeping the ERROR status, error.type, and exception.type. On by default when hide_inputs, hide_outputs, or an input/output message or text hiding flag is true. Image-only masking does not enable it. See Errors and privacy.

Next Steps