feat(core): Add and use dataCollection.graphQL

packages/astro/test/server/middleware.test.ts

@@ -64,6 +64,7 @@ describe('sentryMiddleware', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/browser/src/integrations/graphqlClient.ts

@@ -11,6 +11,7 @@ import {
 } from '@sentry/core/browser';
 import type { FetchHint, XhrHint } from '@sentry/browser-utils';
 import { getBodyString, getFetchRequestArgBody, SENTRY_XHR_DATA_KEY } from '@sentry/browser-utils';
+import { GRAPHQL_DOCUMENT } from '@sentry/conventions/attributes';
 
 interface GraphQLClientOptions {
  endpoints: Array<string | RegExp>;
@@ -88,9 +89,9 @@ function _updateSpanWithGraphQLData(client: Client, options: GraphQLClientOption
  const operationInfo = _getGraphQLOperation(graphqlBody);
  span.updateName(`${httpMethod} ${httpUrl} (${operationInfo})`);
 
- // Handle standard requests - always capture the query document
- if (isStandardRequest(graphqlBody)) {
- span.setAttribute('graphql.document', graphqlBody.query);
+ // Handle standard requests - capture the query document when enabled via dataCollection (default true)
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ span.setAttribute(GRAPHQL_DOCUMENT, graphqlBody.query);
  }
 
  // Handle persisted operations - capture hash for debugging
@@ -126,8 +127,8 @@ function _updateBreadcrumbWithGraphQLData(client: Client, options: GraphQLClient
 
  data['graphql.operation'] = operationInfo;
 
- if (isStandardRequest(graphqlBody)) {
- data['graphql.document'] = graphqlBody.query;
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ data[GRAPHQL_DOCUMENT] = graphqlBody.query;
  }
 
  if (isPersistedRequest(graphqlBody)) {

packages/browser/test/integrations/graphqlClient.test.ts

@@ -313,14 +313,18 @@ describe('GraphqlClient', () => {
  });
 
  describe('beforeOutgoingRequestSpan handler', () => {
- function setupHandler(endpoints: Array<string | RegExp>): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
+ function setupHandler(
+ endpoints: Array<string | RegExp>,
+ graphQLDocument = true,
+ ): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
  let capturedListener: ((span: SentrySpan, hint: FetchHint | XhrHint) => void) | undefined;
  const mockClient = {
  on: (eventName: string, cb: (span: SentrySpan, hint: FetchHint | XhrHint) => void) => {
  if (eventName === 'beforeOutgoingRequestSpan') {
  capturedListener = cb;
  }
  },
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
  } as unknown as Client;
 
  const integration = graphqlClientIntegration({ endpoints });
@@ -420,5 +424,25 @@ describe('GraphqlClient', () => {
  expect(json.description).toBe('custom span');
  expect(json.data['graphql.document']).toBeUndefined();
  });
+
+ test('omits graphql.document when dataCollection.graphQL.document is false', () => {
+ const handler = setupHandler([/\/graphql$/], false);
+ const span = new SentrySpan({
+ name: 'POST http://localhost:4000/graphql',
+ op: 'http.client',
+ attributes: {
+ 'http.method': 'POST',
+ 'http.url': 'http://localhost:4000/graphql',
+ url: 'http://localhost:4000/graphql',
+ },
+ });
+
+ handler(span, makeFetchHint('http://localhost:4000/graphql', requestBody));
+
+ const json = spanToJSON(span);
+ // The span is still renamed with the operation, but the document is not attached.
+ expect(json.description).toBe('POST http://localhost:4000/graphql (query GetHello)');
+ expect(json.data['graphql.document']).toBeUndefined();
+ });
  });
 });

packages/core/src/types/datacollection.ts

@@ -51,7 +51,26 @@ export interface DataCollection {
  queryParams?: CollectBehavior;
 
  /**
- * Controls generative AI input/output recording.
+ * Allow collection of GraphQL operation data when using the SDK's GraphQL integrations
+ *
+ * These options do not add GraphQL instrumentation on their own. The corresponding integration must still be enabled
+ * for any data to be captured.
+ *
+ * - `document`: attach the GraphQL document (query/mutation source text).
+ * - `variables`: attach the variables passed to GraphQL operations.
+ * @default { document: true, variables: true }
+ */
+ graphQL?: {
+ document?: boolean;
+ variables?: boolean;
+ };
+
+ /**
+ * Allow generative AI input/output recording when using the SDK's AI integrations.
+ *
+ * These options do not add AI instrumentation on their own. The corresponding integration must still be enabled for
+ * any data to be captured. Integration-level options, when set, take precedence over these
+ * values.
  * @default { inputs: true, outputs: true }
  */
  genAI?: {
@@ -77,5 +96,6 @@ export interface DataCollection {
  */
 export type ResolvedDataCollection = Required<DataCollection> & {
  httpHeaders: Required<NonNullable<DataCollection['httpHeaders']>>;
+ graphQL: Required<NonNullable<DataCollection['graphQL']>>;
  genAI: Required<NonNullable<DataCollection['genAI']>>;
 };

packages/core/src/utils/data-collection/defaultPiiToCollectionOptions.ts

@@ -16,6 +16,7 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7
@@ -26,6 +27,9 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: { deny: PII_HEADER_SNIPPETS }, response: { deny: PII_HEADER_SNIPPETS } },
  httpBodies: [],
  queryParams: { deny: PII_HEADER_SNIPPETS },
+ // The GraphQL document has literal values redacted at collection time, so it was historically
+ // always attached regardless of `sendDefaultPii`; keep it on to preserve that behavior.
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7

packages/core/src/utils/data-collection/resolveDataCollectionOptions.ts

@@ -7,6 +7,7 @@ const DEFAULTS: ResolvedDataCollection = {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -43,6 +44,10 @@ export function resolveDataCollectionOptions(options: {
  },
  httpBodies: dc.httpBodies ?? base.httpBodies,
  queryParams: dc.queryParams ?? base.queryParams,
+ graphQL: {
+ document: dc.graphQL?.document ?? base.graphQL.document,
+ variables: dc.graphQL?.variables ?? base.graphQL.variables,
+ },
  genAI: {
  inputs: dc.genAI?.inputs ?? base.genAI.inputs,
  outputs: dc.genAI?.outputs ?? base.genAI.outputs,

packages/core/test/lib/integrations/mcp-server/testUtils.ts

@@ -17,6 +17,7 @@ export function createMockClient(userInfo = true, genAI?: { inputs: boolean; out
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: genAIOptions,
  stackFrameVariables: true,
  frameContextLines: 5,

packages/core/test/lib/utils/data-collection/defaultPiiToCollectionOptions.test.ts

@@ -9,6 +9,7 @@ describe('defaultPiiToCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -25,6 +26,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -41,6 +43,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -57,6 +60,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,

packages/core/test/lib/utils/data-collection/resolveDataCollectionOptions.test.ts

@@ -8,6 +8,7 @@ describe('resolveDataCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -21,6 +22,8 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ // GraphQL documents are redacted at collection time, so they stay on to preserve legacy behavior.
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(7);
  });
@@ -45,6 +48,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.httpBodies).toEqual(['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse']);
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  });
 
@@ -54,6 +58,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  });
  });
 
@@ -87,6 +92,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.cookies).toBe(true);
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(5);
@@ -114,6 +120,17 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.genAI.outputs).toBe(true);
  });
 
+ it('merges nested graphQL partially', () => {
+ const result = resolveDataCollectionOptions({
+ dataCollection: {
+ graphQL: { document: false },
+ },
+ });
+
+ expect(result.graphQL.document).toBe(false);
+ expect(result.graphQL.variables).toBe(true);
+ });
+
  it('supports allow/deny list for cookies', () => {
  const result = resolveDataCollectionOptions({
  dataCollection: {
@@ -139,14 +156,17 @@ describe('resolveDataCollectionOptions', () => {
  it('always returns all fields', () => {
  const result = resolveDataCollectionOptions({});
 
- expect(Object.keys(result)).toHaveLength(8);
+ expect(Object.keys(result)).toHaveLength(9);
  expect(result).toHaveProperty('userInfo');
  expect(result).toHaveProperty('cookies');
  expect(result).toHaveProperty('httpHeaders');
  expect(result).toHaveProperty('httpHeaders.request');
  expect(result).toHaveProperty('httpHeaders.response');
  expect(result).toHaveProperty('httpBodies');
  expect(result).toHaveProperty('queryParams');
+ expect(result).toHaveProperty('graphQL');
+ expect(result).toHaveProperty('graphQL.document');
+ expect(result).toHaveProperty('graphQL.variables');
  expect(result).toHaveProperty('genAI');
  expect(result).toHaveProperty('genAI.inputs');
  expect(result).toHaveProperty('genAI.outputs');

packages/core/test/lib/utils/request.test.ts

@@ -874,6 +874,7 @@ describe('request utils', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/node/src/integrations/tracing/graphql/vendored/utils.ts

@@ -23,7 +23,7 @@ import type {
  Token,
 } from './graphql-types';
 import type { Span, SpanAttributes } from '@sentry/core';
-import { isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
+import { getClient, isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
 import { AllowedOperationTypes, SpanNames, TokenKind } from './enum';
 import { AttributeNames } from './enums/AttributeNames';
 import { OTEL_GRAPHQL_DATA_SYMBOL, OTEL_PATCHED_SYMBOL } from './symbols';
@@ -38,8 +38,10 @@ export const isPromise = (value: any): value is Promise<unknown> => {
 };
 
 export function addSpanSource(span: Span, loc?: Location, start?: number, end?: number): void {
- const source = getSourceFromLocation(loc, start, end);
- span.setAttribute(AttributeNames.SOURCE, source);
+ if (getClient()?.getDataCollectionOptions().graphQL.document === true) {
+ const source = getSourceFromLocation(loc, start, end);
+ span.setAttribute(AttributeNames.SOURCE, source);
+ }
 }
 
 function createFieldIfNotExists(

packages/node/test/integrations/tracing/graphql/addSpanSource.test.ts

@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import * as core from '@sentry/core';
+import { addSpanSource } from '../../../../src/integrations/tracing/graphql/vendored/utils';
+import type { Location, Token } from '@sentry/server-utils/orchestrion';
+
+vi.spyOn(core, 'getClient');
+
+function mockClient(graphQLDocument: boolean): void {
+ vi.mocked(core.getClient).mockReturnValue({
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
+ } as any);
+}
+
+function makeLocation(): Location {
+ const token: Token = {
+ kind: 'Name',
+ start: 0,
+ end: 5,
+ line: 1,
+ column: 1,
+ value: 'hello',
+ prev: null,
+ next: null,
+ };
+ return { start: 0, end: 5, startToken: token };
+}
+
+describe('addSpanSource dataCollection gate', () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ });
+
+ it('sets graphql.source attribute when graphQL.document is true', () => {
+ mockClient(true);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).toHaveBeenCalledWith('graphql.source', expect.any(String));
+ });
+
+ it('does not set attribute when graphQL.document is false', () => {
+ mockClient(false);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+
+ it('does not set attribute when getClient() is undefined', () => {
+ vi.mocked(core.getClient).mockReturnValue(undefined);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+});

packages/nuxt/test/runtime/hooks/wrapMiddlewareHandler.test.ts

@@ -47,6 +47,7 @@ describe('wrapMiddlewareHandlerWithSentry', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/remix/test/server/errors.test.ts

@@ -17,6 +17,7 @@ function createMockClient(httpBodies: string[] = []): Client {
  httpHeaders: { request: true, response: true },
  httpBodies,
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/astro/test/server/middleware.test.ts

@@ -64,6 +64,7 @@ describe('sentryMiddleware', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/browser/src/integrations/graphqlClient.ts

@@ -11,6 +11,7 @@ import {
 } from '@sentry/core/browser';
 import type { FetchHint, XhrHint } from '@sentry/browser-utils';
 import { getBodyString, getFetchRequestArgBody, SENTRY_XHR_DATA_KEY } from '@sentry/browser-utils';
+import { GRAPHQL_DOCUMENT } from '@sentry/conventions/attributes';
 
 interface GraphQLClientOptions {
  endpoints: Array<string | RegExp>;
@@ -88,9 +89,9 @@ function _updateSpanWithGraphQLData(client: Client, options: GraphQLClientOption
  const operationInfo = _getGraphQLOperation(graphqlBody);
  span.updateName(`${httpMethod} ${httpUrl} (${operationInfo})`);
 
- // Handle standard requests - always capture the query document
- if (isStandardRequest(graphqlBody)) {
- span.setAttribute('graphql.document', graphqlBody.query);
+ // Handle standard requests - capture the query document when enabled via dataCollection (default true)
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ span.setAttribute(GRAPHQL_DOCUMENT, graphqlBody.query);
  }
 
  // Handle persisted operations - capture hash for debugging
@@ -126,8 +127,8 @@ function _updateBreadcrumbWithGraphQLData(client: Client, options: GraphQLClient
 
  data['graphql.operation'] = operationInfo;
 
- if (isStandardRequest(graphqlBody)) {
- data['graphql.document'] = graphqlBody.query;
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ data[GRAPHQL_DOCUMENT] = graphqlBody.query;
  }
 
  if (isPersistedRequest(graphqlBody)) {

packages/browser/test/integrations/graphqlClient.test.ts

@@ -313,14 +313,18 @@ describe('GraphqlClient', () => {
  });
 
  describe('beforeOutgoingRequestSpan handler', () => {
- function setupHandler(endpoints: Array<string | RegExp>): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
+ function setupHandler(
+ endpoints: Array<string | RegExp>,
+ graphQLDocument = true,
+ ): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
  let capturedListener: ((span: SentrySpan, hint: FetchHint | XhrHint) => void) | undefined;
  const mockClient = {
  on: (eventName: string, cb: (span: SentrySpan, hint: FetchHint | XhrHint) => void) => {
  if (eventName === 'beforeOutgoingRequestSpan') {
  capturedListener = cb;
  }
  },
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
  } as unknown as Client;
 
  const integration = graphqlClientIntegration({ endpoints });
@@ -420,5 +424,25 @@ describe('GraphqlClient', () => {
  expect(json.description).toBe('custom span');
  expect(json.data['graphql.document']).toBeUndefined();
  });
+
+ test('omits graphql.document when dataCollection.graphQL.document is false', () => {
+ const handler = setupHandler([/\/graphql$/], false);
+ const span = new SentrySpan({
+ name: 'POST http://localhost:4000/graphql',
+ op: 'http.client',
+ attributes: {
+ 'http.method': 'POST',
+ 'http.url': 'http://localhost:4000/graphql',
+ url: 'http://localhost:4000/graphql',
+ },
+ });
+
+ handler(span, makeFetchHint('http://localhost:4000/graphql', requestBody));
+
+ const json = spanToJSON(span);
+ // The span is still renamed with the operation, but the document is not attached.
+ expect(json.description).toBe('POST http://localhost:4000/graphql (query GetHello)');
+ expect(json.data['graphql.document']).toBeUndefined();
+ });
  });
 });

packages/core/src/types/datacollection.ts

@@ -51,7 +51,26 @@ export interface DataCollection {
  queryParams?: CollectBehavior;
 
  /**
- * Controls generative AI input/output recording.
+ * Allow collection of GraphQL operation data when using the SDK's GraphQL integrations
+ *
+ * These options do not add GraphQL instrumentation on their own. The corresponding integration must still be enabled
+ * for any data to be captured.
+ *
+ * - `document`: attach the GraphQL document (query/mutation source text).
+ * - `variables`: attach the variables passed to GraphQL operations.
+ * @default { document: true, variables: true }
+ */
+ graphQL?: {
+ document?: boolean;
+ variables?: boolean;
+ };
+
+ /**
+ * Allow generative AI input/output recording when using the SDK's AI integrations.
+ *
+ * These options do not add AI instrumentation on their own. The corresponding integration must still be enabled for
+ * any data to be captured. Integration-level options, when set, take precedence over these
+ * values.
  * @default { inputs: true, outputs: true }
  */
  genAI?: {
@@ -77,5 +96,6 @@ export interface DataCollection {
  */
 export type ResolvedDataCollection = Required<DataCollection> & {
  httpHeaders: Required<NonNullable<DataCollection['httpHeaders']>>;
+ graphQL: Required<NonNullable<DataCollection['graphQL']>>;
  genAI: Required<NonNullable<DataCollection['genAI']>>;
 };

packages/core/src/utils/data-collection/defaultPiiToCollectionOptions.ts

@@ -16,6 +16,7 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7
@@ -26,6 +27,9 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: { deny: PII_HEADER_SNIPPETS }, response: { deny: PII_HEADER_SNIPPETS } },
  httpBodies: [],
  queryParams: { deny: PII_HEADER_SNIPPETS },
+ // The GraphQL document has literal values redacted at collection time, so it was historically
+ // always attached regardless of `sendDefaultPii`; keep it on to preserve that behavior.
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7

packages/core/src/utils/data-collection/resolveDataCollectionOptions.ts

@@ -7,6 +7,7 @@ const DEFAULTS: ResolvedDataCollection = {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -43,6 +44,10 @@ export function resolveDataCollectionOptions(options: {
  },
  httpBodies: dc.httpBodies ?? base.httpBodies,
  queryParams: dc.queryParams ?? base.queryParams,
+ graphQL: {
+ document: dc.graphQL?.document ?? base.graphQL.document,
+ variables: dc.graphQL?.variables ?? base.graphQL.variables,
+ },
  genAI: {
  inputs: dc.genAI?.inputs ?? base.genAI.inputs,
  outputs: dc.genAI?.outputs ?? base.genAI.outputs,

packages/core/test/lib/integrations/mcp-server/testUtils.ts

@@ -17,6 +17,7 @@ export function createMockClient(userInfo = true, genAI?: { inputs: boolean; out
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: genAIOptions,
  stackFrameVariables: true,
  frameContextLines: 5,

packages/core/test/lib/utils/data-collection/defaultPiiToCollectionOptions.test.ts

@@ -9,6 +9,7 @@ describe('defaultPiiToCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -25,6 +26,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -41,6 +43,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -57,6 +60,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,

packages/core/test/lib/utils/data-collection/resolveDataCollectionOptions.test.ts

@@ -8,6 +8,7 @@ describe('resolveDataCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -21,6 +22,8 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ // GraphQL documents are redacted at collection time, so they stay on to preserve legacy behavior.
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(7);
  });
@@ -45,6 +48,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.httpBodies).toEqual(['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse']);
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  });
 
@@ -54,6 +58,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  });
  });
 
@@ -87,6 +92,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.cookies).toBe(true);
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(5);
@@ -114,6 +120,17 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.genAI.outputs).toBe(true);
  });
 
+ it('merges nested graphQL partially', () => {
+ const result = resolveDataCollectionOptions({
+ dataCollection: {
+ graphQL: { document: false },
+ },
+ });
+
+ expect(result.graphQL.document).toBe(false);
+ expect(result.graphQL.variables).toBe(true);
+ });
+
  it('supports allow/deny list for cookies', () => {
  const result = resolveDataCollectionOptions({
  dataCollection: {
@@ -139,14 +156,17 @@ describe('resolveDataCollectionOptions', () => {
  it('always returns all fields', () => {
  const result = resolveDataCollectionOptions({});
 
- expect(Object.keys(result)).toHaveLength(8);
+ expect(Object.keys(result)).toHaveLength(9);
  expect(result).toHaveProperty('userInfo');
  expect(result).toHaveProperty('cookies');
  expect(result).toHaveProperty('httpHeaders');
  expect(result).toHaveProperty('httpHeaders.request');
  expect(result).toHaveProperty('httpHeaders.response');
  expect(result).toHaveProperty('httpBodies');
  expect(result).toHaveProperty('queryParams');
+ expect(result).toHaveProperty('graphQL');
+ expect(result).toHaveProperty('graphQL.document');
+ expect(result).toHaveProperty('graphQL.variables');
  expect(result).toHaveProperty('genAI');
  expect(result).toHaveProperty('genAI.inputs');
  expect(result).toHaveProperty('genAI.outputs');

packages/core/test/lib/utils/request.test.ts

@@ -874,6 +874,7 @@ describe('request utils', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/node/src/integrations/tracing/graphql/vendored/utils.ts

@@ -23,7 +23,7 @@ import type {
  Token,
 } from './graphql-types';
 import type { Span, SpanAttributes } from '@sentry/core';
-import { isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
+import { getClient, isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
 import { AllowedOperationTypes, SpanNames, TokenKind } from './enum';
 import { AttributeNames } from './enums/AttributeNames';
 import { OTEL_GRAPHQL_DATA_SYMBOL, OTEL_PATCHED_SYMBOL } from './symbols';
@@ -38,8 +38,10 @@ export const isPromise = (value: any): value is Promise<unknown> => {
 };
 
 export function addSpanSource(span: Span, loc?: Location, start?: number, end?: number): void {
- const source = getSourceFromLocation(loc, start, end);
- span.setAttribute(AttributeNames.SOURCE, source);
+ if (getClient()?.getDataCollectionOptions().graphQL.document === true) {
+ const source = getSourceFromLocation(loc, start, end);
+ span.setAttribute(AttributeNames.SOURCE, source);
+ }
 }
 
 function createFieldIfNotExists(

packages/node/test/integrations/tracing/graphql/addSpanSource.test.ts

@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import * as core from '@sentry/core';
+import { addSpanSource } from '../../../../src/integrations/tracing/graphql/vendored/utils';
+import type { Location, Token } from '@sentry/server-utils/orchestrion';
+
+vi.spyOn(core, 'getClient');
+
+function mockClient(graphQLDocument: boolean): void {
+ vi.mocked(core.getClient).mockReturnValue({
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
+ } as any);
+}
+
+function makeLocation(): Location {
+ const token: Token = {
+ kind: 'Name',
+ start: 0,
+ end: 5,
+ line: 1,
+ column: 1,
+ value: 'hello',
+ prev: null,
+ next: null,
+ };
+ return { start: 0, end: 5, startToken: token };
+}
+
+describe('addSpanSource dataCollection gate', () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ });
+
+ it('sets graphql.source attribute when graphQL.document is true', () => {
+ mockClient(true);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).toHaveBeenCalledWith('graphql.source', expect.any(String));
+ });
+
+ it('does not set attribute when graphQL.document is false', () => {
+ mockClient(false);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+
+ it('does not set attribute when getClient() is undefined', () => {
+ vi.mocked(core.getClient).mockReturnValue(undefined);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+});

packages/nuxt/test/runtime/hooks/wrapMiddlewareHandler.test.ts

@@ -47,6 +47,7 @@ describe('wrapMiddlewareHandlerWithSentry', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/remix/test/server/errors.test.ts

@@ -17,6 +17,7 @@ function createMockClient(httpBodies: string[] = []): Client {
  httpHeaders: { request: true, response: true },
  httpBodies,
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/astro/test/server/middleware.test.ts

@@ -64,6 +64,7 @@ describe('sentryMiddleware', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/browser/src/integrations/graphqlClient.ts

@@ -11,6 +11,7 @@ import {
 } from '@sentry/core/browser';
 import type { FetchHint, XhrHint } from '@sentry/browser-utils';
 import { getBodyString, getFetchRequestArgBody, SENTRY_XHR_DATA_KEY } from '@sentry/browser-utils';
+import { GRAPHQL_DOCUMENT } from '@sentry/conventions/attributes';
 
 interface GraphQLClientOptions {
  endpoints: Array<string | RegExp>;
@@ -88,9 +89,9 @@ function _updateSpanWithGraphQLData(client: Client, options: GraphQLClientOption
  const operationInfo = _getGraphQLOperation(graphqlBody);
  span.updateName(`${httpMethod} ${httpUrl} (${operationInfo})`);
 
- // Handle standard requests - always capture the query document
- if (isStandardRequest(graphqlBody)) {
- span.setAttribute('graphql.document', graphqlBody.query);
+ // Handle standard requests - capture the query document when enabled via dataCollection (default true)
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ span.setAttribute(GRAPHQL_DOCUMENT, graphqlBody.query);
  }
 
  // Handle persisted operations - capture hash for debugging
@@ -126,8 +127,8 @@ function _updateBreadcrumbWithGraphQLData(client: Client, options: GraphQLClient
 
  data['graphql.operation'] = operationInfo;
 
- if (isStandardRequest(graphqlBody)) {
- data['graphql.document'] = graphqlBody.query;
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ data[GRAPHQL_DOCUMENT] = graphqlBody.query;
  }
 
  if (isPersistedRequest(graphqlBody)) {

packages/browser/test/integrations/graphqlClient.test.ts

@@ -313,14 +313,18 @@ describe('GraphqlClient', () => {
  });
 
  describe('beforeOutgoingRequestSpan handler', () => {
- function setupHandler(endpoints: Array<string | RegExp>): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
+ function setupHandler(
+ endpoints: Array<string | RegExp>,
+ graphQLDocument = true,
+ ): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
  let capturedListener: ((span: SentrySpan, hint: FetchHint | XhrHint) => void) | undefined;
  const mockClient = {
  on: (eventName: string, cb: (span: SentrySpan, hint: FetchHint | XhrHint) => void) => {
  if (eventName === 'beforeOutgoingRequestSpan') {
  capturedListener = cb;
  }
  },
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
  } as unknown as Client;
 
  const integration = graphqlClientIntegration({ endpoints });
@@ -420,5 +424,25 @@ describe('GraphqlClient', () => {
  expect(json.description).toBe('custom span');
  expect(json.data['graphql.document']).toBeUndefined();
  });
+
+ test('omits graphql.document when dataCollection.graphQL.document is false', () => {
+ const handler = setupHandler([/\/graphql$/], false);
+ const span = new SentrySpan({
+ name: 'POST http://localhost:4000/graphql',
+ op: 'http.client',
+ attributes: {
+ 'http.method': 'POST',
+ 'http.url': 'http://localhost:4000/graphql',
+ url: 'http://localhost:4000/graphql',
+ },
+ });
+
+ handler(span, makeFetchHint('http://localhost:4000/graphql', requestBody));
+
+ const json = spanToJSON(span);
+ // The span is still renamed with the operation, but the document is not attached.
+ expect(json.description).toBe('POST http://localhost:4000/graphql (query GetHello)');
+ expect(json.data['graphql.document']).toBeUndefined();
+ });
  });
 });

packages/core/src/types/datacollection.ts

@@ -51,7 +51,26 @@ export interface DataCollection {
  queryParams?: CollectBehavior;
 
  /**
- * Controls generative AI input/output recording.
+ * Allow collection of GraphQL operation data when using the SDK's GraphQL integrations
+ *
+ * These options do not add GraphQL instrumentation on their own. The corresponding integration must still be enabled
+ * for any data to be captured.
+ *
+ * - `document`: attach the GraphQL document (query/mutation source text).
+ * - `variables`: attach the variables passed to GraphQL operations.
+ * @default { document: true, variables: true }
+ */
+ graphQL?: {
+ document?: boolean;
+ variables?: boolean;
+ };
+
+ /**
+ * Allow generative AI input/output recording when using the SDK's AI integrations.
+ *
+ * These options do not add AI instrumentation on their own. The corresponding integration must still be enabled for
+ * any data to be captured. Integration-level options, when set, take precedence over these
+ * values.
  * @default { inputs: true, outputs: true }
  */
  genAI?: {
@@ -77,5 +96,6 @@ export interface DataCollection {
  */
 export type ResolvedDataCollection = Required<DataCollection> & {
  httpHeaders: Required<NonNullable<DataCollection['httpHeaders']>>;
+ graphQL: Required<NonNullable<DataCollection['graphQL']>>;
  genAI: Required<NonNullable<DataCollection['genAI']>>;
 };

packages/core/src/utils/data-collection/defaultPiiToCollectionOptions.ts

@@ -16,6 +16,7 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7
@@ -26,6 +27,9 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: { deny: PII_HEADER_SNIPPETS }, response: { deny: PII_HEADER_SNIPPETS } },
  httpBodies: [],
  queryParams: { deny: PII_HEADER_SNIPPETS },
+ // The GraphQL document has literal values redacted at collection time, so it was historically
+ // always attached regardless of `sendDefaultPii`; keep it on to preserve that behavior.
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7

packages/core/src/utils/data-collection/resolveDataCollectionOptions.ts

@@ -7,6 +7,7 @@ const DEFAULTS: ResolvedDataCollection = {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -43,6 +44,10 @@ export function resolveDataCollectionOptions(options: {
  },
  httpBodies: dc.httpBodies ?? base.httpBodies,
  queryParams: dc.queryParams ?? base.queryParams,
+ graphQL: {
+ document: dc.graphQL?.document ?? base.graphQL.document,
+ variables: dc.graphQL?.variables ?? base.graphQL.variables,
+ },
  genAI: {
  inputs: dc.genAI?.inputs ?? base.genAI.inputs,
  outputs: dc.genAI?.outputs ?? base.genAI.outputs,

packages/core/test/lib/integrations/mcp-server/testUtils.ts

@@ -17,6 +17,7 @@ export function createMockClient(userInfo = true, genAI?: { inputs: boolean; out
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: genAIOptions,
  stackFrameVariables: true,
  frameContextLines: 5,

packages/core/test/lib/utils/data-collection/defaultPiiToCollectionOptions.test.ts

@@ -9,6 +9,7 @@ describe('defaultPiiToCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -25,6 +26,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -41,6 +43,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -57,6 +60,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,

packages/core/test/lib/utils/data-collection/resolveDataCollectionOptions.test.ts

@@ -8,6 +8,7 @@ describe('resolveDataCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -21,6 +22,8 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ // GraphQL documents are redacted at collection time, so they stay on to preserve legacy behavior.
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(7);
  });
@@ -45,6 +48,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.httpBodies).toEqual(['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse']);
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  });
 
@@ -54,6 +58,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  });
  });
 
@@ -87,6 +92,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.cookies).toBe(true);
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(5);
@@ -114,6 +120,17 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.genAI.outputs).toBe(true);
  });
 
+ it('merges nested graphQL partially', () => {
+ const result = resolveDataCollectionOptions({
+ dataCollection: {
+ graphQL: { document: false },
+ },
+ });
+
+ expect(result.graphQL.document).toBe(false);
+ expect(result.graphQL.variables).toBe(true);
+ });
+
  it('supports allow/deny list for cookies', () => {
  const result = resolveDataCollectionOptions({
  dataCollection: {
@@ -139,14 +156,17 @@ describe('resolveDataCollectionOptions', () => {
  it('always returns all fields', () => {
  const result = resolveDataCollectionOptions({});
 
- expect(Object.keys(result)).toHaveLength(8);
+ expect(Object.keys(result)).toHaveLength(9);
  expect(result).toHaveProperty('userInfo');
  expect(result).toHaveProperty('cookies');
  expect(result).toHaveProperty('httpHeaders');
  expect(result).toHaveProperty('httpHeaders.request');
  expect(result).toHaveProperty('httpHeaders.response');
  expect(result).toHaveProperty('httpBodies');
  expect(result).toHaveProperty('queryParams');
+ expect(result).toHaveProperty('graphQL');
+ expect(result).toHaveProperty('graphQL.document');
+ expect(result).toHaveProperty('graphQL.variables');
  expect(result).toHaveProperty('genAI');
  expect(result).toHaveProperty('genAI.inputs');
  expect(result).toHaveProperty('genAI.outputs');

packages/core/test/lib/utils/request.test.ts

@@ -874,6 +874,7 @@ describe('request utils', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/node/src/integrations/tracing/graphql/vendored/utils.ts

@@ -23,7 +23,7 @@ import type {
  Token,
 } from './graphql-types';
 import type { Span, SpanAttributes } from '@sentry/core';
-import { isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
+import { getClient, isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
 import { AllowedOperationTypes, SpanNames, TokenKind } from './enum';
 import { AttributeNames } from './enums/AttributeNames';
 import { OTEL_GRAPHQL_DATA_SYMBOL, OTEL_PATCHED_SYMBOL } from './symbols';
@@ -38,8 +38,10 @@ export const isPromise = (value: any): value is Promise<unknown> => {
 };
 
 export function addSpanSource(span: Span, loc?: Location, start?: number, end?: number): void {
- const source = getSourceFromLocation(loc, start, end);
- span.setAttribute(AttributeNames.SOURCE, source);
+ if (getClient()?.getDataCollectionOptions().graphQL.document === true) {
+ const source = getSourceFromLocation(loc, start, end);
+ span.setAttribute(AttributeNames.SOURCE, source);
+ }
 }
 
 function createFieldIfNotExists(

packages/node/test/integrations/tracing/graphql/addSpanSource.test.ts

@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import * as core from '@sentry/core';
+import { addSpanSource } from '../../../../src/integrations/tracing/graphql/vendored/utils';
+import type { Location, Token } from '@sentry/server-utils/orchestrion';
+
+vi.spyOn(core, 'getClient');
+
+function mockClient(graphQLDocument: boolean): void {
+ vi.mocked(core.getClient).mockReturnValue({
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
+ } as any);
+}
+
+function makeLocation(): Location {
+ const token: Token = {
+ kind: 'Name',
+ start: 0,
+ end: 5,
+ line: 1,
+ column: 1,
+ value: 'hello',
+ prev: null,
+ next: null,
+ };
+ return { start: 0, end: 5, startToken: token };
+}
+
+describe('addSpanSource dataCollection gate', () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ });
+
+ it('sets graphql.source attribute when graphQL.document is true', () => {
+ mockClient(true);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).toHaveBeenCalledWith('graphql.source', expect.any(String));
+ });
+
+ it('does not set attribute when graphQL.document is false', () => {
+ mockClient(false);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+
+ it('does not set attribute when getClient() is undefined', () => {
+ vi.mocked(core.getClient).mockReturnValue(undefined);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+});

packages/nuxt/test/runtime/hooks/wrapMiddlewareHandler.test.ts

@@ -47,6 +47,7 @@ describe('wrapMiddlewareHandlerWithSentry', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/remix/test/server/errors.test.ts

@@ -17,6 +17,7 @@ function createMockClient(httpBodies: string[] = []): Client {
  httpHeaders: { request: true, response: true },
  httpBodies,
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/astro/test/server/middleware.test.ts

@@ -64,6 +64,7 @@ describe('sentryMiddleware', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/browser/src/integrations/graphqlClient.ts

@@ -11,6 +11,7 @@ import {
 } from '@sentry/core/browser';
 import type { FetchHint, XhrHint } from '@sentry/browser-utils';
 import { getBodyString, getFetchRequestArgBody, SENTRY_XHR_DATA_KEY } from '@sentry/browser-utils';
+import { GRAPHQL_DOCUMENT } from '@sentry/conventions/attributes';
 
 interface GraphQLClientOptions {
  endpoints: Array<string | RegExp>;
@@ -88,9 +89,9 @@ function _updateSpanWithGraphQLData(client: Client, options: GraphQLClientOption
  const operationInfo = _getGraphQLOperation(graphqlBody);
  span.updateName(`${httpMethod} ${httpUrl} (${operationInfo})`);
 
- // Handle standard requests - always capture the query document
- if (isStandardRequest(graphqlBody)) {
- span.setAttribute('graphql.document', graphqlBody.query);
+ // Handle standard requests - capture the query document when enabled via dataCollection (default true)
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ span.setAttribute(GRAPHQL_DOCUMENT, graphqlBody.query);
  }
 
  // Handle persisted operations - capture hash for debugging
@@ -126,8 +127,8 @@ function _updateBreadcrumbWithGraphQLData(client: Client, options: GraphQLClient
 
  data['graphql.operation'] = operationInfo;
 
- if (isStandardRequest(graphqlBody)) {
- data['graphql.document'] = graphqlBody.query;
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ data[GRAPHQL_DOCUMENT] = graphqlBody.query;
  }
 
  if (isPersistedRequest(graphqlBody)) {

packages/browser/test/integrations/graphqlClient.test.ts

@@ -313,14 +313,18 @@ describe('GraphqlClient', () => {
  });
 
  describe('beforeOutgoingRequestSpan handler', () => {
- function setupHandler(endpoints: Array<string | RegExp>): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
+ function setupHandler(
+ endpoints: Array<string | RegExp>,
+ graphQLDocument = true,
+ ): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
  let capturedListener: ((span: SentrySpan, hint: FetchHint | XhrHint) => void) | undefined;
  const mockClient = {
  on: (eventName: string, cb: (span: SentrySpan, hint: FetchHint | XhrHint) => void) => {
  if (eventName === 'beforeOutgoingRequestSpan') {
  capturedListener = cb;
  }
  },
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
  } as unknown as Client;
 
  const integration = graphqlClientIntegration({ endpoints });
@@ -420,5 +424,25 @@ describe('GraphqlClient', () => {
  expect(json.description).toBe('custom span');
  expect(json.data['graphql.document']).toBeUndefined();
  });
+
+ test('omits graphql.document when dataCollection.graphQL.document is false', () => {
+ const handler = setupHandler([/\/graphql$/], false);
+ const span = new SentrySpan({
+ name: 'POST http://localhost:4000/graphql',
+ op: 'http.client',
+ attributes: {
+ 'http.method': 'POST',
+ 'http.url': 'http://localhost:4000/graphql',
+ url: 'http://localhost:4000/graphql',
+ },
+ });
+
+ handler(span, makeFetchHint('http://localhost:4000/graphql', requestBody));
+
+ const json = spanToJSON(span);
+ // The span is still renamed with the operation, but the document is not attached.
+ expect(json.description).toBe('POST http://localhost:4000/graphql (query GetHello)');
+ expect(json.data['graphql.document']).toBeUndefined();
+ });
  });
 });

packages/core/src/types/datacollection.ts

@@ -51,7 +51,26 @@ export interface DataCollection {
  queryParams?: CollectBehavior;
 
  /**
- * Controls generative AI input/output recording.
+ * Allow collection of GraphQL operation data when using the SDK's GraphQL integrations
+ *
+ * These options do not add GraphQL instrumentation on their own. The corresponding integration must still be enabled
+ * for any data to be captured.
+ *
+ * - `document`: attach the GraphQL document (query/mutation source text).
+ * - `variables`: attach the variables passed to GraphQL operations.
+ * @default { document: true, variables: true }
+ */
+ graphQL?: {
+ document?: boolean;
+ variables?: boolean;
+ };
+
+ /**
+ * Allow generative AI input/output recording when using the SDK's AI integrations.
+ *
+ * These options do not add AI instrumentation on their own. The corresponding integration must still be enabled for
+ * any data to be captured. Integration-level options, when set, take precedence over these
+ * values.
  * @default { inputs: true, outputs: true }
  */
  genAI?: {
@@ -77,5 +96,6 @@ export interface DataCollection {
  */
 export type ResolvedDataCollection = Required<DataCollection> & {
  httpHeaders: Required<NonNullable<DataCollection['httpHeaders']>>;
+ graphQL: Required<NonNullable<DataCollection['graphQL']>>;
  genAI: Required<NonNullable<DataCollection['genAI']>>;
 };

packages/core/src/utils/data-collection/defaultPiiToCollectionOptions.ts

@@ -16,6 +16,7 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7
@@ -26,6 +27,9 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: { deny: PII_HEADER_SNIPPETS }, response: { deny: PII_HEADER_SNIPPETS } },
  httpBodies: [],
  queryParams: { deny: PII_HEADER_SNIPPETS },
+ // The GraphQL document has literal values redacted at collection time, so it was historically
+ // always attached regardless of `sendDefaultPii`; keep it on to preserve that behavior.
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7

packages/core/src/utils/data-collection/resolveDataCollectionOptions.ts

@@ -7,6 +7,7 @@ const DEFAULTS: ResolvedDataCollection = {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -43,6 +44,10 @@ export function resolveDataCollectionOptions(options: {
  },
  httpBodies: dc.httpBodies ?? base.httpBodies,
  queryParams: dc.queryParams ?? base.queryParams,
+ graphQL: {
+ document: dc.graphQL?.document ?? base.graphQL.document,
+ variables: dc.graphQL?.variables ?? base.graphQL.variables,
+ },
  genAI: {
  inputs: dc.genAI?.inputs ?? base.genAI.inputs,
  outputs: dc.genAI?.outputs ?? base.genAI.outputs,

packages/core/test/lib/integrations/mcp-server/testUtils.ts

@@ -17,6 +17,7 @@ export function createMockClient(userInfo = true, genAI?: { inputs: boolean; out
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: genAIOptions,
  stackFrameVariables: true,
  frameContextLines: 5,

packages/core/test/lib/utils/data-collection/defaultPiiToCollectionOptions.test.ts

@@ -9,6 +9,7 @@ describe('defaultPiiToCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -25,6 +26,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -41,6 +43,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -57,6 +60,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,

packages/core/test/lib/utils/data-collection/resolveDataCollectionOptions.test.ts

@@ -8,6 +8,7 @@ describe('resolveDataCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -21,6 +22,8 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ // GraphQL documents are redacted at collection time, so they stay on to preserve legacy behavior.
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(7);
  });
@@ -45,6 +48,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.httpBodies).toEqual(['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse']);
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  });
 
@@ -54,6 +58,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  });
  });
 
@@ -87,6 +92,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.cookies).toBe(true);
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(5);
@@ -114,6 +120,17 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.genAI.outputs).toBe(true);
  });
 
+ it('merges nested graphQL partially', () => {
+ const result = resolveDataCollectionOptions({
+ dataCollection: {
+ graphQL: { document: false },
+ },
+ });
+
+ expect(result.graphQL.document).toBe(false);
+ expect(result.graphQL.variables).toBe(true);
+ });
+
  it('supports allow/deny list for cookies', () => {
  const result = resolveDataCollectionOptions({
  dataCollection: {
@@ -139,14 +156,17 @@ describe('resolveDataCollectionOptions', () => {
  it('always returns all fields', () => {
  const result = resolveDataCollectionOptions({});
 
- expect(Object.keys(result)).toHaveLength(8);
+ expect(Object.keys(result)).toHaveLength(9);
  expect(result).toHaveProperty('userInfo');
  expect(result).toHaveProperty('cookies');
  expect(result).toHaveProperty('httpHeaders');
  expect(result).toHaveProperty('httpHeaders.request');
  expect(result).toHaveProperty('httpHeaders.response');
  expect(result).toHaveProperty('httpBodies');
  expect(result).toHaveProperty('queryParams');
+ expect(result).toHaveProperty('graphQL');
+ expect(result).toHaveProperty('graphQL.document');
+ expect(result).toHaveProperty('graphQL.variables');
  expect(result).toHaveProperty('genAI');
  expect(result).toHaveProperty('genAI.inputs');
  expect(result).toHaveProperty('genAI.outputs');

packages/core/test/lib/utils/request.test.ts

@@ -874,6 +874,7 @@ describe('request utils', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/node/src/integrations/tracing/graphql/vendored/utils.ts

@@ -23,7 +23,7 @@ import type {
  Token,
 } from './graphql-types';
 import type { Span, SpanAttributes } from '@sentry/core';
-import { isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
+import { getClient, isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
 import { AllowedOperationTypes, SpanNames, TokenKind } from './enum';
 import { AttributeNames } from './enums/AttributeNames';
 import { OTEL_GRAPHQL_DATA_SYMBOL, OTEL_PATCHED_SYMBOL } from './symbols';
@@ -38,8 +38,10 @@ export const isPromise = (value: any): value is Promise<unknown> => {
 };
 
 export function addSpanSource(span: Span, loc?: Location, start?: number, end?: number): void {
- const source = getSourceFromLocation(loc, start, end);
- span.setAttribute(AttributeNames.SOURCE, source);
+ if (getClient()?.getDataCollectionOptions().graphQL.document === true) {
+ const source = getSourceFromLocation(loc, start, end);
+ span.setAttribute(AttributeNames.SOURCE, source);
+ }
 }
 
 function createFieldIfNotExists(

packages/node/test/integrations/tracing/graphql/addSpanSource.test.ts

@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import * as core from '@sentry/core';
+import { addSpanSource } from '../../../../src/integrations/tracing/graphql/vendored/utils';
+import type { Location, Token } from '@sentry/server-utils/orchestrion';
+
+vi.spyOn(core, 'getClient');
+
+function mockClient(graphQLDocument: boolean): void {
+ vi.mocked(core.getClient).mockReturnValue({
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
+ } as any);
+}
+
+function makeLocation(): Location {
+ const token: Token = {
+ kind: 'Name',
+ start: 0,
+ end: 5,
+ line: 1,
+ column: 1,
+ value: 'hello',
+ prev: null,
+ next: null,
+ };
+ return { start: 0, end: 5, startToken: token };
+}
+
+describe('addSpanSource dataCollection gate', () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ });
+
+ it('sets graphql.source attribute when graphQL.document is true', () => {
+ mockClient(true);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).toHaveBeenCalledWith('graphql.source', expect.any(String));
+ });
+
+ it('does not set attribute when graphQL.document is false', () => {
+ mockClient(false);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+
+ it('does not set attribute when getClient() is undefined', () => {
+ vi.mocked(core.getClient).mockReturnValue(undefined);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+});

packages/nuxt/test/runtime/hooks/wrapMiddlewareHandler.test.ts

@@ -47,6 +47,7 @@ describe('wrapMiddlewareHandlerWithSentry', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/remix/test/server/errors.test.ts

@@ -17,6 +17,7 @@ function createMockClient(httpBodies: string[] = []): Client {
  httpHeaders: { request: true, response: true },
  httpBodies,
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/astro/test/server/middleware.test.ts

@@ -64,6 +64,7 @@ describe('sentryMiddleware', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/browser/src/integrations/graphqlClient.ts

@@ -11,6 +11,7 @@ import {
 } from '@sentry/core/browser';
 import type { FetchHint, XhrHint } from '@sentry/browser-utils';
 import { getBodyString, getFetchRequestArgBody, SENTRY_XHR_DATA_KEY } from '@sentry/browser-utils';
+import { GRAPHQL_DOCUMENT } from '@sentry/conventions/attributes';
 
 interface GraphQLClientOptions {
  endpoints: Array<string | RegExp>;
@@ -88,9 +89,9 @@ function _updateSpanWithGraphQLData(client: Client, options: GraphQLClientOption
  const operationInfo = _getGraphQLOperation(graphqlBody);
  span.updateName(`${httpMethod} ${httpUrl} (${operationInfo})`);
 
- // Handle standard requests - always capture the query document
- if (isStandardRequest(graphqlBody)) {
- span.setAttribute('graphql.document', graphqlBody.query);
+ // Handle standard requests - capture the query document when enabled via dataCollection (default true)
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ span.setAttribute(GRAPHQL_DOCUMENT, graphqlBody.query);
  }
 
  // Handle persisted operations - capture hash for debugging
@@ -126,8 +127,8 @@ function _updateBreadcrumbWithGraphQLData(client: Client, options: GraphQLClient
 
  data['graphql.operation'] = operationInfo;
 
- if (isStandardRequest(graphqlBody)) {
- data['graphql.document'] = graphqlBody.query;
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ data[GRAPHQL_DOCUMENT] = graphqlBody.query;
  }
 
  if (isPersistedRequest(graphqlBody)) {

packages/browser/test/integrations/graphqlClient.test.ts

@@ -313,14 +313,18 @@ describe('GraphqlClient', () => {
  });
 
  describe('beforeOutgoingRequestSpan handler', () => {
- function setupHandler(endpoints: Array<string | RegExp>): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
+ function setupHandler(
+ endpoints: Array<string | RegExp>,
+ graphQLDocument = true,
+ ): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
  let capturedListener: ((span: SentrySpan, hint: FetchHint | XhrHint) => void) | undefined;
  const mockClient = {
  on: (eventName: string, cb: (span: SentrySpan, hint: FetchHint | XhrHint) => void) => {
  if (eventName === 'beforeOutgoingRequestSpan') {
  capturedListener = cb;
  }
  },
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
  } as unknown as Client;
 
  const integration = graphqlClientIntegration({ endpoints });
@@ -420,5 +424,25 @@ describe('GraphqlClient', () => {
  expect(json.description).toBe('custom span');
  expect(json.data['graphql.document']).toBeUndefined();
  });
+
+ test('omits graphql.document when dataCollection.graphQL.document is false', () => {
+ const handler = setupHandler([/\/graphql$/], false);
+ const span = new SentrySpan({
+ name: 'POST http://localhost:4000/graphql',
+ op: 'http.client',
+ attributes: {
+ 'http.method': 'POST',
+ 'http.url': 'http://localhost:4000/graphql',
+ url: 'http://localhost:4000/graphql',
+ },
+ });
+
+ handler(span, makeFetchHint('http://localhost:4000/graphql', requestBody));
+
+ const json = spanToJSON(span);
+ // The span is still renamed with the operation, but the document is not attached.
+ expect(json.description).toBe('POST http://localhost:4000/graphql (query GetHello)');
+ expect(json.data['graphql.document']).toBeUndefined();
+ });
  });
 });

packages/core/src/types/datacollection.ts

@@ -51,7 +51,26 @@ export interface DataCollection {
  queryParams?: CollectBehavior;
 
  /**
- * Controls generative AI input/output recording.
+ * Allow collection of GraphQL operation data when using the SDK's GraphQL integrations
+ *
+ * These options do not add GraphQL instrumentation on their own. The corresponding integration must still be enabled
+ * for any data to be captured.
+ *
+ * - `document`: attach the GraphQL document (query/mutation source text).
+ * - `variables`: attach the variables passed to GraphQL operations.
+ * @default { document: true, variables: true }
+ */
+ graphQL?: {
+ document?: boolean;
+ variables?: boolean;
+ };
+
+ /**
+ * Allow generative AI input/output recording when using the SDK's AI integrations.
+ *
+ * These options do not add AI instrumentation on their own. The corresponding integration must still be enabled for
+ * any data to be captured. Integration-level options, when set, take precedence over these
+ * values.
  * @default { inputs: true, outputs: true }
  */
  genAI?: {
@@ -77,5 +96,6 @@ export interface DataCollection {
  */
 export type ResolvedDataCollection = Required<DataCollection> & {
  httpHeaders: Required<NonNullable<DataCollection['httpHeaders']>>;
+ graphQL: Required<NonNullable<DataCollection['graphQL']>>;
  genAI: Required<NonNullable<DataCollection['genAI']>>;
 };

packages/core/src/utils/data-collection/defaultPiiToCollectionOptions.ts

@@ -16,6 +16,7 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7
@@ -26,6 +27,9 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: { deny: PII_HEADER_SNIPPETS }, response: { deny: PII_HEADER_SNIPPETS } },
  httpBodies: [],
  queryParams: { deny: PII_HEADER_SNIPPETS },
+ // The GraphQL document has literal values redacted at collection time, so it was historically
+ // always attached regardless of `sendDefaultPii`; keep it on to preserve that behavior.
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7

packages/core/src/utils/data-collection/resolveDataCollectionOptions.ts

@@ -7,6 +7,7 @@ const DEFAULTS: ResolvedDataCollection = {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -43,6 +44,10 @@ export function resolveDataCollectionOptions(options: {
  },
  httpBodies: dc.httpBodies ?? base.httpBodies,
  queryParams: dc.queryParams ?? base.queryParams,
+ graphQL: {
+ document: dc.graphQL?.document ?? base.graphQL.document,
+ variables: dc.graphQL?.variables ?? base.graphQL.variables,
+ },
  genAI: {
  inputs: dc.genAI?.inputs ?? base.genAI.inputs,
  outputs: dc.genAI?.outputs ?? base.genAI.outputs,

packages/core/test/lib/integrations/mcp-server/testUtils.ts

@@ -17,6 +17,7 @@ export function createMockClient(userInfo = true, genAI?: { inputs: boolean; out
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: genAIOptions,
  stackFrameVariables: true,
  frameContextLines: 5,

packages/core/test/lib/utils/data-collection/defaultPiiToCollectionOptions.test.ts

@@ -9,6 +9,7 @@ describe('defaultPiiToCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -25,6 +26,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -41,6 +43,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -57,6 +60,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,

packages/core/test/lib/utils/data-collection/resolveDataCollectionOptions.test.ts

@@ -8,6 +8,7 @@ describe('resolveDataCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -21,6 +22,8 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ // GraphQL documents are redacted at collection time, so they stay on to preserve legacy behavior.
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(7);
  });
@@ -45,6 +48,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.httpBodies).toEqual(['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse']);
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  });
 
@@ -54,6 +58,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  });
  });
 
@@ -87,6 +92,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.cookies).toBe(true);
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(5);
@@ -114,6 +120,17 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.genAI.outputs).toBe(true);
  });
 
+ it('merges nested graphQL partially', () => {
+ const result = resolveDataCollectionOptions({
+ dataCollection: {
+ graphQL: { document: false },
+ },
+ });
+
+ expect(result.graphQL.document).toBe(false);
+ expect(result.graphQL.variables).toBe(true);
+ });
+
  it('supports allow/deny list for cookies', () => {
  const result = resolveDataCollectionOptions({
  dataCollection: {
@@ -139,14 +156,17 @@ describe('resolveDataCollectionOptions', () => {
  it('always returns all fields', () => {
  const result = resolveDataCollectionOptions({});
 
- expect(Object.keys(result)).toHaveLength(8);
+ expect(Object.keys(result)).toHaveLength(9);
  expect(result).toHaveProperty('userInfo');
  expect(result).toHaveProperty('cookies');
  expect(result).toHaveProperty('httpHeaders');
  expect(result).toHaveProperty('httpHeaders.request');
  expect(result).toHaveProperty('httpHeaders.response');
  expect(result).toHaveProperty('httpBodies');
  expect(result).toHaveProperty('queryParams');
+ expect(result).toHaveProperty('graphQL');
+ expect(result).toHaveProperty('graphQL.document');
+ expect(result).toHaveProperty('graphQL.variables');
  expect(result).toHaveProperty('genAI');
  expect(result).toHaveProperty('genAI.inputs');
  expect(result).toHaveProperty('genAI.outputs');

packages/core/test/lib/utils/request.test.ts

@@ -874,6 +874,7 @@ describe('request utils', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/node/src/integrations/tracing/graphql/vendored/utils.ts

@@ -23,7 +23,7 @@ import type {
  Token,
 } from './graphql-types';
 import type { Span, SpanAttributes } from '@sentry/core';
-import { isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
+import { getClient, isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
 import { AllowedOperationTypes, SpanNames, TokenKind } from './enum';
 import { AttributeNames } from './enums/AttributeNames';
 import { OTEL_GRAPHQL_DATA_SYMBOL, OTEL_PATCHED_SYMBOL } from './symbols';
@@ -38,8 +38,10 @@ export const isPromise = (value: any): value is Promise<unknown> => {
 };
 
 export function addSpanSource(span: Span, loc?: Location, start?: number, end?: number): void {
- const source = getSourceFromLocation(loc, start, end);
- span.setAttribute(AttributeNames.SOURCE, source);
+ if (getClient()?.getDataCollectionOptions().graphQL.document === true) {
+ const source = getSourceFromLocation(loc, start, end);
+ span.setAttribute(AttributeNames.SOURCE, source);
+ }
 }
 
 function createFieldIfNotExists(

packages/node/test/integrations/tracing/graphql/addSpanSource.test.ts

@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import * as core from '@sentry/core';
+import { addSpanSource } from '../../../../src/integrations/tracing/graphql/vendored/utils';
+import type { Location, Token } from '@sentry/server-utils/orchestrion';
+
+vi.spyOn(core, 'getClient');
+
+function mockClient(graphQLDocument: boolean): void {
+ vi.mocked(core.getClient).mockReturnValue({
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
+ } as any);
+}
+
+function makeLocation(): Location {
+ const token: Token = {
+ kind: 'Name',
+ start: 0,
+ end: 5,
+ line: 1,
+ column: 1,
+ value: 'hello',
+ prev: null,
+ next: null,
+ };
+ return { start: 0, end: 5, startToken: token };
+}
+
+describe('addSpanSource dataCollection gate', () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ });
+
+ it('sets graphql.source attribute when graphQL.document is true', () => {
+ mockClient(true);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).toHaveBeenCalledWith('graphql.source', expect.any(String));
+ });
+
+ it('does not set attribute when graphQL.document is false', () => {
+ mockClient(false);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+
+ it('does not set attribute when getClient() is undefined', () => {
+ vi.mocked(core.getClient).mockReturnValue(undefined);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+});

packages/nuxt/test/runtime/hooks/wrapMiddlewareHandler.test.ts

@@ -47,6 +47,7 @@ describe('wrapMiddlewareHandlerWithSentry', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/remix/test/server/errors.test.ts

@@ -17,6 +17,7 @@ function createMockClient(httpBodies: string[] = []): Client {
  httpHeaders: { request: true, response: true },
  httpBodies,
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/astro/test/server/middleware.test.ts

@@ -64,6 +64,7 @@ describe('sentryMiddleware', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/browser/src/integrations/graphqlClient.ts

@@ -11,6 +11,7 @@ import {
 } from '@sentry/core/browser';
 import type { FetchHint, XhrHint } from '@sentry/browser-utils';
 import { getBodyString, getFetchRequestArgBody, SENTRY_XHR_DATA_KEY } from '@sentry/browser-utils';
+import { GRAPHQL_DOCUMENT } from '@sentry/conventions/attributes';
 
 interface GraphQLClientOptions {
  endpoints: Array<string | RegExp>;
@@ -88,9 +89,9 @@ function _updateSpanWithGraphQLData(client: Client, options: GraphQLClientOption
  const operationInfo = _getGraphQLOperation(graphqlBody);
  span.updateName(`${httpMethod} ${httpUrl} (${operationInfo})`);
 
- // Handle standard requests - always capture the query document
- if (isStandardRequest(graphqlBody)) {
- span.setAttribute('graphql.document', graphqlBody.query);
+ // Handle standard requests - capture the query document when enabled via dataCollection (default true)
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ span.setAttribute(GRAPHQL_DOCUMENT, graphqlBody.query);
  }
 
  // Handle persisted operations - capture hash for debugging
@@ -126,8 +127,8 @@ function _updateBreadcrumbWithGraphQLData(client: Client, options: GraphQLClient
 
  data['graphql.operation'] = operationInfo;
 
- if (isStandardRequest(graphqlBody)) {
- data['graphql.document'] = graphqlBody.query;
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ data[GRAPHQL_DOCUMENT] = graphqlBody.query;
  }
 
  if (isPersistedRequest(graphqlBody)) {

packages/browser/test/integrations/graphqlClient.test.ts

@@ -313,14 +313,18 @@ describe('GraphqlClient', () => {
  });
 
  describe('beforeOutgoingRequestSpan handler', () => {
- function setupHandler(endpoints: Array<string | RegExp>): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
+ function setupHandler(
+ endpoints: Array<string | RegExp>,
+ graphQLDocument = true,
+ ): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
  let capturedListener: ((span: SentrySpan, hint: FetchHint | XhrHint) => void) | undefined;
  const mockClient = {
  on: (eventName: string, cb: (span: SentrySpan, hint: FetchHint | XhrHint) => void) => {
  if (eventName === 'beforeOutgoingRequestSpan') {
  capturedListener = cb;
  }
  },
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
  } as unknown as Client;
 
  const integration = graphqlClientIntegration({ endpoints });
@@ -420,5 +424,25 @@ describe('GraphqlClient', () => {
  expect(json.description).toBe('custom span');
  expect(json.data['graphql.document']).toBeUndefined();
  });
+
+ test('omits graphql.document when dataCollection.graphQL.document is false', () => {
+ const handler = setupHandler([/\/graphql$/], false);
+ const span = new SentrySpan({
+ name: 'POST http://localhost:4000/graphql',
+ op: 'http.client',
+ attributes: {
+ 'http.method': 'POST',
+ 'http.url': 'http://localhost:4000/graphql',
+ url: 'http://localhost:4000/graphql',
+ },
+ });
+
+ handler(span, makeFetchHint('http://localhost:4000/graphql', requestBody));
+
+ const json = spanToJSON(span);
+ // The span is still renamed with the operation, but the document is not attached.
+ expect(json.description).toBe('POST http://localhost:4000/graphql (query GetHello)');
+ expect(json.data['graphql.document']).toBeUndefined();
+ });
  });
 });

packages/core/src/types/datacollection.ts

@@ -51,7 +51,26 @@ export interface DataCollection {
  queryParams?: CollectBehavior;
 
  /**
- * Controls generative AI input/output recording.
+ * Allow collection of GraphQL operation data when using the SDK's GraphQL integrations
+ *
+ * These options do not add GraphQL instrumentation on their own. The corresponding integration must still be enabled
+ * for any data to be captured.
+ *
+ * - `document`: attach the GraphQL document (query/mutation source text).
+ * - `variables`: attach the variables passed to GraphQL operations.
+ * @default { document: true, variables: true }
+ */
+ graphQL?: {
+ document?: boolean;
+ variables?: boolean;
+ };
+
+ /**
+ * Allow generative AI input/output recording when using the SDK's AI integrations.
+ *
+ * These options do not add AI instrumentation on their own. The corresponding integration must still be enabled for
+ * any data to be captured. Integration-level options, when set, take precedence over these
+ * values.
  * @default { inputs: true, outputs: true }
  */
  genAI?: {
@@ -77,5 +96,6 @@ export interface DataCollection {
  */
 export type ResolvedDataCollection = Required<DataCollection> & {
  httpHeaders: Required<NonNullable<DataCollection['httpHeaders']>>;
+ graphQL: Required<NonNullable<DataCollection['graphQL']>>;
  genAI: Required<NonNullable<DataCollection['genAI']>>;
 };

packages/core/src/utils/data-collection/defaultPiiToCollectionOptions.ts

@@ -16,6 +16,7 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7
@@ -26,6 +27,9 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: { deny: PII_HEADER_SNIPPETS }, response: { deny: PII_HEADER_SNIPPETS } },
  httpBodies: [],
  queryParams: { deny: PII_HEADER_SNIPPETS },
+ // The GraphQL document has literal values redacted at collection time, so it was historically
+ // always attached regardless of `sendDefaultPii`; keep it on to preserve that behavior.
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7

packages/core/src/utils/data-collection/resolveDataCollectionOptions.ts

@@ -7,6 +7,7 @@ const DEFAULTS: ResolvedDataCollection = {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -43,6 +44,10 @@ export function resolveDataCollectionOptions(options: {
  },
  httpBodies: dc.httpBodies ?? base.httpBodies,
  queryParams: dc.queryParams ?? base.queryParams,
+ graphQL: {
+ document: dc.graphQL?.document ?? base.graphQL.document,
+ variables: dc.graphQL?.variables ?? base.graphQL.variables,
+ },
  genAI: {
  inputs: dc.genAI?.inputs ?? base.genAI.inputs,
  outputs: dc.genAI?.outputs ?? base.genAI.outputs,

packages/core/test/lib/integrations/mcp-server/testUtils.ts

@@ -17,6 +17,7 @@ export function createMockClient(userInfo = true, genAI?: { inputs: boolean; out
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: genAIOptions,
  stackFrameVariables: true,
  frameContextLines: 5,

packages/core/test/lib/utils/data-collection/defaultPiiToCollectionOptions.test.ts

@@ -9,6 +9,7 @@ describe('defaultPiiToCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -25,6 +26,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -41,6 +43,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -57,6 +60,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,

packages/core/test/lib/utils/data-collection/resolveDataCollectionOptions.test.ts

@@ -8,6 +8,7 @@ describe('resolveDataCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -21,6 +22,8 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ // GraphQL documents are redacted at collection time, so they stay on to preserve legacy behavior.
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(7);
  });
@@ -45,6 +48,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.httpBodies).toEqual(['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse']);
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  });
 
@@ -54,6 +58,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  });
  });
 
@@ -87,6 +92,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.cookies).toBe(true);
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(5);
@@ -114,6 +120,17 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.genAI.outputs).toBe(true);
  });
 
+ it('merges nested graphQL partially', () => {
+ const result = resolveDataCollectionOptions({
+ dataCollection: {
+ graphQL: { document: false },
+ },
+ });
+
+ expect(result.graphQL.document).toBe(false);
+ expect(result.graphQL.variables).toBe(true);
+ });
+
  it('supports allow/deny list for cookies', () => {
  const result = resolveDataCollectionOptions({
  dataCollection: {
@@ -139,14 +156,17 @@ describe('resolveDataCollectionOptions', () => {
  it('always returns all fields', () => {
  const result = resolveDataCollectionOptions({});
 
- expect(Object.keys(result)).toHaveLength(8);
+ expect(Object.keys(result)).toHaveLength(9);
  expect(result).toHaveProperty('userInfo');
  expect(result).toHaveProperty('cookies');
  expect(result).toHaveProperty('httpHeaders');
  expect(result).toHaveProperty('httpHeaders.request');
  expect(result).toHaveProperty('httpHeaders.response');
  expect(result).toHaveProperty('httpBodies');
  expect(result).toHaveProperty('queryParams');
+ expect(result).toHaveProperty('graphQL');
+ expect(result).toHaveProperty('graphQL.document');
+ expect(result).toHaveProperty('graphQL.variables');
  expect(result).toHaveProperty('genAI');
  expect(result).toHaveProperty('genAI.inputs');
  expect(result).toHaveProperty('genAI.outputs');

packages/core/test/lib/utils/request.test.ts

@@ -874,6 +874,7 @@ describe('request utils', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/node/src/integrations/tracing/graphql/vendored/utils.ts

@@ -23,7 +23,7 @@ import type {
  Token,
 } from './graphql-types';
 import type { Span, SpanAttributes } from '@sentry/core';
-import { isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
+import { getClient, isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
 import { AllowedOperationTypes, SpanNames, TokenKind } from './enum';
 import { AttributeNames } from './enums/AttributeNames';
 import { OTEL_GRAPHQL_DATA_SYMBOL, OTEL_PATCHED_SYMBOL } from './symbols';
@@ -38,8 +38,10 @@ export const isPromise = (value: any): value is Promise<unknown> => {
 };
 
 export function addSpanSource(span: Span, loc?: Location, start?: number, end?: number): void {
- const source = getSourceFromLocation(loc, start, end);
- span.setAttribute(AttributeNames.SOURCE, source);
+ if (getClient()?.getDataCollectionOptions().graphQL.document === true) {
+ const source = getSourceFromLocation(loc, start, end);
+ span.setAttribute(AttributeNames.SOURCE, source);
+ }
 }
 
 function createFieldIfNotExists(

packages/node/test/integrations/tracing/graphql/addSpanSource.test.ts

@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import * as core from '@sentry/core';
+import { addSpanSource } from '../../../../src/integrations/tracing/graphql/vendored/utils';
+import type { Location, Token } from '@sentry/server-utils/orchestrion';
+
+vi.spyOn(core, 'getClient');
+
+function mockClient(graphQLDocument: boolean): void {
+ vi.mocked(core.getClient).mockReturnValue({
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
+ } as any);
+}
+
+function makeLocation(): Location {
+ const token: Token = {
+ kind: 'Name',
+ start: 0,
+ end: 5,
+ line: 1,
+ column: 1,
+ value: 'hello',
+ prev: null,
+ next: null,
+ };
+ return { start: 0, end: 5, startToken: token };
+}
+
+describe('addSpanSource dataCollection gate', () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ });
+
+ it('sets graphql.source attribute when graphQL.document is true', () => {
+ mockClient(true);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).toHaveBeenCalledWith('graphql.source', expect.any(String));
+ });
+
+ it('does not set attribute when graphQL.document is false', () => {
+ mockClient(false);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+
+ it('does not set attribute when getClient() is undefined', () => {
+ vi.mocked(core.getClient).mockReturnValue(undefined);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+});

packages/nuxt/test/runtime/hooks/wrapMiddlewareHandler.test.ts

@@ -47,6 +47,7 @@ describe('wrapMiddlewareHandlerWithSentry', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/remix/test/server/errors.test.ts

@@ -17,6 +17,7 @@ function createMockClient(httpBodies: string[] = []): Client {
  httpHeaders: { request: true, response: true },
  httpBodies,
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/astro/test/server/middleware.test.ts

@@ -64,6 +64,7 @@ describe('sentryMiddleware', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/browser/src/integrations/graphqlClient.ts

@@ -11,6 +11,7 @@ import {
 } from '@sentry/core/browser';
 import type { FetchHint, XhrHint } from '@sentry/browser-utils';
 import { getBodyString, getFetchRequestArgBody, SENTRY_XHR_DATA_KEY } from '@sentry/browser-utils';
+import { GRAPHQL_DOCUMENT } from '@sentry/conventions/attributes';
 
 interface GraphQLClientOptions {
  endpoints: Array<string | RegExp>;
@@ -88,9 +89,9 @@ function _updateSpanWithGraphQLData(client: Client, options: GraphQLClientOption
  const operationInfo = _getGraphQLOperation(graphqlBody);
  span.updateName(`${httpMethod} ${httpUrl} (${operationInfo})`);
 
- // Handle standard requests - always capture the query document
- if (isStandardRequest(graphqlBody)) {
- span.setAttribute('graphql.document', graphqlBody.query);
+ // Handle standard requests - capture the query document when enabled via dataCollection (default true)
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ span.setAttribute(GRAPHQL_DOCUMENT, graphqlBody.query);
  }
 
  // Handle persisted operations - capture hash for debugging
@@ -126,8 +127,8 @@ function _updateBreadcrumbWithGraphQLData(client: Client, options: GraphQLClient
 
  data['graphql.operation'] = operationInfo;
 
- if (isStandardRequest(graphqlBody)) {
- data['graphql.document'] = graphqlBody.query;
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ data[GRAPHQL_DOCUMENT] = graphqlBody.query;
  }
 
  if (isPersistedRequest(graphqlBody)) {

packages/browser/test/integrations/graphqlClient.test.ts

@@ -313,14 +313,18 @@ describe('GraphqlClient', () => {
  });
 
  describe('beforeOutgoingRequestSpan handler', () => {
- function setupHandler(endpoints: Array<string | RegExp>): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
+ function setupHandler(
+ endpoints: Array<string | RegExp>,
+ graphQLDocument = true,
+ ): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
  let capturedListener: ((span: SentrySpan, hint: FetchHint | XhrHint) => void) | undefined;
  const mockClient = {
  on: (eventName: string, cb: (span: SentrySpan, hint: FetchHint | XhrHint) => void) => {
  if (eventName === 'beforeOutgoingRequestSpan') {
  capturedListener = cb;
  }
  },
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
  } as unknown as Client;
 
  const integration = graphqlClientIntegration({ endpoints });
@@ -420,5 +424,25 @@ describe('GraphqlClient', () => {
  expect(json.description).toBe('custom span');
  expect(json.data['graphql.document']).toBeUndefined();
  });
+
+ test('omits graphql.document when dataCollection.graphQL.document is false', () => {
+ const handler = setupHandler([/\/graphql$/], false);
+ const span = new SentrySpan({
+ name: 'POST http://localhost:4000/graphql',
+ op: 'http.client',
+ attributes: {
+ 'http.method': 'POST',
+ 'http.url': 'http://localhost:4000/graphql',
+ url: 'http://localhost:4000/graphql',
+ },
+ });
+
+ handler(span, makeFetchHint('http://localhost:4000/graphql', requestBody));
+
+ const json = spanToJSON(span);
+ // The span is still renamed with the operation, but the document is not attached.
+ expect(json.description).toBe('POST http://localhost:4000/graphql (query GetHello)');
+ expect(json.data['graphql.document']).toBeUndefined();
+ });
  });
 });

packages/core/src/types/datacollection.ts

@@ -51,7 +51,26 @@ export interface DataCollection {
  queryParams?: CollectBehavior;
 
  /**
- * Controls generative AI input/output recording.
+ * Allow collection of GraphQL operation data when using the SDK's GraphQL integrations
+ *
+ * These options do not add GraphQL instrumentation on their own. The corresponding integration must still be enabled
+ * for any data to be captured.
+ *
+ * - `document`: attach the GraphQL document (query/mutation source text).
+ * - `variables`: attach the variables passed to GraphQL operations.
+ * @default { document: true, variables: true }
+ */
+ graphQL?: {
+ document?: boolean;
+ variables?: boolean;
+ };
+
+ /**
+ * Allow generative AI input/output recording when using the SDK's AI integrations.
+ *
+ * These options do not add AI instrumentation on their own. The corresponding integration must still be enabled for
+ * any data to be captured. Integration-level options, when set, take precedence over these
+ * values.
  * @default { inputs: true, outputs: true }
  */
  genAI?: {
@@ -77,5 +96,6 @@ export interface DataCollection {
  */
 export type ResolvedDataCollection = Required<DataCollection> & {
  httpHeaders: Required<NonNullable<DataCollection['httpHeaders']>>;
+ graphQL: Required<NonNullable<DataCollection['graphQL']>>;
  genAI: Required<NonNullable<DataCollection['genAI']>>;
 };

packages/core/src/utils/data-collection/defaultPiiToCollectionOptions.ts

@@ -16,6 +16,7 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7
@@ -26,6 +27,9 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: { deny: PII_HEADER_SNIPPETS }, response: { deny: PII_HEADER_SNIPPETS } },
  httpBodies: [],
  queryParams: { deny: PII_HEADER_SNIPPETS },
+ // The GraphQL document has literal values redacted at collection time, so it was historically
+ // always attached regardless of `sendDefaultPii`; keep it on to preserve that behavior.
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7

packages/core/src/utils/data-collection/resolveDataCollectionOptions.ts

@@ -7,6 +7,7 @@ const DEFAULTS: ResolvedDataCollection = {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -43,6 +44,10 @@ export function resolveDataCollectionOptions(options: {
  },
  httpBodies: dc.httpBodies ?? base.httpBodies,
  queryParams: dc.queryParams ?? base.queryParams,
+ graphQL: {
+ document: dc.graphQL?.document ?? base.graphQL.document,
+ variables: dc.graphQL?.variables ?? base.graphQL.variables,
+ },
  genAI: {
  inputs: dc.genAI?.inputs ?? base.genAI.inputs,
  outputs: dc.genAI?.outputs ?? base.genAI.outputs,

packages/core/test/lib/integrations/mcp-server/testUtils.ts

@@ -17,6 +17,7 @@ export function createMockClient(userInfo = true, genAI?: { inputs: boolean; out
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: genAIOptions,
  stackFrameVariables: true,
  frameContextLines: 5,

packages/core/test/lib/utils/data-collection/defaultPiiToCollectionOptions.test.ts

@@ -9,6 +9,7 @@ describe('defaultPiiToCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -25,6 +26,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -41,6 +43,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -57,6 +60,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,

packages/core/test/lib/utils/data-collection/resolveDataCollectionOptions.test.ts

@@ -8,6 +8,7 @@ describe('resolveDataCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -21,6 +22,8 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ // GraphQL documents are redacted at collection time, so they stay on to preserve legacy behavior.
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(7);
  });
@@ -45,6 +48,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.httpBodies).toEqual(['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse']);
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  });
 
@@ -54,6 +58,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  });
  });
 
@@ -87,6 +92,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.cookies).toBe(true);
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(5);
@@ -114,6 +120,17 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.genAI.outputs).toBe(true);
  });
 
+ it('merges nested graphQL partially', () => {
+ const result = resolveDataCollectionOptions({
+ dataCollection: {
+ graphQL: { document: false },
+ },
+ });
+
+ expect(result.graphQL.document).toBe(false);
+ expect(result.graphQL.variables).toBe(true);
+ });
+
  it('supports allow/deny list for cookies', () => {
  const result = resolveDataCollectionOptions({
  dataCollection: {
@@ -139,14 +156,17 @@ describe('resolveDataCollectionOptions', () => {
  it('always returns all fields', () => {
  const result = resolveDataCollectionOptions({});
 
- expect(Object.keys(result)).toHaveLength(8);
+ expect(Object.keys(result)).toHaveLength(9);
  expect(result).toHaveProperty('userInfo');
  expect(result).toHaveProperty('cookies');
  expect(result).toHaveProperty('httpHeaders');
  expect(result).toHaveProperty('httpHeaders.request');
  expect(result).toHaveProperty('httpHeaders.response');
  expect(result).toHaveProperty('httpBodies');
  expect(result).toHaveProperty('queryParams');
+ expect(result).toHaveProperty('graphQL');
+ expect(result).toHaveProperty('graphQL.document');
+ expect(result).toHaveProperty('graphQL.variables');
  expect(result).toHaveProperty('genAI');
  expect(result).toHaveProperty('genAI.inputs');
  expect(result).toHaveProperty('genAI.outputs');

packages/core/test/lib/utils/request.test.ts

@@ -874,6 +874,7 @@ describe('request utils', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/node/src/integrations/tracing/graphql/vendored/utils.ts

@@ -23,7 +23,7 @@ import type {
  Token,
 } from './graphql-types';
 import type { Span, SpanAttributes } from '@sentry/core';
-import { isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
+import { getClient, isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
 import { AllowedOperationTypes, SpanNames, TokenKind } from './enum';
 import { AttributeNames } from './enums/AttributeNames';
 import { OTEL_GRAPHQL_DATA_SYMBOL, OTEL_PATCHED_SYMBOL } from './symbols';
@@ -38,8 +38,10 @@ export const isPromise = (value: any): value is Promise<unknown> => {
 };
 
 export function addSpanSource(span: Span, loc?: Location, start?: number, end?: number): void {
- const source = getSourceFromLocation(loc, start, end);
- span.setAttribute(AttributeNames.SOURCE, source);
+ if (getClient()?.getDataCollectionOptions().graphQL.document === true) {
+ const source = getSourceFromLocation(loc, start, end);
+ span.setAttribute(AttributeNames.SOURCE, source);
+ }
 }
 
 function createFieldIfNotExists(

packages/node/test/integrations/tracing/graphql/addSpanSource.test.ts

@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import * as core from '@sentry/core';
+import { addSpanSource } from '../../../../src/integrations/tracing/graphql/vendored/utils';
+import type { Location, Token } from '@sentry/server-utils/orchestrion';
+
+vi.spyOn(core, 'getClient');
+
+function mockClient(graphQLDocument: boolean): void {
+ vi.mocked(core.getClient).mockReturnValue({
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
+ } as any);
+}
+
+function makeLocation(): Location {
+ const token: Token = {
+ kind: 'Name',
+ start: 0,
+ end: 5,
+ line: 1,
+ column: 1,
+ value: 'hello',
+ prev: null,
+ next: null,
+ };
+ return { start: 0, end: 5, startToken: token };
+}
+
+describe('addSpanSource dataCollection gate', () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ });
+
+ it('sets graphql.source attribute when graphQL.document is true', () => {
+ mockClient(true);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).toHaveBeenCalledWith('graphql.source', expect.any(String));
+ });
+
+ it('does not set attribute when graphQL.document is false', () => {
+ mockClient(false);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+
+ it('does not set attribute when getClient() is undefined', () => {
+ vi.mocked(core.getClient).mockReturnValue(undefined);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+});

packages/nuxt/test/runtime/hooks/wrapMiddlewareHandler.test.ts

@@ -47,6 +47,7 @@ describe('wrapMiddlewareHandlerWithSentry', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/remix/test/server/errors.test.ts

@@ -17,6 +17,7 @@ function createMockClient(httpBodies: string[] = []): Client {
  httpHeaders: { request: true, response: true },
  httpBodies,
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/astro/test/server/middleware.test.ts

@@ -64,6 +64,7 @@ describe('sentryMiddleware', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/browser/src/integrations/graphqlClient.ts

@@ -11,6 +11,7 @@ import {
 } from '@sentry/core/browser';
 import type { FetchHint, XhrHint } from '@sentry/browser-utils';
 import { getBodyString, getFetchRequestArgBody, SENTRY_XHR_DATA_KEY } from '@sentry/browser-utils';
+import { GRAPHQL_DOCUMENT } from '@sentry/conventions/attributes';
 
 interface GraphQLClientOptions {
  endpoints: Array<string | RegExp>;
@@ -88,9 +89,9 @@ function _updateSpanWithGraphQLData(client: Client, options: GraphQLClientOption
  const operationInfo = _getGraphQLOperation(graphqlBody);
  span.updateName(`${httpMethod} ${httpUrl} (${operationInfo})`);
 
- // Handle standard requests - always capture the query document
- if (isStandardRequest(graphqlBody)) {
- span.setAttribute('graphql.document', graphqlBody.query);
+ // Handle standard requests - capture the query document when enabled via dataCollection (default true)
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ span.setAttribute(GRAPHQL_DOCUMENT, graphqlBody.query);
  }
 
  // Handle persisted operations - capture hash for debugging
@@ -126,8 +127,8 @@ function _updateBreadcrumbWithGraphQLData(client: Client, options: GraphQLClient
 
  data['graphql.operation'] = operationInfo;
 
- if (isStandardRequest(graphqlBody)) {
- data['graphql.document'] = graphqlBody.query;
+ if (isStandardRequest(graphqlBody) && client.getDataCollectionOptions().graphQL.document === true) {
+ data[GRAPHQL_DOCUMENT] = graphqlBody.query;
  }
 
  if (isPersistedRequest(graphqlBody)) {

packages/browser/test/integrations/graphqlClient.test.ts

@@ -313,14 +313,18 @@ describe('GraphqlClient', () => {
  });
 
  describe('beforeOutgoingRequestSpan handler', () => {
- function setupHandler(endpoints: Array<string | RegExp>): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
+ function setupHandler(
+ endpoints: Array<string | RegExp>,
+ graphQLDocument = true,
+ ): (span: SentrySpan, hint: FetchHint | XhrHint) => void {
  let capturedListener: ((span: SentrySpan, hint: FetchHint | XhrHint) => void) | undefined;
  const mockClient = {
  on: (eventName: string, cb: (span: SentrySpan, hint: FetchHint | XhrHint) => void) => {
  if (eventName === 'beforeOutgoingRequestSpan') {
  capturedListener = cb;
  }
  },
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
  } as unknown as Client;
 
  const integration = graphqlClientIntegration({ endpoints });
@@ -420,5 +424,25 @@ describe('GraphqlClient', () => {
  expect(json.description).toBe('custom span');
  expect(json.data['graphql.document']).toBeUndefined();
  });
+
+ test('omits graphql.document when dataCollection.graphQL.document is false', () => {
+ const handler = setupHandler([/\/graphql$/], false);
+ const span = new SentrySpan({
+ name: 'POST http://localhost:4000/graphql',
+ op: 'http.client',
+ attributes: {
+ 'http.method': 'POST',
+ 'http.url': 'http://localhost:4000/graphql',
+ url: 'http://localhost:4000/graphql',
+ },
+ });
+
+ handler(span, makeFetchHint('http://localhost:4000/graphql', requestBody));
+
+ const json = spanToJSON(span);
+ // The span is still renamed with the operation, but the document is not attached.
+ expect(json.description).toBe('POST http://localhost:4000/graphql (query GetHello)');
+ expect(json.data['graphql.document']).toBeUndefined();
+ });
  });
 });

packages/core/src/types/datacollection.ts

@@ -51,7 +51,26 @@ export interface DataCollection {
  queryParams?: CollectBehavior;
 
  /**
- * Controls generative AI input/output recording.
+ * Allow collection of GraphQL operation data when using the SDK's GraphQL integrations
+ *
+ * These options do not add GraphQL instrumentation on their own. The corresponding integration must still be enabled
+ * for any data to be captured.
+ *
+ * - `document`: attach the GraphQL document (query/mutation source text).
+ * - `variables`: attach the variables passed to GraphQL operations.
+ * @default { document: true, variables: true }
+ */
+ graphQL?: {
+ document?: boolean;
+ variables?: boolean;
+ };
+
+ /**
+ * Allow generative AI input/output recording when using the SDK's AI integrations.
+ *
+ * These options do not add AI instrumentation on their own. The corresponding integration must still be enabled for
+ * any data to be captured. Integration-level options, when set, take precedence over these
+ * values.
  * @default { inputs: true, outputs: true }
  */
  genAI?: {
@@ -77,5 +96,6 @@ export interface DataCollection {
  */
 export type ResolvedDataCollection = Required<DataCollection> & {
  httpHeaders: Required<NonNullable<DataCollection['httpHeaders']>>;
+ graphQL: Required<NonNullable<DataCollection['graphQL']>>;
  genAI: Required<NonNullable<DataCollection['genAI']>>;
 };

packages/core/src/utils/data-collection/defaultPiiToCollectionOptions.ts

@@ -16,6 +16,7 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7
@@ -26,6 +27,9 @@ export function defaultPiiToCollectionOptions(sendDefaultPii?: boolean): Resolve
  httpHeaders: { request: { deny: PII_HEADER_SNIPPETS }, response: { deny: PII_HEADER_SNIPPETS } },
  httpBodies: [],
  queryParams: { deny: PII_HEADER_SNIPPETS },
+ // The GraphQL document has literal values redacted at collection time, so it was historically
+ // always attached regardless of `sendDefaultPii`; keep it on to preserve that behavior.
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7, // default should be 5, but ContextLines integration uses 7

packages/core/src/utils/data-collection/resolveDataCollectionOptions.ts

@@ -7,6 +7,7 @@ const DEFAULTS: ResolvedDataCollection = {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -43,6 +44,10 @@ export function resolveDataCollectionOptions(options: {
  },
  httpBodies: dc.httpBodies ?? base.httpBodies,
  queryParams: dc.queryParams ?? base.queryParams,
+ graphQL: {
+ document: dc.graphQL?.document ?? base.graphQL.document,
+ variables: dc.graphQL?.variables ?? base.graphQL.variables,
+ },
  genAI: {
  inputs: dc.genAI?.inputs ?? base.genAI.inputs,
  outputs: dc.genAI?.outputs ?? base.genAI.outputs,

packages/core/test/lib/integrations/mcp-server/testUtils.ts

@@ -17,6 +17,7 @@ export function createMockClient(userInfo = true, genAI?: { inputs: boolean; out
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: genAIOptions,
  stackFrameVariables: true,
  frameContextLines: 5,

packages/core/test/lib/utils/data-collection/defaultPiiToCollectionOptions.test.ts

@@ -9,6 +9,7 @@ describe('defaultPiiToCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -25,6 +26,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -41,6 +43,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,
@@ -57,6 +60,7 @@ describe('defaultPiiToCollectionOptions', () => {
  },
  httpBodies: [],
  queryParams: { deny: ['forwarded', '-ip', 'remote-', 'via', '-user'] },
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 7,

packages/core/test/lib/utils/data-collection/resolveDataCollectionOptions.test.ts

@@ -8,6 +8,7 @@ describe('resolveDataCollectionOptions', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: ['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse'],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,
@@ -21,6 +22,8 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ // GraphQL documents are redacted at collection time, so they stay on to preserve legacy behavior.
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(7);
  });
@@ -45,6 +48,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.httpBodies).toEqual(['incomingRequest', 'outgoingRequest', 'incomingResponse', 'outgoingResponse']);
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  });
 
@@ -54,6 +58,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.userInfo).toBe(false);
  expect(result.httpBodies).toEqual([]);
  expect(result.genAI).toEqual({ inputs: false, outputs: false });
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  });
  });
 
@@ -87,6 +92,7 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.cookies).toBe(true);
  expect(result.httpHeaders).toEqual({ request: true, response: true });
  expect(result.queryParams).toBe(true);
+ expect(result.graphQL).toEqual({ document: true, variables: true });
  expect(result.genAI).toEqual({ inputs: true, outputs: true });
  expect(result.stackFrameVariables).toBe(true);
  expect(result.frameContextLines).toBe(5);
@@ -114,6 +120,17 @@ describe('resolveDataCollectionOptions', () => {
  expect(result.genAI.outputs).toBe(true);
  });
 
+ it('merges nested graphQL partially', () => {
+ const result = resolveDataCollectionOptions({
+ dataCollection: {
+ graphQL: { document: false },
+ },
+ });
+
+ expect(result.graphQL.document).toBe(false);
+ expect(result.graphQL.variables).toBe(true);
+ });
+
  it('supports allow/deny list for cookies', () => {
  const result = resolveDataCollectionOptions({
  dataCollection: {
@@ -139,14 +156,17 @@ describe('resolveDataCollectionOptions', () => {
  it('always returns all fields', () => {
  const result = resolveDataCollectionOptions({});
 
- expect(Object.keys(result)).toHaveLength(8);
+ expect(Object.keys(result)).toHaveLength(9);
  expect(result).toHaveProperty('userInfo');
  expect(result).toHaveProperty('cookies');
  expect(result).toHaveProperty('httpHeaders');
  expect(result).toHaveProperty('httpHeaders.request');
  expect(result).toHaveProperty('httpHeaders.response');
  expect(result).toHaveProperty('httpBodies');
  expect(result).toHaveProperty('queryParams');
+ expect(result).toHaveProperty('graphQL');
+ expect(result).toHaveProperty('graphQL.document');
+ expect(result).toHaveProperty('graphQL.variables');
  expect(result).toHaveProperty('genAI');
  expect(result).toHaveProperty('genAI.inputs');
  expect(result).toHaveProperty('genAI.outputs');

packages/core/test/lib/utils/request.test.ts

@@ -874,6 +874,7 @@ describe('request utils', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/node/src/integrations/tracing/graphql/vendored/utils.ts

@@ -23,7 +23,7 @@ import type {
  Token,
 } from './graphql-types';
 import type { Span, SpanAttributes } from '@sentry/core';
-import { isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
+import { getClient, isObjectLike, SPAN_STATUS_ERROR, startInactiveSpan, withActiveSpan } from '@sentry/core';
 import { AllowedOperationTypes, SpanNames, TokenKind } from './enum';
 import { AttributeNames } from './enums/AttributeNames';
 import { OTEL_GRAPHQL_DATA_SYMBOL, OTEL_PATCHED_SYMBOL } from './symbols';
@@ -38,8 +38,10 @@ export const isPromise = (value: any): value is Promise<unknown> => {
 };
 
 export function addSpanSource(span: Span, loc?: Location, start?: number, end?: number): void {
- const source = getSourceFromLocation(loc, start, end);
- span.setAttribute(AttributeNames.SOURCE, source);
+ if (getClient()?.getDataCollectionOptions().graphQL.document === true) {
+ const source = getSourceFromLocation(loc, start, end);
+ span.setAttribute(AttributeNames.SOURCE, source);
+ }
 }
 
 function createFieldIfNotExists(

packages/node/test/integrations/tracing/graphql/addSpanSource.test.ts

@@ -0,0 +1,53 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import * as core from '@sentry/core';
+import { addSpanSource } from '../../../../src/integrations/tracing/graphql/vendored/utils';
+import type { Location, Token } from '@sentry/server-utils/orchestrion';
+
+vi.spyOn(core, 'getClient');
+
+function mockClient(graphQLDocument: boolean): void {
+ vi.mocked(core.getClient).mockReturnValue({
+ getDataCollectionOptions: () => ({ graphQL: { document: graphQLDocument, variables: true } }),
+ } as any);
+}
+
+function makeLocation(): Location {
+ const token: Token = {
+ kind: 'Name',
+ start: 0,
+ end: 5,
+ line: 1,
+ column: 1,
+ value: 'hello',
+ prev: null,
+ next: null,
+ };
+ return { start: 0, end: 5, startToken: token };
+}
+
+describe('addSpanSource dataCollection gate', () => {
+ beforeEach(() => {
+ vi.clearAllMocks();
+ });
+
+ it('sets graphql.source attribute when graphQL.document is true', () => {
+ mockClient(true);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).toHaveBeenCalledWith('graphql.source', expect.any(String));
+ });
+
+ it('does not set attribute when graphQL.document is false', () => {
+ mockClient(false);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+
+ it('does not set attribute when getClient() is undefined', () => {
+ vi.mocked(core.getClient).mockReturnValue(undefined);
+ const span = { setAttribute: vi.fn() } as any;
+ addSpanSource(span, makeLocation());
+ expect(span.setAttribute).not.toHaveBeenCalled();
+ });
+});

packages/nuxt/test/runtime/hooks/wrapMiddlewareHandler.test.ts

@@ -47,6 +47,7 @@ describe('wrapMiddlewareHandlerWithSentry', () => {
  httpHeaders: { request: true, response: true },
  httpBodies: [],
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: false, outputs: false },
  stackFrameVariables: true,
  frameContextLines: 5,

packages/remix/test/server/errors.test.ts

@@ -17,6 +17,7 @@ function createMockClient(httpBodies: string[] = []): Client {
  httpHeaders: { request: true, response: true },
  httpBodies,
  queryParams: true,
+ graphQL: { document: true, variables: true },
  genAI: { inputs: true, outputs: true },
  stackFrameVariables: true,
  frameContextLines: 5,