Body Capture
What of a request and response body ends up in a trace.
Off by default, and deliberately so. Bodies are the most sensitive thing the porthole can touch and the most likely to end up pasted into a chat window: an auth response carries tokens, a profile response carries personal data. Turn it on per client, for the client you are actually debugging.
Even when on, capture is bounded three ways: only text-shaped content types, only the first maxBytes, and never a one-shot or duplex body, because reading one would consume the stream the call is about to send.
Constructors
Types
Properties
Header names replaced with *, matched case-insensitively.
Content types never read, whatever textContentTypes says, because they have no end. Peeking at a response body blocks until it has the bytes, so peeking at an event stream would hang the call until something happened to be pushed.
Content-type prefixes worth reading as text. Anything else is skipped.