mask or omit sensitive data in payload (activity stream)

Organization Name (Required - If you are an Oracle Partner, please provide the organization you are logging the idea on behalf of):

Natwest Group

Description (Required):

Mask Sensitive data at the activity level in integrations

Use Case and Business Need (Required):

We have a few integrations that connect to legacy SOAP web services, which require a token to be retrieved at runtime and then passed to another SOAP service through the request headers. During this process, the username and password of the service account used to generate the token are exposed in the activity stream logs.

To mitigate this risk, we need a control that prevents sensitive information from being logged at the activity level, ensuring that such details are omitted or masked from the activity stream even when integrations run in debug mode. Exposure of the service account credentials within the payload represents a security-policy violation, as it could allow support personnel to directly access or log in to the legacy systems—potentially leading to unauthorised access to sensitive data and other adverse impacts.