{"version":"2.1.216","anchor":"credential-sentinels-now-substituted-in-request-bodies","canonical_anchor":"credential-sentinels-now-substituted-in-request-bodies","heading":"Credential Sentinels Now Substituted in Request Bodies","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.216\/e\/credential-sentinels-now-substituted-in-request-bodies","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.216","markdown":"### Credential Sentinels Now Substituted in Request Bodies\n\n**What**\n\nMasked credential sentinels (set up via `sandbox.credentials.envVars`) are now replaced with their real values in outgoing request bodies as well as headers. A streaming `Transform` walks the body for sentinel byte sequences and swaps them in place.\n\n**Details**\n\n- Only applies to methods that send a body (`POST`, `PUT`, `PATCH`, etc.)\n- Skipped for requests with `Content-Encoding` headers (compressed bodies cannot be substituted safely; a warning is logged)\n- If any sentinel differs in length from its real value, the `content-length` header is removed so the stream can change size\n- Only sentinels where sentinel length equals real-value length preserve `content-length` intact\n\n**Evidence**\n\nBody substitution transform (search for `\"[body-substitution]\"` or `\"substitution skipped \u2014 a sentinel in this body\"`)."}