feat(replay): [Data Collection 16] Inherit network collection policy

[adinauer]

PR Stack (Data Collection)

• feat(core): Data Collection #5759
• feat(core): [Data Collection 1] Add configuration types #5760
• feat(core): [Data Collection 2] Expose SentryOptions API #5761
• feat(core): [Data Collection 3] Add policy resolver #5799
• feat(graphql): [Data Collection 4] Apply GraphQL policies #5800
• feat(database): [Data Collection 5] Apply query policy #5801
• feat(spring): [Data Collection 6] Apply incoming request body policy #5802
• feat(apollo): [Data Collection 7] Apply incoming response body policy #5803
• feat(apollo): [Data Collection 8] Apply outgoing request body policy #5804
• feat(graphql): [Data Collection 9] Apply outgoing response body policy #5805
• feat(http): [Data Collection 10] Apply request header policy #5806
• feat(http): [Data Collection 11] Apply response header policy #5807
• feat(http): [Data Collection 12] Apply query parameter policy #5810
• feat(http): [Data Collection 13] Apply cookie collection policy #5811
• feat(user): [Data Collection 14] Apply user information policy #5812
• fix(android): [Data Collection 15] Scope device info cache to SDK options #5831
• feat(replay): [Data Collection 16] Inherit network collection policy #5832
• fix(android): [Data Collection 17] Apply user info policy to distinct ID #5833
• fix(spring): [Data Collection 18] Bind key-value policies #5834

---

📜 Description

Make Session Replay network body and header options nullable overrides that can inherit the global Data Collection policy.

Explicit Replay options remain authoritative. When a Replay option is unset and Data Collection is configured, request and response headers inherit their matching httpHeaders behavior, while bodies inherit the matching outgoing-request and incoming-response body settings. If Data Collection is absent, Replay preserves its historical defaults: body capture enabled and the Content-Type, Content-Length, and Accept header allow-list.

Add KeyValueCollectionBehavior Replay APIs for header policies while retaining deprecated list-based APIs for compatibility. Apply effective policies to OkHttp Replay network details and preserve the existing RRWeb options payload shape.

Android manifest options now preserve nullable inheritance when metadata is absent and continue to take precedence when explicitly configured.

💡 Motivation and Context

Session Replay previously maintained independent network defaults, so opting into Data Collection did not consistently control network content included in recordings. Nullable Replay overrides provide an explicit precedence model without breaking the existing primitive and list-based Java APIs.

The Replay URL allow and deny lists remain independent eligibility controls. Data Collection only determines which content an eligible request may serialize.

Refs #5666

💚 How did you test it?

• ./gradlew spotlessApply apiDump
• ./gradlew :sentry:apiCheck :sentry:test --tests='io.sentry.SentryReplayOptionsTest' --tests='io.sentry.util.network.NetworkDetailCaptureUtilsTest' --tests='io.sentry.rrweb.RRWebOptionsEventSerializationTest' :sentry-okhttp:test --tests='io.sentry.okhttp.SentryOkHttpInterceptorTest' :sentry-android-core:testDebugUnitTest --tests='io.sentry.android.core.ManifestMetadataReaderTest'
• git diff --check

📝 Checklist

• I added GH Issue ID & Linear ID
• I added tests to verify the changes.
• No new PII added or SDK only sends newly added PII if sendDefaultPII is enabled.
• I updated the docs if needed.
• I updated the wizard if needed.
• Review from the native team if needed.
• No breaking change or entry added to the changelog.
• No breaking change for hybrid SDKs or communicated to hybrid SDKs.
• Public API changes reviewed by another Mobile SDK team member or implemented according to the develop docs spec.

🔮 Next steps

Coordinate richer RRWeb options metadata if Sentry needs to distinguish directional body policies and non-allow-list header behaviors.

#skip-changelog

⚠️ Merge this PR using a merge commit (not squash). Only the collection branch is squash-merged into main.

[github-actions]

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against f83d56c

[adinauer]

This class needs some discussion, can we somehow send whether OFF / DENY or ALLOW was used?

[sentry]

📲 Install Builds

Android

🔗 App Name	App ID	Version	Configuration
SDK Size	io.sentry.tests.size	8.48.0 (1)	release

⚙️ sentry-android Build Distribution Settings

[github-actions]

Performance metrics 🚀

	Plain	With Sentry	Diff
Startup time	358.20 ms	437.48 ms	79.28 ms
Size	0 B	0 B	0 B