# Configure telemetry

> Make the browser Editor telemetry behavior explicit.




Telemetry is enabled by default. The browser Editor sends one document-open event when each DOCX becomes ready. Configure it when you create the Editor. Set its [license identity](/editor/license) separately.

Each request body uses this structure:

```json
{
  "superdocVersion": "2.10.0",
  "browserInfo": {
    "userAgent": "Mozilla/5.0 ...",
    "currentUrl": "https://app.example.com",
    "hostname": "app.example.com",
    "screenSize": { "width": 1440, "height": 900 }
  },
  "metadata": { "application": "contract-review" },
  "events": [
    {
      "timestamp": "2026-08-29T12:00:00.000Z",
      "documentId": "document-123",
      "documentCreatedAt": "2026-08-01T09:30:00.000Z"
    }
  ]
}
```

`superdocVersion`, `browserInfo`, and optional `metadata` are request-envelope fields. Each item in `events` contains only `timestamp`, `documentId`, and `documentCreatedAt`. `browserInfo.currentUrl` contains the page origin. The payload does not include the page path, query string, fragment, or document content.

## Choose telemetry behavior [#choose-telemetry-behavior]

Disable telemetry explicitly when the deployment must not initialize the telemetry integration:

```ts
const superdoc = new SuperDoc({
  selector: '#editor',
  document: '/contract.docx',
  telemetry: { enabled: false },
});
```

When telemetry is enabled, `endpoint` selects the destination and `metadata` adds application-defined context:

```ts
const superdoc = new SuperDoc({
  selector: '#editor',
  document: '/contract.docx',
  telemetry: {
    enabled: true,
    endpoint: 'https://telemetry.example.com/v1/events',
    metadata: {
      application: 'contract-review',
      environment: 'production',
    },
  },
});
```

The Editor serializes `metadata` into the request body. Do not include document text, comments, personal data, credentials, signed URLs, or other sensitive values. Allow the selected endpoint in `connect-src`. For a cross-origin endpoint, allow the Editor page's origin, the `POST` method, and the `Content-Type` and `X-License-Key` request headers in its CORS policy.

> **Verification target (success)**
>
> Inspect browser network requests in the deployed environment. Confirm that disabled telemetry sends no telemetry
> requests, or that enabled telemetry reaches only the approved endpoint with approved metadata.


Continue with [Secure integration](/editor/secure-integration) to review every document and metadata boundary.