diff --git a/api/incubator/src/main/java/io/opentelemetry/api/incubator/config/InstrumentationConfigUtil.java b/api/incubator/src/main/java/io/opentelemetry/api/incubator/config/InstrumentationConfigUtil.java
index f0ee7090710..33f45333c3e 100644
--- a/api/incubator/src/main/java/io/opentelemetry/api/incubator/config/InstrumentationConfigUtil.java
+++ b/api/incubator/src/main/java/io/opentelemetry/api/incubator/config/InstrumentationConfigUtil.java
@@ -111,6 +111,22 @@ public static List<String> httpServerResponseCapturedHeaders(ConfigProvider conf
         "server");
   }
 
+  /**
+   * Return {@code .instrumentation.general.sanitization.url.sensitive_query_parameters}, or null if
+   * none is configured.
+   *
+   * @throws DeclarativeConfigException if an unexpected type is encountered accessing the property
+   */
+  @Nullable
+  public static List<String> sensitiveQueryParameters(ConfigProvider configProvider) {
+    return getOrNull(
+        configProvider,
+        config -> config.getScalarList("sensitive_query_parameters", String.class),
+        "general",
+        "sanitization",
+        "url");
+  }
+
   /**
    * Return {@code .instrumentation.java.<instrumentationName>}, or null if none is configured.
    *
diff --git a/api/incubator/src/test/java/io/opentelemetry/api/incubator/config/InstrumentationConfigUtilTest.java b/api/incubator/src/test/java/io/opentelemetry/api/incubator/config/InstrumentationConfigUtilTest.java
index 18fc13888db..d00c6d7321c 100644
--- a/api/incubator/src/test/java/io/opentelemetry/api/incubator/config/InstrumentationConfigUtilTest.java
+++ b/api/incubator/src/test/java/io/opentelemetry/api/incubator/config/InstrumentationConfigUtilTest.java
@@ -46,6 +46,13 @@ class InstrumentationConfigUtilTest {
           + "        response_captured_headers:\n"
           + "          - server-response-header1\n"
           + "          - server-response-header2\n"
+          + "    sanitization:\n"
+          + "      url:\n"
+          + "        sensitive_query_parameters:\n"
+          + "          - AWSAccessKeyId\n"
+          + "          - Signature\n"
+          + "          - sig\n"
+          + "          - X-Goog-Signature\n"
           + "  java:\n"
           + "    example:\n"
           + "      property: \"value\"";
@@ -58,6 +65,8 @@ class InstrumentationConfigUtilTest {
       toConfigProvider("instrumentation/development:\n  general:\n");
   private static final ConfigProvider emptyHttpConfigProvider =
       toConfigProvider("instrumentation/development:\n  general:\n    http:\n");
+  private static final ConfigProvider emptySanitizationConfigProvider =
+      toConfigProvider("instrumentation/development:\n  general:\n    sanitization:\n");
 
   private static ConfigProvider toConfigProvider(String configYaml) {
     return SdkConfigProvider.create(
@@ -139,6 +148,19 @@ void httpServerResponseCapturedHeaders() {
         .isNull();
   }
 
+  @Test
+  void sensitiveQueryParameters() {
+    assertThat(InstrumentationConfigUtil.sensitiveQueryParameters(kitchenSinkConfigProvider))
+        .isEqualTo(Arrays.asList("AWSAccessKeyId", "Signature", "sig", "X-Goog-Signature"));
+    assertThat(
+            InstrumentationConfigUtil.sensitiveQueryParameters(emptyInstrumentationConfigProvider))
+        .isNull();
+    assertThat(InstrumentationConfigUtil.sensitiveQueryParameters(emptyGeneralConfigProvider))
+        .isNull();
+    assertThat(InstrumentationConfigUtil.sensitiveQueryParameters(emptySanitizationConfigProvider))
+        .isNull();
+  }
+
   @Test
   void javaInstrumentationConfig() {
     assertThat(