Unlike _kvcb_from_value, which raises a clear ValueError for invalid modes, _http_headers_from_value does not validate its input type. When data_collection={"http_headers": "off"} (a string), the "request" in val / "response" in val checks become substring searches that return False, silently falling back to deny_list for both directions with no warning — masking a likely user misconfiguration. A non-iterable value such as False would instead raise TypeError: argument of type 'bool' is not iterable, giving no actionable hint that data_collection.http_headers must be a dict. Consider adding an isinstance(val, dict) guard that raises a consistent ValueError/TypeError referencing the option, matching _kvcb_from_value's validation.

The stacklevel=2 in warnings.warn points to _get_options (internal SDK code) rather than the user's sentry_sdk.init() call site, making the deprecation warning confusing and unhelpful. A value of 4 or 5 is needed to surface it at the correct frame.