An external API dependency returns a potentially sensitive error response. What should the application expose to users?

1. The full stack trace, credentials, and all downstream headers.
2. A success response regardless of whether the action completed.
3. A controlled error message and correlation identifier, while retaining protected diagnostics internally.
4. Every other user's recent request details.