API Security-Identification Header Policy
Policy Name |
API Security-Identification Header |
Summary |
Adds API instance identifiers as response headers for external security platform correlation |
Category |
Security |
First Omni Gateway version available |
v1.13.0 |
Release Notes |
|
Returned Status Codes |
No return codes exist for this policy. |
Summary
The API Security-Identification Header policy injects organization and API instance identifiers as response headers to enable integration with external security platforms such as Akamai.
The policy adds these headers in the response phase:
-
x-ms-correlation-id-1: Contains the business group ID -
x-ms-correlation-id-2: Contains the API instance ID
The policy has no configuration parameters and operates transparently without blocking traffic. If the required metadata is unavailable, the response continues without the headers but logs a warning is logged for each missing identifier.
If the backend already returns x-ms-correlation-id-1 or x-ms-correlation-id-2 headers, the policy overwrites these values with the platform metadata values.
Logging
The policy logs the following information:
-
DEBUG level: The actual organization ID and API instance ID values injected into the headers (for example:
api-security-identification-header: org.id=a1b2c3d4-e5f6-7890-abcd-ef1234567890, apiId=19203842) -
WARN level: When an organization ID or API instance ID is missing or empty from platform metadata