---
schema_version: "1"
id: 9e3db967668376733092d2dc147e094065138ddcb41a6ff69815d4ead2bcab08
title: API Security-Identification Header Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-api-security-identification-header.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-api-security-identification-header
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 52afb286c1e71bb6349174ed70eab15358039ea8647cdd568611ffd78bb3e43f
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: api security, identification, correlation, api gateway, flex gateway, gateway, policy
---

# API Security-Identification Header Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>API Security-Identification Header</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Adds API instance identifiers as response headers for external security platform correlation</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.13.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/api-security-identification-header-release-notes">API Security-Identification Header</a></p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>No return codes exist for this policy.</p></td></tr></tbody></table>

## Summary

The API Security-Identification Header policy injects organization and API instance identifiers as
response headers to enable integration with external security platforms such as Akamai.

The policy adds these headers in the response phase:

- `x-ms-correlation-id-1`: Contains the business group ID

- `x-ms-correlation-id-2`: Contains the API instance ID

The policy has no configuration parameters and operates transparently without blocking traffic. If
the required metadata is unavailable, the response continues without the headers but logs a warning
is logged for each missing identifier.

If the backend already returns `x-ms-correlation-id-1` or `x-ms-correlation-id-2` headers, the
policy overwrites these values with the platform metadata values.

## Configuring Policy Parameters

### Omni Gateway Local Mode

The API Security-Identification Header policy isn’t supported in Local Mode.

### Managed Omni Gateway and Omni Gateway Connected Mode

The API Security-Identification Header policy doesn’t have configuration parameters.

## Logging

The policy logs the following information:

- **DEBUG level**: The actual organization ID and API instance ID values injected into the headers
  (for example:
  `api-security-identification-header: org.id=a1b2c3d4-e5f6-7890-abcd-ef1234567890, apiId=19203842`)

- **WARN level**: When an organization ID or API instance ID is missing or empty from platform
  metadata

## Example Response

Given the following platform metadata:

- Organization ID: `a1b2c3d4-e5f6-7890-abcd-ef1234567890`

- API instance ID: `19203842`

The policy adds the following response headers:

x-ms-correlation-id-1: a1b2c3d4-e5f6-7890-abcd-ef1234567890 x-ms-correlation-id-2: 19203842