---
schema_version: "1"
id: b1d1dc353b2608f40dde46dd6676709112f638d48bd8144f37e3c8f3920c1a6e
title: API Security-Identification Header Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/mule-gateway/policies-included-api-security-identification-header.md
canonical_url: https://docs.mulesoft.com/mule-gateway/policies-included-api-security-identification-header
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 3dfdd354bc9ce17a92ffd120a928c12e546f7da5337248f5cee946cfef8cea4d
description: MuleSoft Documentation Site
latest: true
---
---
product: Mule Gateway
keywords: api security, identification, correlation, api gateway, mule gateway, gateway, policy
---

# API Security-Identification Header Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>API Security-Identification Header</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Adds API instance identifiers as response headers for external security platform correlation</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Mule version available</strong></p></td><td><p>v4.12.0</p></td></tr><tr><td><p><strong>Returned Status Codes</strong></p></td><td><p>No return codes exist for this policy.</p></td></tr></tbody></table>

## Summary

The API Security-Identification Header policy injects organization and API instance identifiers as
response headers to enable integration with external security platforms such as Akamai.

The policy adds these headers in the response phase:

- `x-ms-correlation-id-1`: Contains the business group ID

- `x-ms-correlation-id-2`: Contains the API instance ID

The policy has no configuration parameters and operates transparently without blocking traffic. If
the required metadata is unavailable, the response continues without the headers and a warning is
logged for each missing identifier.

If the backend already returns `x-ms-correlation-id-1` or `x-ms-correlation-id-2` headers, the
policy overwrites these values with the platform metadata values.

## Configuring Policy Parameters

This policy has no user-configurable parameters, but the policy requires the following system
properties to be configured for the Mule runtime:

- `anypoint.platform.client_id`: The client ID for authenticating with Anypoint Platform

- `anypoint.platform.client_secret`: The client secret for authenticating with Anypoint Platform

- `anypoint.platform.base_uri`: The base URI for the Anypoint Platform API (for example,
  `[https://anypoint.mulesoft.com](https://anypoint.mulesoft.com)`)

> [!NOTE] These properties are typically configured automatically when running Mule runtime with
> Anypoint Platform.

## Logging

The policy logs the following information:

- **INFO level**: Organization ID retrieval status during policy initialization (for example:
  `OrgIdRetriever.initialise() complete — organizationId=<value>`)

- **WARN level**: When system properties are not configured or when organization ID retrieval fails
  during initialization

## Example Response

Given the following metadata:

- Organization ID: `a1b2c3d4-e5f6-7890-abcd-ef1234567890`

- API instance ID: `19203842`

The policy adds the following response headers:

x-ms-correlation-id-1: a1b2c3d4-e5f6-7890-abcd-ef1234567890 x-ms-correlation-id-2: 19203842