Correlation ID

Overview

Correlation ID is an identifier propagated across related requests, messages, logs, and services so operators can reconstruct one distributed business or technical flow. It groups related work, while a request ID identifies one request and a trace ID usually follows a formal distributed-tracing context.

The principal risks include identifier collisions, attacker-controlled log injection, missing propagation, accidental use as an authorization key, inconsistent formats, and correlation gaps across asynchronous events. Evidence for Correlation ID should preserve the input, configuration version, actor or service, decision, downstream reference, and final outcome.

A production implementation should generate or validate it at a trusted boundary, propagate it consistently, avoid embedding sensitive data, index it in logs, and distinguish external values from internal identifiers. The production boundary for Correlation ID should identify the authoritative system, responsible owner, accepted states, and recovery path.

Useful measures include propagation coverage, orphan-log rate, invalid identifiers, investigations completed with one identifier, and services dropping correlation context. Correlation ID is closely connected to Payment API Correlation ID, Payment Trace ID, and Webhook Event Log.

Testing Correlation ID should cover boundary values, dependency failure, restart recovery, and incompatible versions where they affect the workflow. Operational metrics for Correlation ID should use stable denominators and separate technical activity from successful business completion.

For Correlation ID, identifiers and timestamps should remain stable enough to trace the technical action to its final business outcome. Monitoring for Correlation ID should distinguish transport success, processing success, and the final external or financial result. Changes to Correlation ID should be tested against normal, failed, delayed, duplicate, and recovery paths that apply to the operation.