Hi Team,
in BC outbound HTTP request gets an automatically injected header correlation-context. HTTP requests executed in background sessions (Job Queue / Task Scheduler) include an even longer automatically injected header correlation-context (containing verbose traceStartInfo=[TaskScheduler] ...).
Some third-party/government APIs reject requests with this long header and return HTTP 400 Bad Request.
We have a reproducible case with the German BZSt eVATR VAT check API (https://api.evatr.vies.bzst.de/app/v1):
- Same AL code + same JSON payload works OnPrem and in SaaS in foreground
- Same code fails in SaaS in Job Queue background with HTTP 400
- Postman tests confirm: using the long background
correlation-contexttriggers the 400; using a shorter value succeeds. - AL cannot prevent it: even if we set
correlation-contextourselves to a short value beforeSend(), the platform puts the long TaskScheduler value in front of ours.
Request:
Please provide a supported way to prevent this from breaking integrations, e.g. one of:
- Per-request/per-client option in AL to suppress platform-injected correlation/telemetry headers for outbound HTTP calls
- Tenant/admin setting to disable or limit correlation headers for outbound calls
- Hard cap/truncation of
correlation-contextlength (especially in background sessions) - If developer sets
correlation-context, do not append verbose platform content - Split the correlation-context into multiple headers with a max. length of e.g. 300
Impact:
Background automation is a standard pattern in BC; without a solution, integrations with strict APIs (e.g., government/financial services) could fail in SaaS.
Proxy-based workarounds introduce SPOF/liability and are not acceptable.
I can imagine that this header might be important for Application Insights. But I'm not sure. I haven't found any documentation about this header in the Business Central documentation.
However, some external web services cannot handle long headers.
Comments
OK, so today I can answer this myself 🙃:obviously, when calling the API from code called from an event subscriber it blows up the correlation-context enough to break things, while when calling it directly from an action, it stays within the limit. 🙄
Category: Development
Hi Jürgen,trying the same API ("aus Gründen"... 😉), for me it succeeds in a Saas environment, but fails on-prem (where we need it) even when calling it from a CodeUnit without jobqueue. The injected correlation-context is > 300 charachters long. How did you manage to get it to work on-prem, what does your correlation-context look like, may I ask?Best regards, Thomas
Category: Development
Appendum:To my knowledge, the "correlation-context" header is deprecated in the W3C. Apparently, "baggage" or "traceparent" and "tracestate" are the standard headers intended for distributed tracing.
Category: Development
