Hi Team,
in BC outbound HTTP request gets an automatically injected header correlation-context. HTTP requests executed in background sessions (Job Queue / Task Scheduler) include an even longer automatically injected header correlation-context (containing verbose traceStartInfo=[TaskScheduler] ...).
Some third-party/government APIs reject requests with this long header and return HTTP 400 Bad Request.
We have a reproducible case with the German BZSt eVATR VAT check API (https://api.evatr.vies.bzst.de/app/v1):
- Same AL code + same JSON payload works OnPrem and in SaaS in foreground
- Same code fails in SaaS in Job Queue background with HTTP 400
- Postman tests confirm: using the long background
correlation-contexttriggers the 400; using a shorter value succeeds. - AL cannot prevent it: even if we set
correlation-contextourselves to a short value beforeSend(), the platform puts the long TaskScheduler value in front of ours.
Request:
Please provide a supported way to prevent this from breaking integrations, e.g. one of:
- Per-request/per-client option in AL to suppress platform-injected correlation/telemetry headers for outbound HTTP calls
- Tenant/admin setting to disable or limit correlation headers for outbound calls
- Hard cap/truncation of
correlation-contextlength (especially in background sessions) - If developer sets
correlation-context, do not append verbose platform content - Split the correlation-context into multiple headers with a max. length of e.g. 300
Impact:
Background automation is a standard pattern in BC; without a solution, integrations with strict APIs (e.g., government/financial services) could fail in SaaS.
Proxy-based workarounds introduce SPOF/liability and are not acceptable.
I can imagine that this header might be important for Application Insights. But I'm not sure. I haven't found any documentation about this header in the Business Central documentation.
However, some external web services cannot handle long headers.
Comments
Appendum:To my knowledge, the "correlation-context" header is deprecated in the W3C. Apparently, "baggage" or "traceparent" and "tracestate" are the standard headers intended for distributed tracing.
Category: Development
