13

Hi Team,


in BC outbound HTTP request gets an automatically injected header correlation-context. HTTP requests executed in background sessions (Job Queue / Task Scheduler) include an even longer automatically injected header correlation-context (containing verbose traceStartInfo=[TaskScheduler] ...).

Some third-party/government APIs reject requests with this long header and return HTTP 400 Bad Request.

We have a reproducible case with the German BZSt eVATR VAT check API (https://api.evatr.vies.bzst.de/app/v1):

  • Same AL code + same JSON payload works OnPrem and in SaaS in foreground
  • Same code fails in SaaS in Job Queue background with HTTP 400
  • Postman tests confirm: using the long background correlation-context triggers the 400; using a shorter value succeeds.
  • AL cannot prevent it: even if we set correlation-context ourselves to a short value before Send(), the platform puts the long TaskScheduler value in front of ours.


Request:

Please provide a supported way to prevent this from breaking integrations, e.g. one of:

  1. Per-request/per-client option in AL to suppress platform-injected correlation/telemetry headers for outbound HTTP calls
  2. Tenant/admin setting to disable or limit correlation headers for outbound calls
  3. Hard cap/truncation of correlation-context length (especially in background sessions)
  4. If developer sets correlation-context, do not append verbose platform content
  5. Split the correlation-context into multiple headers with a max. length of e.g. 300


Impact:

Background automation is a standard pattern in BC; without a solution, integrations with strict APIs (e.g., government/financial services) could fail in SaaS.

Proxy-based workarounds introduce SPOF/liability and are not acceptable.


I can imagine that this header might be important for Application Insights. But I'm not sure. I haven't found any documentation about this header in the Business Central documentation.

However, some external web services cannot handle long headers.

Category: Development
STATUS DETAILS
New

Comments

J

OK, so today I can answer this myself 🙃:obviously, when calling the API from code called from an event subscriber it blows up the correlation-context enough to break things, while when calling it directly from an action, it stays within the limit. 🙄

Category: Development

J

Hi Jürgen,trying the same API ("aus Gründen"... 😉), for me it succeeds in a Saas environment, but fails on-prem (where we need it) even when calling it from a CodeUnit without jobqueue. The injected correlation-context is > 300 charachters long. How did you manage to get it to work on-prem, what does your correlation-context look like, may I ask?Best regards, Thomas

Category: Development

J

Appendum:To my knowledge, the "correlation-context" header is deprecated in the W3C. Apparently, "baggage" or "traceparent" and "tracestate" are the standard headers intended for distributed tracing.

Category: Development