Correlation ID and trace ID
“What is a correlation ID, and how do you add one to every log line and error response?”
One id per request, on every log line and in the error the user sees, so support can find the whole story in seconds.
See it
X-Correlation-ID: c-81f2
1/5The portal sends a request with its own id in the X-Correlation-ID header: c-81f2.
In plain words
A busy API writes thousands of log lines a minute, from many requests at once, all mixed together. When a dealer reports "I got an error at 10:42", support can't tell which lines belong to that one request. A correlation id fixes this: one id per request, written on every log line the request produces and sent back in the response. The user, or the portal, shows the id in the error message; support pastes it into the log search and sees only that request's lines. If the portal already made an id, the API reuses it from a request header (often X-Correlation-ID), so one id follows the call through every service. Separately, .NET has a built-in id, the trace id. It comes from W3C Trace Context (W3C is the web standards body): the id arrives in a traceparent header, or is created, and .NET passes it on to the next service on outgoing HTTP calls by itself. files every line under it as operation_Id. Many teams use the trace id alone; others add their own correlation id because a client or an old system already sends one. Note the shapes: the traceId in a ProblemDetails is the full text 00-<32 hex>-<16 hex>-<flags> (the flags are usually -01 in production), while operation_Id is only the 32-hex middle part, so support searches with that part.
- A correlation id ties together every log line and downstream call for one request. A middleware reads it from an incoming header or creates one, and stores it for the request.
- The middleware then opens a logging scope (while it is open, every log line gets the id as a field). It returns the id in a response header and in ProblemDetails.
- ASP.NET Core already has a W3C trace id on , the .NET object that carries the trace id. It is propagated, meaning passed on to the next service, in the
traceparentheader of outgoing calls. - The same id is
operation_Idin , and ProblemDetails adds it astraceId, the full00-…text whose middle 32 characters are theoperation_Id. - Order matters: the correlation middleware goes before , so the error log line is still inside its scope, and the header is set in , because the exception handler clears the response headers before writing the 500.
- Then a user's error message carries an id that finds the exact log lines in one query.
In the lending API
The middleware, run on .NET 10. Cut down: a real one also limits the id's length and characters (last follow-up). Program.cs shows where it sits; the middleware file is the detail, so the walk goes back to the start there. Tap Next line to follow c-81f2.
Lending.sln · where these 2 files sit
- src/Api/
- Middleware/
- Middleware/
X-Correlation-ID header: c-81f2.What they ask next
Interviewers check that you can explain every line. Tap a question to open it.
Correlation id or trace id: do I need both?
Often not. The W3C trace id already travels to the next service on calls, shows up as
operation_Idin and astraceIdin ProblemDetails (the full text; search with its middle 32 hex characters). Add your own correlation id when a client or an older system already sends one, or when the business wants an id that is easy to read out on the phone.Can I trust an id that came in a header?
Only as a label. Limit its length and characters, so nobody can fill your logs with junk through it, and never use it for security decisions.
Traps
- Don't say
Put the correlation middleware anywhere in Program.cs.SayBefore . After it, the error log line is written outside the scope and loses the id. - Don't say
Pass the id as a parameter to every method so it gets logged.SayOpen a logging scope once in middleware; every line inside it carries the id.