x-fapi-interaction-id

Tracing & Correlation de facto — unregistered response reached by regulation 3 spellings

x-fapi-interaction-id is a correlation identifier: the client may send one, the server must echo it, and both sides log it. Mechanically it is unremarkable — a UUID that makes a single call traceable across two organisations.

What is remarkable is the reach. The UK’s CMA Open Banking Order, the EU’s PSD2, and Australia’s Consumer Data Right all require conformance to security profiles built on FAPI, and FAPI requires this header. One string, mandated on three continents, by three unrelated pieces of legislation, because they all delegated the technical detail to the same standard.

Ninety-five providers declare it — a small number in absolute terms and a very large one when you consider it is essentially the count of organisations in the catalog operating under an open-banking regime.

It is also the header that makes the limits of contract-derived measurement concrete. We can see that a contract declares it. We cannot see whether a deployment echoes it, because watching that requires credentials we do not and should not have.

The registry

Not registered with IANA. It is a de facto or vendor field — real, widely used, and governed by nothing but convention.

In the catalog

Declared by 156 providers across 19,977 published specification files in the API Evangelist catalog, where it appears as a response header — sent by the server.

It is spelled 3 different ways across those contracts — x-fapi-interaction-id, x-fapi-interaction-Id, XFAPIInteractionId. HTTP field names are case-insensitive (RFC 9110, §5.1), so every one of these is the same header. They are not the same string, which is why generated clients disagree about it.

Reached by regulation

This header is mandated: the law, or a technical standard the law makes binding, names it directly. Only a credentialed caller can watch it in flight. The catalog can see that a contract declares it; it cannot see that a deployment honours it, and this site never claims otherwise.

The same correlation header lands in three jurisdictions through three different laws, because all three point at FAPI. It is the closest thing the regulated API world has to a universal header.

Using it

Echo the client’s value when one is supplied; generate a UUID when one is not; return it on errors as well as successes — the error case is when somebody actually needs it. Log it on both sides of the call. Never derive anything security-relevant from it: it is caller-supplied and it is not a credential.