Is x-correlator support required at OIDC endpoints?

[trehman-gsma]

Context
The CAMARA APIs define 401 and 403 error responses that include an optional x-correlator header. For example, in SimSwap v1.0.0 and CAMARA_common.yaml r0.4.0. In architectures where the AZ validates the request before it reaches the service API, x-correlator support may be required at the AZ level.

Questions

• Is x-correlator support required at all OIDC endpoints (e.g. GET /auth, POST /bc-authorize, POST /token)?
• Should the ICM documentation make a note about expected x-correlator behaviour for 401/403 service API responses?

[jpengar]

CAMARA defines the x-correlator header for CAMARA APIs calls as per https://github.com/camaraproject/Commonalities/blob/main/documentation/API-design-guidelines.md#9-architecture-headers.

However, the authentication flows follow the OAuth/OIDC/CIBA standards and have their own interface definitions, errors, headers, etc. I see no reason for ICM to require x-correlator header for the authentication flows endpoints just because it is defined for CAMARA APIs requests/responses.