What is a correlation ID?¶

A correlation ID is a value used to link records that relate to the same wider operation, request, transaction or workflow.

It helps investigators follow activity across several components without relying only on time.

Avoid this assumption: That matching correlation IDs automatically prove that every linked record was caused by the same person or action. They do not.

A system may assign one correlation ID when a request begins and pass it through several services. Authentication, application, database and response logs may all contain the same value.

That can be extremely useful. It may show that several technical events formed part of one processing chain, even where they were recorded on different servers.

But the scope depends on the system. A correlation ID may be reused within a session, generated by a client application or absent from some components. Errors, retries and parallel processing can also produce additional IDs.

A matching value shows a designed technical relationship, not personal attribution. The linked records may have been generated by an automated process, service account, API or compromised session.

Investigators should ask which system created the correlation ID, how long it remains valid and which components are expected to copy it. Preserve all linked identifiers and surrounding events.

Check whether the value is unique or only unique within a tenant, application or time period. Do not confuse it with a session ID, event ID or request ID unless the system documentation says they are equivalent.

Operational takeaway¶

A correlation ID can link technical records across a shared workflow, but its scope, uniqueness and relationship to the initiating user or process must be established.