1)You suggest we should attach clientSessionId HTTP header; how do you understand a “session”? Is this the time a specific token authorization is valid?
2. Note we already set a header named Authorization with value Token xxx where xxx is the value we receive from your endpoint /Authentication/RequestToken ; is this not sufficient and you want our client to send a different unique identifier?
3. Do you want to be able to identify each REST API call our REST client is doing with its own, unique request id? Then clientSessionId is not the best name - it suggests the value is the same for the duration of some session, but it will be different for each request; therefore I suggest “clientRequestId” header name.