# Evaluation API keeps returning a missing client id error from my curl test

Asked by Farah Qureshi on 2025-03-19. Tags: http-api, errors, cql.

Testing the Evaluation API before wiring it into our backend. This command
returns a problem response about a missing client id even though the API key is
definitely correct:

```shellcmd
curl -X POST https://api.croct.io/external/web/evaluate \
  -H "X-Api-Key: <my-key>" \
  -H "Content-Type: application/json" \
  -d '{"query": "user is returning"}'
```

The key works for other calls, so I assume the endpoint wants an additional
header identifying the user? Which one exactly, and what format does it expect.

## 1 answer

### Accepted answer from henrikd (2025-03-20)

Correct diagnosis. The API key identifies your application, but an evaluation
is always about a specific person, so the endpoint needs to know whose context
to evaluate the query against. You provide that with one of two headers:

- `X-Client-Id`: a UUID identifying the anonymous visitor, or
- `X-Token`: a JWT user token, for identified users.

For a curl smoke test the client ID route is easiest:

```shellcmd
curl -X POST https://api.croct.io/external/web/evaluate \
  -H "X-Api-Key: <my-key>" \
  -H "X-Client-Id: 5b9f6f7d-3f3c-4c5e-9d2a-1c8b7a6e5f4d" \
  -H "Content-Type: application/json" \
  -d '{"query": "user is returning"}'
```

Any valid UUID works for testing; in production you pass the visitor's actual
client ID so the evaluation runs against their real profile.

Unrelated to your current error but worth knowing while you are here: queries
must be 1 to 500 UTF-8 characters. Oversized ones fail with a separate
"Too complex query" error, so keep audience logic in named audiences rather
than inlining giant expressions.

#### Reply from Farah Qureshi (2025-03-20)

Added X-Client-Id and it evaluates correctly now. The 500 character note is
useful too, our audience queries were getting long. Thanks.