I only found a little info on this in the official docs, but this Medium article was more helpful:
Like many AWS services, API Gateway also emits API Gateway-specific header. The response from REST API should have “x-amzn-requestid” which is UUID style request id and “x-amz-apigw-id” which is an extended request id. If the response doesn’t contain those headers, that means the request never reach the API Gateway DataPlane and the response came from somewhere else, like your proxy or API endpoint.
The official docs mention it briefly here:
As a best practice, include $context.requestId and $context.extendedRequestId in your log format. $context.requestId logs the value in the x-amzn-RequestId header. Clients can override the value in the x-amzn-RequestId header. API Gateway returns this request ID in the x-amzn-RequestId response header. $context.extendedRequestId is a unique ID that API Gateway generates. API Gateway returns this request ID in the x-amz-apigw-id response header. An API caller can't provide or override this request ID.
In summary:
- The presence of the header means the request made it to API Gateway
- The value of the header is an "extended request ID" value that maps back to
$context.extendedRequestId
on the back end for logging
- The value cannot be modified or overridden by the caller
Frankly the "apigw-id" part is a little confusing given its actual content/purpose.