Are there any situations besides API requests in which we wouldn't have a CID?

When we don't have a CID could this be something less opaque like the string "API_CID" or maybe a digest of auth information from the API request?