access_token=$(echo $res_21 | jq .access_token) # Aus dem letzten Request besorge ich mir das access token, das in Zukunft bei jedem Request als Header gesetzt werden muss.

curl -X POST ... -H "Authorization:Bearer "$access_token"" # Ich setze das Token im Header ein.

> GET /api/session/clients/user/v1/sessions HTTP/1.1
> Host: api.comdirect.de
> User-Agent: curl/7.58.0
> Accept:application/json
> Authorization:Bearer%20<mein_token>    # Yeah, token endlich drinnen und keine blöden Quotes mehr drumrum
> x-http-request-info:{"clientRequestId":{"sessionId":"<meine_session_id","requestId":"<meine_request_id"}}
> Content-Type:application/json
> 
{ [5 bytes data]
< HTTP/1.1 401 401
< Date: Sun, 05 Apr 2020 08:39:56 GMT
< Server: Apache
< Set-Cookie: qSession=***; path=/; domain=.comdirect.de
< Strict-Transport-Security: max-age=31536000; includeSubDomains
< X-Frame-Options: SAMEORIGIN
< Cache-Control: no-store
< Pragma: no-cache
< WWW-Authenticate: Bearer realm="api", error="invalid_token"
< Content-Type: application/json;charset=UTF-8
< X-Content-Type-Options: nosniff
< Transfer-Encoding: chunked
< 
{ [5 bytes data]
* Connection #0 to host api.comdirect.de left intact
{"error":"invalid_token","error_description":null}       # Fuck this

Beispiel Header:
Accept:application/json
Authorization:Bearer 1234567890__Access-Token__1234567890
x-http-request-info:{"clientRequestId":{"sessionId":"123_beliebige_ID_fuer_Session_12","requestId":"123456789"}}
Content-Type:"application/json"

{"error":"unauthorized","error_description":"An Authentication object was not found in the SecurityContext"}

cmd="curl -s -o /dev/null -s -w "%{http_code}" \
    -H Accept:application/json \
    -H Authorization:%20Bearer%20"$access_token"TOKEN \
    -H x-http-request-info:{\"clientRequestId\":{\"sessionId\":\"$sessionId\",\"requestId\":\"$requestId\"}} \
    -H Content-Type:application/json \
    $api_prefix_complete/session/clients/user/v1/sessions"
  cmd=$(echo $cmd | sed 's/Authorization:%20Bearer%20"/\Authorization:%20Bearer%20/')
  cmd=$(echo $cmd | sed -e 's/"TOKEN//')
  res_22=$($cmd)
  echo $res_22

curl -i \
-H 'Accept:application/json' \
-H 'Content-Type:application/json' \
-H 'Authorization: Bearer '"$access_token" \
-X POST ...

cmd="curl -i -v \
    -H 'Accept:application/json' \
    -H 'Authorization: Bearer $access_token' \
    -H 'x-http-request-info:{\"clientRequestId\":{\"sessionId\":\"$sessionId\",\"requestId\":\"$requestId\"}}' \
    -H 'Content-Type:application/json' \
    $api_prefix_complete/session/clients/user/v1/sessions"

curl -i -v 
-H 'Accept:application/json' 
-H 'Authorization: Bearer <MEINTOKEN>' 
-H 'x-http-request-info:{"clientRequestId":{"sessionId":"<SESSIONID>","requestId":"<REQUESTID>"}}' 
-H 'Content-Type:application/json' https://api.comdirect.de/api/session/clients/user/v1/sessions

* Closing connection 0
curl: (6) Could not resolve host: Bearer
* Rebuilt URL to: <hier_steht_jetzt_mein_token_drinnen>'/
* Could not resolve host: <hier_steht_jetzt_mein_token_drinnen>'
* Closing connection 1
curl: (6) Could not resolve host: <hier_steht_jetzt_mein_token_drinnen>'
*   Trying 193.41.133.19...
* TCP_NODELAY set
...

> GET /api/session/clients/user/v1/sessions HTTP/1.1
> Host: api.comdirect.de
> User-Agent: curl/7.58.0
> Accept: */*
> 'Accept:application/json'
> 'x-http-request-info:{"clientRequestId":{"sessionId":"<SESSIONID>","requestId":"<REQUESTID>"}}'
> 'Content-Type:application/json'
> 
{ [5 bytes data]
< HTTP/1.1 400 400

{"code":"request.header.invalid","messages":[{"key":"request.header.invalid.x-http-request-info","severity":"ERROR","message":"Der Header 'x-http-request-info' ist fehlerhaft."}]}

curl -i -s -H ''\''Accept:application/json'\''' -H ''\''Authorization:' Bearer 'MEINTOKEN'\''' -H ''\''x-http-request-info:{"clientRequestId":{"sessionId":"MEINESESSION","requestId":"MEINEREQUESTID"}}'\''' -H ''\''Content-Type:application/json'\''' https://api.comdirect.de/api/session/clients/user/v1/sessions