Asset API Authentication and Authorization
Pipeline
Bearer authentication accepts the configured JWT issuer/key families and maps email and role claims. Authentication and authorization services and middleware are registered. No Asset route calls RequireAuthorization, attaches a policy, or declares a role requirement.
Therefore valid identity may populate tenant and actor context, but authentication is not required by endpoint metadata. No explicitly anonymous marker was added either; the routes are effectively accessible without an authorization requirement. Unauthorized response behavior is middleware capability, not a verified Asset endpoint outcome. Fine-grained roles, resource ownership, document access policy, and workflow-callback caller authentication are Not implemented.
Classification
The API is Transitional. Capabilities explicitly described as absent are Not implemented. Host diagnostics and evidence routes are Foundation. Production exposure, ownership, and governance Require confirmation.
Source References
microservices/src/asset-service/Program.csmicroservices/src/asset-service/Api/AssetEndpoints.csmicroservices/src/asset-service/Api/AssetCompatEndpoints.cs