Skip to main content

Helpdesk API Authorization

Audience

Developers, security, QA, support and architects.

Summary

No Helpdesk route group or individual service operation declares an authorization policy. Startup does not invoke authorization middleware.

Reference Content

Frontend navigation uses feature, permission, role-alias and audience values, and protected routes apply client-side checks. Those checks can hide or block presentation routes but cannot authorize the downstream API.

No verified service checks distinguish employee, agent, administrator, requester, assignee or internal-comment privileges. Diagnostic, reporting and outbox reads have no route authorization in the reviewed service.

Requires confirmation

Per-operation policies, employee/agent/admin roles, requester ownership checks, diagnostic access and enforcement location require confirmation.

Source References

  • microservices/src/helpdesk-service/Program.cs
  • microservices/src/helpdesk-service/Api/HelpdeskEndpoints.cs
  • UI/salary-ui/apps/client-hrms-portal/src/components/AppLayout.tsx
  • UI/salary-ui/apps/client-hrms-portal/src/utils/ProtectedRoute.tsx

See Also

Keywords

API authorization, route policy, permission, role, access control.

Revision Information

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Next review: 2026-10-20