Skip to main content

Expense API Authentication and Context

Summary​

Authentication middleware accepts supported bearer identities and resolves tenant/actor context from authenticated or forwarded request context. Tenant-scoped persistence filters apply to claims, receipt references, audit, and timeline; commands that require tenant context fail when it is absent.

Audience​

API consumers, backend and frontend developers, QA, architects, implementation partners, and support.

Reference Content​

Authentication middleware accepts supported bearer identities and resolves tenant/actor context from authenticated or forwarded request context. Tenant-scoped persistence filters apply to claims, receipt references, audit, and timeline; commands that require tenant context fail when it is absent.

The reviewed endpoint groups do not attach explicit operation-level authorization requirements. Therefore authentication registration must not be represented as complete authorization. Claimant self-scope is confirmed only for a limited Pending deletion rule. Approver, Paid-state, receipt, evidence-read, callback, and privileged scope Require confirmation.

Clients must send credentials and tenant context only through approved gateway mechanisms. This documentation intentionally omits claim/header names and trust configuration.

Source References​

  • microservices/src/expense-service/Program.cs
  • microservices/src/expense-service/Infrastructure/Persistence.cs

See Also​

Keywords​

  • Expense API
  • Authentication and Context

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-16
  • Review cycle: Quarterly