Skip to main content

Helpdesk API Limitations

Audience​

Developers, product, QA, security, support and architects.

Summary​

The API is Transitional. These limitations are verified implementation gaps.

Reference Content​

Authentication​

  • No explicit authentication middleware is registered in Helpdesk startup.
  • Forwarded identity and tenant context rely on an unconfirmed trust boundary.

Authorization​

  • No route policies distinguish employee, requester, agent or administrator.
  • Diagnostic/report/outbox operations have no explicit authorization.
  • Outbox reads lack tenant query filtering.

Ticket lifecycle​

  • Generic status mutation has no transition matrix.
  • Canonical and compatibility reopen timestamp behavior differs.
  • No concurrency or idempotency controls are visible.

Assignment​

  • Supplied assignee identity is not validated or resolved.
  • No unassignment, queue/team or agent-eligibility API exists.

Validation​

  • Validation is distributed and error formats vary.
  • Internal comments, requester ownership and SLA reference identities are not fully validated.
  • Employee creation classification fields do not match canonical identifiers.

Gateway​

  • Employee listing adds no requester filter.
  • Employee creation body is forwarded without contract translation.
  • Shadow-route exposure and production ownership require confirmation.

Compatibility​

  • Permissive defaults can create reference data or accept unknown values.
  • Canonical and legacy-shaped contracts coexist without formal retirement metadata.

Versioning​

  • No explicit HTTP API versioning or deprecation strategy exists.

Testing​

  • No dedicated Helpdesk API automated tests were found.
  • Backfill verification does not cover HTTP security or lifecycle behavior.

Requires confirmation​

Release blockers, remediation priority, accepted residual risk and compatibility exit criteria require owner approval.

Source References​

  • microservices/src/helpdesk-service/Program.cs
  • microservices/src/helpdesk-service/Api/HelpdeskEndpoints.cs
  • microservices/src/helpdesk-service/Application/Common.cs
  • microservices/src/helpdesk-service/Infrastructure/HelpdeskDbContext.cs
  • microservices/src/gateway-api/Program.cs
  • microservices/src/gateway-api/EssEndpoints.cs
  • microservices/src/helpdesk-service/Infrastructure/DocumentServiceClient.cs

See Also​

Keywords​

Helpdesk API limitations, authorization gap, gateway gap, testing gap.

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Next review: 2026-10-20