Skip to main content

API Authentication

Summary​

The portal client forwards its session credential on non-login calls. The gateway forwards request headers but does not authenticate requests. Recruitment registers bearer-token validation; its minimal API groups do not require authenticated users. HR Operations requires authentication at controller level.

Audience​

Developers, QA, support, security reviewers, and solution architects.

Authentication flow​

Boundary findings​

BoundaryVerified behavior
Portal clientAttaches the stored portal credential when available and handles unauthorized responses by clearing/redirecting the session
GatewayCopies headers and records routing metadata; no authentication middleware was found
Extracted RecruitmentRegisters validation for configured issuers, audiences, signing material, lifetime, name, and role claims
Recruitment minimal APIsNo required authenticated-user metadata is applied
Monolith Recruitment compatibilityInternal lifecycle actions require authentication; public offer actions explicitly allow anonymous access
HR OperationsController-level authentication applies to all exit and task actions
Employee direct APIsRecruitment does not forward a user credential; direct endpoint group has no required authentication metadata
Public offer linksLink possession identifies the offer; it is not user authentication

No credential values, key material, internal identity addresses, or example tokens are included in this documentation.

Requires confirmation​

  • Network controls protecting direct Recruitment and Employee service exposure.
  • Whether gateway authentication exists outside the inspected application pipeline.
  • Required expiry, replay, revocation, and rotation rules for public offer links.
  • Whether service-to-service employee calls require workload authentication in production.

Source References​

  • UI/salary-ui/packages/api-client/src/axiosConfig.ts
  • microservices/src/gateway-api/Program.cs
  • microservices/src/recruitment-service/Program.cs
  • microservices/src/recruitment-service/Api/Policies.cs
  • Controllers/RecruitmentController.cs
  • Controllers/HrOperationsController.cs
  • microservices/src/recruitment-service/Infrastructure/EmployeeServiceClient.cs
  • microservices/src/employee-service/Api/EmployeeDirectEndpoints.cs

See Also​

Keywords​

  • Credential forwarding
  • Public capability link
  • Required authentication

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Review cycle: Quarterly