API Architecture Overview
Summary
Onboarding APIs are split across native Recruitment minimal APIs and a gateway-selectable compatibility surface. Offboarding and generic checklist operations remain controller APIs in the monolith. Extracted completion calls Employee Service synchronously.
Audience
Developers, QA, support, security reviewers, and solution architects.
API architecture
Ownership
| Boundary | Owner | Maturity |
|---|---|---|
| Native offer acceptance and onboarding | Recruitment Service | Implemented foundation |
| Public token offer response | Recruitment Service or monolith compatibility target | Transitional |
| Portal-shaped onboarding | Gateway-selected compatibility implementation | Transitional |
| Employee initialization | Recruitment client to Employee Service | Partial |
| Exit request and access revoke | Monolith HR Operations | Implemented controller boundary |
| Generic onboarding task | Monolith HR Operations | Foundation |
| Lifecycle workflow callback | No dedicated operation found | Not implemented |
| Lifecycle notification HTTP call | No dedicated operation found | Not implemented |
Runtime exposure
The gateway explicitly routes the portal-shaped Recruitment family to either the monolith or extracted service. HR Operations exit traffic stays on monolith routing. Native Recruitment operations are reachable through direct/shadow service exposure when that deployment route is enabled. The gateway records route-source and correlation metadata but does not add authentication or authorization.
Current maturity
The API is Transitional. Compatibility preserves route shapes, not side-effect parity. Extracted minimal APIs register authentication but apply no endpoint authorization requirement. The monolith lifecycle controllers use action or controller authorization and business permission checks.
Requires confirmation
- Which direct and shadow surfaces are exposed in each environment.
- Target ownership and retirement criteria for monolith Recruitment compatibility.
- Whether offboarding will receive an extracted API boundary.
- Security controls outside the inspected gateway and service code.
Source References
microservices/src/recruitment-service/Program.csmicroservices/src/recruitment-service/Api/RecruitmentEndpoints.csmicroservices/src/recruitment-service/Api/RecruitmentCompatEndpoints.csControllers/RecruitmentController.csControllers/HrOperationsController.csmicroservices/src/gateway-api/Program.csmicroservices/src/recruitment-service/Infrastructure/EmployeeServiceClient.cs
Related Articles
See Also
Keywords
- API ownership
- Minimal APIs
- Compatibility routing
Revision Information
- Status: Draft
- Last reviewed: 2026-07-20
- Review cycle: Quarterly