Skip to main content

Authentication and Request Context

Summary​

Bearer authentication, tenant and actor context, correlation, and authorization evidence.

Audience​

API consumers, engineers, architects, QA, support, security reviewers, implementation partners, and product owners.

Overview​

Startup registers bearer authentication, authorization services, their middleware, and correlation middleware. Tenant and actor context can be resolved from authenticated claims or forwarded request context.

Endpoint family​

  • Missing required tenant context on write paths becomes a Bad Request response.
  • Global query filters apply tenant context to cycles, appraisals, goals, reviews, audit, and timeline.
  • Actor context supplies user, labor, email, role, and super-administrator signals where source code consumes them.
  • Correlation context is accepted or generated, added to request state and logging scope, and returned in the response.
  • No native or compatibility endpoint calls RequireAuthorization.
  • No Performance endpoint is explicitly marked public; its current reachability follows the absence of authorization endpoint metadata.

Classification​

Transitional: authentication and tenant isolation are confirmed, while endpoint authorization is Not implemented.

Authentication and authorization​

Bearer authentication and tenant context are registered. No Performance endpoint in this family declares an authorization requirement unless explicitly stated above.

Requires confirmation​

Gateway trust, forwarded-context validation, permission mapping, subject ownership, callback authentication, and direct-access policy require confirmation.

Diagram​

See Also​

Keywords​

  • Performance API
  • Authentication and Context
  • Draft API documentation

Source References​

  • microservices/src/performance-service/Program.cs
  • microservices/src/performance-service/Infrastructure/Persistence.cs
  • microservices/src/shared-kernel/Middleware/CorrelationIdMiddleware.cs
  • microservices/src/performance-service/Api/PerformanceEndpoints.cs

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-16
  • Review cycle: Quarterly