Skip to main content

Recruitment API Authentication and Context

Summary​

Bearer authentication, tenant resolution, actor context, correlation, and gateway forwarding exist, but Recruitment endpoint authorization is not enforced.

Audience​

Developers, QA and support engineers, implementation partners, architects, and security reviewers working with Recruitment APIs.

Overview​

Confirmed context​

  • Bearer token validation is registered for configured signing sources.
  • Tenant context resolves tenant and actor evidence from claims or forwarded request context.
  • Correlation middleware accepts or creates correlation evidence.
  • EF Core global filters scope most tenant-owned entities.
  • Gateway proxying forwards request context to the selected owner.
  • Public routes use opening identifiers or opaque tokens rather than an authenticated tenant workflow.

The policy catalog is empty and mapped Recruitment endpoints do not call RequireAuthorization. Authentication middleware registration does not prove authorization enforcement. Diagnostics, callbacks, documents, compensation data, and compatibility routes therefore require explicit security review.

Requires confirmation​

Production exposure, authorization policy, ownership, compatibility parity, operational limits, and version governance require confirmation.

Source References​

  • microservices/src/recruitment-service/Program.cs
  • microservices/src/recruitment-service/Api/Policies.cs
  • microservices/src/recruitment-service/Infrastructure/Persistence.cs
  • microservices/src/shared-kernel/Middleware/CorrelationIdMiddleware.cs
  • microservices/src/gateway-api/Program.cs

See Also​

Keywords​

  • Recruitment API
  • Authentication and Context

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-16
  • Review cycle: Quarterly