Skip to main content

Workflow API Authentication

Summary​

A bearer authentication handler is configured, and authentication middleware runs. No reviewed Workflow route requires an authenticated principal.

Configuration behavior​

Token lifetime validation is enabled. Issuer, audience and signing-key validation are enabled only when corresponding configured values are present. Two configured identity-key families can contribute signing keys. Email and role claims are selected for caller context.

Endpoint behavior​

The native route group, shared health and service-information operations have no authentication requirement metadata. Consequently an anonymous principal can reach handlers when network access permits.

OpenAPI​

Swagger generation is registered, but no verified security requirement is attached to Workflow operations.

Requires Confirmation​

Mandatory production token settings, external ingress authentication and OpenAPI authentication metadata require confirmation.

Source References​

  • microservices/src/workflow-service/Program.cs
  • microservices/src/workflow-service/Api/WorkflowEndpoints.cs

See Also​

Keywords​

Workflow API, approval endpoint, Workflow Service.

Revision Information​

  • Status: Draft
  • Last reviewed: 2026-07-20
  • Next review: 2026-10-20