Building HTTP Web APIs That Other Apps Call
View All Tags
A race condition doesn't show up when you send one request at a time. You need several at the same moment, and you don't need a load-testing tool: curl with xargs does it on macOS and Linux, and ForEach-Object -Parallel does it in PowerShell. Then check what's in the database, because the status codes alone can look fine.
Attributes check one value at a time. When a rule involves more than that, such as "no product twice in one order", or "this number can be anything except 0", put it on the request itself with IValidatableObject. AddValidation calls it, and the error comes back in the same format as the others.
An order has a list of lines, and two things can be wrong with it: the list itself, and any one of its items. AddValidation in .NET 10 checks both, and it tells the client exactly which item is wrong.
By default, an enum in a minimal API's JSON is a number, and "type": 0 tells a reader nothing. One line in Program.cs makes every endpoint use the names, in both directions. It's worth knowing exactly what it accepts on the way in, too.
An IExceptionHandler is one class that decides what clients see when an exception escapes an endpoint. It answers the ones it recognises, and leaves everything else alone. Here's a complete one, and the setting I add since .NET 10.
When MySQL is down, or a row is locked for too long, a 500 tells the client that your code has a bug and there's no point trying again. 503 Service Unavailable with Retry-After says the truth: not now, come back in a few seconds. An exception handler does it in one place, for the whole API.
To read a request header in a minimal API, add a parameter with [FromHeader]. One detail decides how it behaves: string? makes the header optional, and string makes it required, with a 400 if it's missing.
A client that gets no answer can't tell whether its POST worked. If it tries again, you can get two orders. An Idempotency-Key header fixes that: the client sends the same key each time, and the second request gets back what the first one made.
A request without my header got a 400 Bad Request with an empty explanation, and my endpoint never ran. The log had the reason: Required parameter "string source" was not provided from header. One ? decides whether a header is required.
GET /orders?status=99 didn't fail. My enum has three members, and the endpoint happily ran with status 99, which then filters to nothing, with no sign that the request was wrong. .NET's enum parsing allows this on purpose, so the check is yours to add.
