Building HTTP Web APIs That Other Apps Call
View All Tags
[Required] and [Range] cover a lot, but not everything. A price in a decimal(12,2) column must be 0 or more, must fit, and must have at most two decimal places, or MySQL rounds it without an error. A custom attribute puts that rule in one class, about ten lines long, that you can use anywhere.
Before .NET 10, minimal APIs didn't check data annotations: you needed a filter or a library. Now one line in Program.cs does it. Put [Required] and [Range] on your request record, and a bad request gets a 400 with every problem listed, before your handler runs. This guide adds it, with the same requests before and after.
Out of the box, an ASP.NET Core API's errors are all different: an empty 404, a stack trace as plain text in Development, and a blank 500 in Production. Problem details is the standard JSON format for errors, and three lines in Program.cs give every failure that one shape. This guide adds them, with the real responses before and after.
Results.Ok(x) and TypedResults.Ok(x) put the same response on the wire. The difference is what the rest of your app can see before the request happens. With TypedResults and a declared return type, the OpenAPI document knows every status and body your endpoint can return, without any extra code. Here are both versions of one endpoint, and the documents they produce.
When a POST creates something, the right answer isn't a plain 200 OK. It's 201 Created, with a Location header that says where the new thing lives, and usually the new thing in the body. ASP.NET Core minimal APIs have two ways to do it. This guide shows both, with the real responses.
A minimal API starts with everything in Program.cs, and that stops being pleasant after a few endpoints. The fix uses plain C#: a static class with an extension method that maps the routes, and private methods for the handlers. There's no framework to learn. Program.cs then only says which features exist.
When every endpoint in a minimal API starts with /api/v1/categories, the prefix gets typed five times and is easy to get wrong once. MapGroup writes it down one time. Everything in the group shares the prefix and any settings you put on the group, and groups can sit inside groups. This guide does that on a real .NET 10 API.
Add a CancellationToken parameter to a minimal API endpoint, pass it to EF Core, and the work can stop when the client goes away. That's the idea, so I measured what it does on MySQL with Oracle's connector. The token fires, and the next step stops. A statement that's already running keeps going until it ends, so the token isn't a substitute for a command timeout.
In ASP.NET Core you ask for a DbContext, and one appears. Which one? Each HTTP request gets its own, shared by everything in that request, and it's disposed of when the request ends. This guide proves that with real IDs, and explains what the rule means for code that lives outside a request.
When a unique index refuses a value, EF Core throws an exception, and your API answers 500. But nothing broke: the client asked for something that already exists, and 409 Conflict is the right answer. This guide reads MySQL's error number from the exception, and catches only that error, with a small helper you can reuse.
