RTS Questionnaire · Question 37 of 52 · file: answers/q37.html
Have you worked with API versioning, authentication/authorization, exception handling, validation, logging, and observability in .NET APIs?
.NETAPIObservability
✅ Yes — these cross-cutting concerns are standard parts of every .NET API I deliver.
🧪 Interactive proof: this answer has its own page with a live cross-cutting workflow, the composition root, the exception handler and the observability configuration behind it — open the Q37 API cross-cutting proof →
Technical detail
- 🔢 Versioning — URL segment, header and media-type versioning strategies; deprecated versions documented in OpenAPI with sunset headers; additive contracts and DTO evolution so consumers (Angular/React clients, partners) upgrade without breaking.
- 🔐 Authentication / Authorization — JWT bearer tokens validated against OIDC providers, policy- and claim-based authorization, role/permission checks at endpoint level, API keys for partners, CORS allow-lists and rate limiting/throttling.
- 🧯 Exception handling — global exception middleware mapping domain exceptions to RFC 7807
ProblemDetailswith stable error codes and correlation IDs; no stack traces leaked in production; deliberate retry semantics for transient failures. - ✔️ Validation — model/attribute validation plus FluentValidation-style rules for business constraints, custom validators, structured validation problem responses, and validation at the edge of the domain so invalid state is never persisted.
- 📝 Logging and observability — structured logging (Serilog/ILogger) with correlation IDs, log levels per environment, sensitive-data redaction; health and readiness endpoints; metrics, distributed tracing and dashboards with alerting (Application Insights, CloudWatch, Prometheus/Grafana).
🧪 All of it is verified by tests: contract, authorization (401/403), validation and error-shape tests in CI, plus load checks on the hot paths before release.
🧾 CV evidence: CV .NET/REST API delivery with Dependency Injection and testing (NUnit/MSTest); 2025 DMS .NET assessment with Swagger + JWT; AWS/Azure observability stack (CloudWatch, CloudTrail, Azure Monitor/Application Insights) in the CV cloud sections.