At the moment if the user accesses a modelled API and such endpoint requires application role that user doesn’t have, the server responds with 200 and it doesn’t return any data or executes workflow.
I believe that this might might be confusing for the other party and that the server should respond with 403.
That used to work. We had an issue whether to return 404 or 403 but it did not return 200.
How is it possible that it returns 200? Either it finds the valid endpoint and executes it or it finds an endpoint with matching routing but with a wrong role and returns 403 or skips any endpoints that do not match and ends up with nothing, thus returning 404.
The problem with 403 is that we could in theory model several endpoints with same routing but different (exclusive) roles. Then it would be incorrect to end the loop and return 403. But that is solvable (marking that there was a matching endpoint and if we do not find any valid endpoints later, return 403 instead of 404).
Thanks for the insight. I’ll investigate the behaviour further. So far it was just observation I made during modelling of new API.