# ASP.NET Core Minimal APIs on .NET 10

`aspnet-core/minimal-apis` · Skill · v1.0.0

Validation, problem details, deny-by-default auth and cookie 401s for ASP.NET Core minimal APIs on .NET 10, measured on 10.0.14.

Teaches an agent the current ASP.NET Core minimal API stack on .NET 10 (10.0.14 LTS, SDK 10.0.403) and the .NET 6-8 habits that quietly misbehave on it: built-in validation with AddValidation (and that DataAnnotations do nothing without it), nested and collection error paths with PascalCase keys, IValidatableObject running only after property rules pass, the per-assembly source generator that silently skips endpoints and types in feature-module class libraries, Validator.TryValidateObject ignoring record parameter attributes, TypedResults unions, RFC 9457 problem details and exception handling that never leaks internals, fallback authorization policies, the .NET 10 cookie change that returns 401/403 only for endpoints it recognises as APIs (Results.*, strings and text results still redirect), antiforgery for form endpoints, and WebApplicationFactory tests with xunit v3 on Microsoft.Testing.Platform. Every behavioural claim marked measured was run on 10.0.14.

## Verdict

- level: **submitted** — In the catalog, not yet checked for this digest.
- uplift: **untested** — No runs exist for this digest.
- digest: `sha256:f4b0f790e7f6b2605a157c2c4870e6e02fd198a96d17082d1190c64a053eba8b`

## Uplift runs

None for this digest. Untested is not the same as useless: nobody has measured it yet.

## Security

No checks recorded for this digest.

## Compatibility

| agent | targeted | compiled | evaluated |
| --- | --- | --- | --- |
| Claude Code | yes | no record | no record |
| Codex | yes | no record | no record |
| Cursor | yes | no record | no record |
| GitHub Copilot | yes | no record | no record |
| Gemini CLI | yes | no record | no record |
| OpenCode | yes | no record | no record |

## Permissions

- network: none
- shell: dotnet, grep
- filesystem: write
- env: none

## Files

- `SKILL.md` 14623 B sha256:2aed9c944db36e4def4cc6317154b1ca4ecaeb16fe5bda67cf49b29e0181440b
- `references/auth.md` 5839 B sha256:0f654a7a6bca633bb56c97904058296a11dedb68dfa2e1130481788e91b9727a
- `references/errors-and-results.md` 4449 B sha256:152e5c7cd49eb91823e6fa0e9c3fb283e2954d6fea246826e8b496dad75819c0
- `references/sources.md` 6266 B sha256:85592d085e4126a6b897a98231d21955bbc221e6fdf72ac9ae334f5b0b54ed82
- `references/testing.md` 3405 B sha256:9624813be99f53167af4643cafd2c357922d7999ccd89620f5ba3f149f6d8b4d
- `references/validation.md` 6881 B sha256:56ad5e80b2bfde14fe803f060c5b7eaf46645994a3b273413e2b861c64e61136

## Limitations

- Written and measured against .NET 10.0.14 (SDK 10.0.403). .NET 11 changes validation (async rules, localization, non-experimental attributes) and is not covered.
- Covers minimal APIs. MVC controllers, Razor Pages and Blazor forms validate differently and are only mentioned where behaviour is shared.
- Authentication coverage is cookie-centred; JWT bearer, OpenID Connect and ASP.NET Core Identity endpoints get short notes only.
- OpenAPI document generation, rate limiting, output caching and Native AOT are out of scope.
- The proof suite runs through TestServer, so it measures HTTP behaviour but not Kestrel-specific limits, HTTPS or reverse-proxy headers.

## Install

```sh
npx sigil add aspnet-core/minimal-apis --agent claude-code,codex,cursor
```

Source: https://github.com/dgesteves/sigil/tree/5cb851d5b2f2f14446ddf631ef5e91bf9d3263dd/catalog/skills/aspnet-core/minimal-apis