---
title: SAIF.NetCore.HttpClients dependencies
summary: Internal and external dependencies for this library.
status: draft
owner: Framework
last_reviewed: 2026-10-02
library: SAIF.NetCore.HttpClients
reference_type: package
---

# SAIF.NetCore.HttpClients dependencies

SAIF.NetCore.HttpClients depends on a single internal package for its implemented contracts and on two RestSharp packages (plus Newtonsoft.Json directly) for the HTTP transport and JSON serialization it wraps; because every request target is caller-supplied, the library makes no SAIF web API calls of its own and has no API dependencies to document.

## Internal dependencies

| Dependency | Reference Type | Usage |
| --- | --- | --- |
| [SAIF.NetCore.ServiceContracts](../saif-netcore-servicecontracts/overview.md) | NuGet Package (same-repo) | Implements `IHttpJsonClient` and `IHttpRequestResult`; consumes the `HttpClientOptions` and `HttpClientSerializer` option types |

## External dependencies

| Dependency | Version | Usage |
| --- | --- | --- |
| RestSharp | 106.11.7 | Core HTTP transport: `RestClient`, `RestRequest`, `IRestResponse`, `NtlmAuthenticator`, `JsonDeserializer` |
| RestSharp.Serializers.NewtonsoftJson | 106.11.7 | Supplies `UseNewtonsoftJson()` on the RestSharp client when `HttpClientOptions.Serializer == NewtonsoftJson` |
| Newtonsoft.Json | 13.0.1 | `JsonConvert` and `JToken` parsing used in error-content extraction and `ToReturnType<T>` result conversion |

## Dependency risks and notes
- RestSharp 106.11.7 is several majors behind the current RestSharp release line, and its transitive HTTP-stack dependencies are not independently verified here*.
- A new `RestClient` is created for every call and retry attempt, and retries block a thread-pool thread with `Thread.Sleep` rather than an asynchronous delay — a performance and scalability risk under load.
- `HttpJsonClient` carries mutable per-instance state (`RequestResult`, `Headers`, bearer token) while being registered `Transient` by `SAIF.NetCore.ServiceExtensions`; sharing an instance across concurrent requests is unsafe.
- Every target URL is caller-supplied at request time, so this library hard-codes no fixed SAIF web API endpoint of its own; Newtonsoft.Json remains a direct, genuinely used external dependency for error-content parsing and result conversion.
- Basic auth and bearer credentials can be sent over a plain `http://` base URL because no scheme check exists, and 401 is a default retry status, so credentials may be resent on failure — see the library's security and authorization findings for the full risk discussion.

## Related documentation
- [Index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Security and authorization](security-authorization.md)
- [API reference](api/index.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming
> conventions, or contextual evidence where direct confirmation was not available
> in source artifacts.

## Sources
- `src/SAIF.NetCore.HttpClients/SAIF.NetCore.HttpClients/SAIF.NetCore.HttpClients/SAIF.NetCore.HttpClients.csproj`
- `src/SAIF.NetCore.HttpClients/SAIF.NetCore.HttpClients/SAIF.NetCore.HttpClients/HttpJsonClient/HttpJsonClient.cs`
- `Architecture.md`