---
title: Expose the header in Swagger UI when debugging
summary: Adds an OnBehalfOfUser header parameter to Swagger UI only when a debugger is attached at startup.
status: draft
owner: SAIF Platform Team
last_reviewed: 2026-10-02
library: SAIF.NetCore.NtlmApiAuth
reference_type: package
operation_id: OP-11
trigger: Swagger configuration (startup)
---

# Expose the header in Swagger UI when debugging

Registers a Swagger operation filter that adds an `OnBehalfOfUser` header parameter to every operation, but only when `Debugger.IsAttached` is true at the moment Swagger options are configured.

| Field | Value |
| --- | --- |
| **Operation ID** | OP-11 |
| **Trigger** | Swagger configuration (startup) |
| **Inputs** | `System.Diagnostics.Debugger.IsAttached` |
| **Outputs** | Operation filter registered (or not) |
| **Primary components** | `SwaggerGenOptionsExtensions.AddDebuggerOnBehalfOfHeader()`, `OnBehalfOfUserHeaderParameterFilter.Apply` |
| **Entry point** | `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/SwaggerGenOptionsExtensions.cs` |

## Steps

1. At configuration time, check `Debugger.IsAttached`; if true, register the operation filter. ([BR-NTLM-014](../business-rules.md#br-ntlm-014-swagger-header-only-shown-when-debugging))
2. Per operation (when the filter is registered), ensure `operation.Parameters` exists and append a header parameter named `OnBehalfOfUser` (not marked required, no schema).

## Process flow

```mermaid
flowchart TD
	Start([Swagger configuration]) --> S1{Debugger.IsAttached?}
	S1 -->|No| End([Filter not registered])
	S1 -->|Yes| S2[Register OnBehalfOfUserHeaderParameterFilter]
	S2 --> S3["Per operation: append OnBehalfOfUser header parameter"]
	S3 --> End2([Swagger UI shows the header])
```

## Failure and edge-case behavior
- The decision is made once, at startup; attaching a debugger afterward does not retroactively enable the filter.
- Hiding the header from Swagger UI in non-debug environments does not stop the server from honoring the header — it is documentation-only, not a control.

## Related documentation
- [Operations and processes](../operations-processes.md)
- [Business rules](../business-rules.md)

## Sources
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Extensions/SwaggerGenOptionsExtensions.cs`
- `src/SAIF.NetCore.NtlmApiAuth/src/SAIF.NetCore.NtlmApiAuth/Swagger/OnBehalfOfUserHeaderParameterFilter.cs`