---
title: Hosting pipeline
summary: Host model, server, ordered middleware pipeline, API versioning, OpenAPI exposure, health checks, and telemetry.
status: draft
owner: Architecture
last_reviewed: 2026-10-09
---

# Hosting pipeline

DBConnectionAPI runs on a generic host that uses `Startup : CoreAPIStartup` and is configured for IIS in-process hosting. A request first passes the two Swagger middleware components registered locally, then enters the opaque `base.Configure` call contributed by the `SAIF.NetCore.ServiceExtensions` package, which holds authentication, authorization, exception handling and endpoint mapping, before it reaches a controller action.

## Host model

| Field | Value |
| --- | --- |
| **Entry point** | `DBConnectionAPI/DBConnectionAPI/Program.cs` |
| **Host builder** | Generic host — `Host.CreateDefaultBuilder(args).ConfigureWebHostDefaults(webBuilder => webBuilder.UseStartup<Startup>())` |
| **Startup call chain** | `Main(args)` → `CreateHostBuilder(args).Build().Run()`; the generic host invokes `Startup.ConfigureServices` and `Startup.Configure` by convention, and `Program.cs` calls no method on the startup instance |
| **Host-builder extensions** | `.ConfigureOpenTelemetry(configure => configure.Owner = "Architecture")` — opaque, contributed by `SAIF.NetCore.ServiceExtensions` |
| **Startup type** | `Startup` (`DBConnectionAPI/DBConnectionAPI/Startup.cs`) |
| **Base class** | `CoreAPIStartup` (`SAIF.NetCore.ServiceExtensions` 10.2026.26267.1) |
| **Target framework** | `net10.0` |

### Base-class flags

| Flag or call | Value | Set in | Effect (as far as source shows) |
| --- | --- | --- | --- |
| `EnableSecureEnvironmentClient<Startup>()` | Called | `DBConnectionAPI/DBConnectionAPI/Startup.cs` (constructor) | Opaque — contributed by `SAIF.NetCore.ServiceExtensions`; the package documentation states it registers the secure `IEnvironmentClient` and must be called before `ConfigureServices`† |
| `EnableNewtonsoftJsonSerializer` | Not set | `DBConnectionAPI/DBConnectionAPI/Startup.cs` | Base default applies** |
| `DisableAuthServices` | Not set | `DBConnectionAPI/DBConnectionAPI/Startup.cs` | Base default applies, so the package authentication services and `UseAuthentication()` are active† |
| `WebHostEnvironment.EnvironmentName` | Not set | `DBConnectionAPI/DBConnectionAPI/Startup.cs` | No override from `AppSettings:ApplicationHost` in local source; any use is inside the base** |
| `base.ConfigureServices(services)` | First statement of `ConfigureServices` | `DBConnectionAPI/DBConnectionAPI/Startup.cs` | Opaque registrations precede local ones |
| `base.Configure(app, env)` | Last statement of `Configure`, after Swagger | `DBConnectionAPI/DBConnectionAPI/Startup.cs` | Opaque middleware follows Swagger |

## Server

| Aspect | Finding |
| --- | --- |
| Server | IIS in-process (ASP.NET Core Module V2) |
| Hosting model evidence | `<AspNetCoreHostingModel>InProcess</AspNetCoreHostingModel>` in `DBConnectionAPI/DBConnectionAPI/DBConnectionAPI.csproj`; `web.config` declares the `aspNetCore` handler with `AspNetCoreModuleV2` and no `hostingModel` attribute |
| `web.config` notes | The checked-in `processPath` references a Visual Studio launcher executable (`VSIISExeLauncher.exe`) and the file sets the environment variables `ENVIRONMENT`, `COMPLUS_ForceENC`, `ASPNETCORE_ENVIRONMENT`, `ASPNETCORE_HTTPS_PORT` and `ASPNETCORE_DETAILEDERRORS`; whether publish transforms the file is not visible in source** |
| Local launch profiles | None — `Properties/launchSettings.json` is absent |

## Middleware pipeline

| Order | Middleware | Registered in | Condition | Status | Notes |
| --- | --- | --- | --- | --- | --- |
| 1 | `app.UseSwagger()` | `DBConnectionAPI/DBConnectionAPI/Startup.cs` line 42 | Always (no environment guard) | Active | Serves the generated OpenAPI JSON before authentication runs* |
| 2 | `app.UseSwaggerUI(c => c.SwaggerEndpoint("{.\|..}/swagger/v1/swagger.json", "DBConnectionAPI"))` | `DBConnectionAPI/DBConnectionAPI/Startup.cs` lines 46-50 | Always | Active | Base path is `.` when `RoutePrefix` is blank, otherwise `..` |
| 3 | `base.Configure(app, env)` | `DBConnectionAPI/DBConnectionAPI/Startup.cs` line 51 | Always | Opaque | Contributed by `CoreAPIStartup` (`SAIF.NetCore.ServiceExtensions`) — not visible in source. Authentication, authorization, exception handling and endpoint mapping sit inside this call and their relative order is not visible in source |

No `UseExceptionHandler`, `UseDeveloperExceptionPage`, `UseCors`, `UseHealthChecks` or custom local middleware exists, and no middleware is commented out.

```mermaid
flowchart LR
    REQ["Request"] --> SRV["IIS in-process<br/>ASP.NET Core Module V2"]
    SRV --> M1["UseSwagger"]
    M1 --> M2["UseSwaggerUI"]
    M2 --> BASE["base.Configure<br/>opaque package pipeline"]
    BASE --> CTRL["Controller action"]
```

## API versioning

| Aspect | Finding |
| --- | --- |
| Package | None |
| Registration | None — no `AddApiVersioning` call |
| Default version | — |
| Assume default when unspecified | — |
| Report API versions | — |
| Version reader | — |
| Versioned API explorer | None |
| Versions declared | Literal `v1` route prefix only (`v1/Connections`, `v1/Admin` plus the action name) |

## API documentation surface

| Aspect | Finding |
| --- | --- |
| Generator | Swashbuckle `AddSwaggerGen` |
| State | Active in every environment (no `env.IsDevelopment()` guard) |
| Document(s) | One document, `v1` (`OpenApiInfo` title `DBConnectionAPI`) |
| Exposed route | `swagger/v1/swagger.json` and Swagger UI at `swagger`, relative to the application path* |
| XML comments | `IncludeXmlComments` with a path built from `AppContext.BaseDirectory` and a backslash separator; `<DocumentationFile>` is set, but the generated `DBConnectionAPI.xml` has an empty `<members/>` list because no `///` comments exist |
| Security definitions | None |
| Operation filters | None |
| Package and version | `Swashbuckle.AspNetCore` 6.4.0 |

## Health checks

| Aspect | Finding |
| --- | --- |
| ASP.NET Core health checks | None found — no `AddHealthChecks`, `MapHealthChecks` or `UseHealthChecks` |
| SAIF pingable registrations | None |
| Ping endpoint | Not determined from source** (any ping endpoint would be package-contributed and opaque) |

## Telemetry

| Aspect | Finding |
| --- | --- |
| OpenTelemetry | `.ConfigureOpenTelemetry(configure => configure.Owner = "Architecture")` on the host builder; behavior opaque |
| Application Insights | None found |
| Logging configuration | `appsettings.json` `Logging:LogLevel:Default` = `Warning`; `appsettings.Development.json` overrides `Default`, `System` and `Microsoft`. Whether `ISaifLogService` honours these levels is not visible in source** |
| Registered in | `DBConnectionAPI/DBConnectionAPI/Program.cs` |

> **Note:** Statements marked with `†` are derived from dependency library
> documentation via the Legends CLI. Statements marked with `*` were inferred
> from code structure or contextual evidence. Statements marked with `**` could
> not be confirmed; treat as unknown until verified.

## Related documentation
- [API index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Endpoints](endpoints.md)
- [Authentication and authorization](authentication-authorization.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Data model](data-model.md)
- [Operational runbook](operational-runbook.md)
- [Tech debt](tech-debt.md)

## Sources
- DBConnectionAPI/DBConnectionAPI/Program.cs
- DBConnectionAPI/DBConnectionAPI/Startup.cs
- DBConnectionAPI/DBConnectionAPI/DBConnectionAPI.csproj
- DBConnectionAPI/DBConnectionAPI/DBConnectionAPI.xml
- DBConnectionAPI/DBConnectionAPI/web.config
- DBConnectionAPI/DBConnectionAPI/appsettings.json
- DBConnectionAPI/DBConnectionAPI/appsettings.Development.json