---
title: Authentication and authorization
summary: Identity establishment, authorization enforcement, and per-endpoint access requirements for PdfAPI.
status: draft
owner: Not determined from source
last_reviewed: 2026-09-17
library: PdfAPI
reference_type: embedded
---

# Authentication and authorization

**No authentication or authorization construct exists in PdfAPI's application code.** This is an explicit finding, verified by an exhaustive scan across `PdfAPI\`, `PdfAPI.Core\`, and `PdfApi.SyncFusionCore\`, not a gap in analysis coverage.

## Authentication

| Aspect | Finding |
| --- | --- |
| Mechanism | None found in code |
| Established by | Not applicable — no authentication construct is present in application code |
| Identity type | — |
| Configured in | `PdfAPI\Web.config` declares no `<system.webServer><security><authentication>` element |
| Anonymous access | Allowed — `Pipelines\build-vars.yml` provisions the IIS site with `IISWindowsAuth: true` **and** `IISAnonymousAuth: true`; with anonymous authentication enabled and no application-layer authorization, the endpoints are reachable without an authenticated caller* |

## Authorization enforcement

| Mechanism | Scope | Declared in | Effect |
| --- | --- | --- | --- |
| None in code | — | — | Every routed request reaches the action; access relies entirely on network / IIS controls |

The following constructs were searched for across the whole solution closure and returned **zero matches**: `[SaifAuthorize`, `[Authorize`, `[AllowAnonymous`, `ApiUser(`, `systemHashValue`, `IsInRole`, `IsAuthorized`, `HasAccess`, `CheckAccess`, `PrincipalContext`, `GroupPrincipal`, `DirectorySearcher`, and any WCF `SecurityService` integration.

## Access requirements by endpoint

| Endpoint | Requirement | Enforced by | On failure |
| --- | --- | --- | --- |
| [`POST v1/convert`](endpoints/convert-controller.md#post-v1%2Fconvert) | None in code | — | Request proceeds |
| [`POST v1/convert/{fileExtension}`](endpoints/convert-controller.md#post-v1%2Fconvert%2F%7Bfileextension%7D) | None in code | — | Request proceeds |
| [`POST v1/extract`](endpoints/extract-controller.md#post-v1%2Fextract) | None in code | — | Request proceeds |
| [`POST v1/merge`](endpoints/merge-controller.md#post-v1%2Fmerge) | None in code | — | Request proceeds |
| [`GET v1/legacy/download/{trackingId}`](endpoints/legacy-controller.md#get-v1%2Flegacy%2Fdownload%2F%7Btrackingid%7D) | None in code | — | Request proceeds |
| [`GET v1/info/track/{trackingId}`](endpoints/info-controller.md#get-v1%2Finfo%2Ftrack%2F%7Btrackingid%7D) | None in code | — | Request proceeds |
| [`POST v1/info/pages/count`](endpoints/info-controller.md#post-v1%2Finfo%2Fpages%2Fcount) | None in code | — | Request proceeds |
| [`POST v1/info/fields/exist`](endpoints/info-controller.md#post-v1%2Finfo%2Ffields%2Fexist) | None in code | — | Request proceeds |
| [`POST v1/info/fields/flatten`](endpoints/info-controller.md#post-v1%2Finfo%2Ffields%2Fflatten) | None in code | — | Request proceeds |
| [`POST v1/info/validate`](endpoints/info-controller.md#post-v1%2Finfo%2Fvalidate) | None in code | — | Request proceeds |
| [`POST v1/info/validate/pdfa`](endpoints/info-controller.md#post-v1%2Finfo%2Fvalidate%2Fpdfa) | None in code | — | Request proceeds |
| [`POST v1/info/version`](endpoints/info-controller.md#post-v1%2Finfo%2Fversion) | None in code | — | Request proceeds |
| [`GET buildVersion`](endpoints/api-info-controller.md#get-buildversion) | None in code | — | Request proceeds |

## Secrets handling

| Secret | Retrieved by | Consumed by | Notes |
| --- | --- | --- | --- |
| Syncfusion license key | Hard-coded string literal (not retrieved via `GetSecureConfigSetting`) | `PdfApi.SyncFusionCore\LicenseHelper.cs` | Committed to source control — see [Tech debt](tech-debt.md) |

`GetSecureConfigSetting` is not called anywhere in this repository (Verified — zero matches across `PdfAPI\`, `PdfAPI.Core\`, `PdfApi.SyncFusionCore\`). No credential, encrypted setting, or crypto-hash-gated configuration is retrieved by this application.

## Security rules

No authorization construct exists in code, so no `SEC-API-` rule is catalogued here. The absence itself is recorded in [Authorization enforcement](#authorization-enforcement) above and in [Tech debt](tech-debt.md).

Related security-relevant findings (not authorization, but security-adjacent):
- **Framework exception detail produced before the response envelope** — `config.IncludeErrorDetailPolicy = IncludeErrorDetailPolicy.Always;` applies in every environment, so an uncaught failure produces framework exception detail (including a stack trace) before `ApiResponseHandler` runs; the final client-visible envelope is unknown** (see [Endpoints: Error response shape](endpoints.md#error-response-shape)).
- **Unbounded upload surface** — `maxRequestLength="1048576"` (1 GB) and `maxAllowedContentLength="1073741824"` (1 GB) apply to endpoints that accept raw `byte[]` bodies with no authorization.

## Related documentation
- [API index](index.md)
- [Overview](overview.md)
- [Architecture](architecture.md)
- [Endpoints](endpoints.md)
- [Dependencies](dependencies.md)
- [Configuration](configuration.md)
- [Operations and processes](operations-processes.md)
- [Business rules](business-rules.md)
- [Data model](data-model.md)
- [Operational runbook](operational-runbook.md)
- [Tech debt](tech-debt.md)

> **Note:** Statements marked with `*` were inferred from code structure, naming conventions, or
> contextual evidence where direct confirmation was not available in source artifacts. Statements
> marked with `**` could not be confirmed; treat as unknown until verified.

## Sources
- PdfAPI\Web.config
- PdfAPI\Controllers\v1\ConvertController.cs
- PdfAPI\Controllers\v1\ExtractController.cs
- PdfAPI\Controllers\v1\MergeController.cs
- PdfAPI\Controllers\v1\LegacyController.cs
- PdfAPI\Controllers\v1\InfoController.cs
- PdfAPI\Controllers\v1\ApiInfoController.cs
- PdfApi.SyncFusionCore\LicenseHelper.cs
- PdfAPI\App_Start\WebApiConfig.cs
- Pipelines\build-vars.yml