In modular monolith and microservice architectures, the role of the API Host is often misunderstood:

Teams pollute Controllers with domain business logic, turning controllers into unmaintainable bottlenecks;
Haphazard middleware ordering leads to tenant resolution running before authentication, causing critical access control vulnerabilities.

BitzOrcas.Modern enforces a strict architectural rule: The API Host is a Composition Root, not a business layer: All HTTP endpoints are bound at compile time via [GenerateEndpoint] into Native AOT-ready Minimal APIs, while use cases remain purely in Application vertical slices.

Middleware Topology and Request Pipeline

Step 1: Declarative Minimal API Endpoints

Using [GenerateEndpoint], the Roslyn incremental generator emits high-performance static route mappings:

using BitzOrcas.Application.Abstractions.Authorization;
using BitzOrcas.Domain.Results;
using BitzOrcas.Endpoint.Attributes;
using Mediator;

namespace BitzOrcas.Sandbox.Application.Commands;

// Declarative endpoint: configures route, Swagger tags, and rate limit policies
[GenerateEndpoint(
    HttpRoute.Post,
    "/api/notes",
    Tag = "Notes",
    RateLimitPolicy = "userPolicy",
    RequestTimeoutPolicy = "StandardCommand")]
public sealed record CreateNoteCommand(string Title)
    : ICommand<Result<string>>, IAuthorizedRequest
{
    // Authorization resource and action descriptor
    public ResourceDescriptor Resource { get; } = new("sandbox", "note");
    public AuthorizationAction Action { get; } = AuthorizationAction.Create;
}

Step 2: Standard RFC 9457 Problem Details Errors

When handlers return Result.Failure, the framework automatically serializes standard Problem Details:

{
  "type": "https://docs.bitzsoft.com/problems/validation",
  "title": "Bad Request",
  "status": 400,
  "detail": "Customer name cannot exceed 100 characters.",
  "instance": "/api/customers",
  "errorCode": "Customer.NameTooLong",
  "errorType": "Validation",
  "traceId": "4bf92f3577b34da6a3ce929d0e0e4736"
}

Summary

BitzOrcas Web API infrastructure ensures maximum decoupling:

Compile-Time Static Dispatch: Sub-second container startups without runtime reflection;
Middleware Ordering Contract: Enforces strict security pipeline guarantees;
RFC Industry Standards: Consistent Problem Details streamline frontend error integration.