Hide an api endpoint in release build

Question

I am working on a Asp.net web api project. I recently created an end point for documentation using config.Services.GetApiExplorer();

What is the best way to hide this endpoint in production and still make it available for all other developers in my team.

One way I could think of is to register a route using

#if debug

routes.MapRoute(
"documentation",
"documentation/help", 
new { controller = "apiexplorer", action
= "Index" }
);

#endif

Answer 1

There is two attribute could hide an API endpoint:

[ApiExplorerSettings(IgnoreApi = true)]
[NonAction]
public async Task<void> PrivateAPI()
{
...
}

But for your case, I probably create a new attribute to check the environment and apply that attribute to your controller method. Inject the 'IHostingEnvironment' class, then use .IsDevelopment() method.

Answer 2

I assume that your developers still need to have access to that endpoint even on production (for sanity checks, ... . the same as dev and staging environment). If that s the case, create a new Policy and put your developers (or any other person you want to expose your endpoint to) under that policy.

[Authorize(Policy = "JustDevelopersPolicy")]
public async Task<void> PrivateAPI()
{
...
}

FYI, It might change the response by calling that endpoint, so, if an unauthorized person calls it, they get 401 instead of 404