Protected API Access Flow

API Request


POST /api/findRoles/1
Content-Type: application/json
Authorization: Bearer <JWT>

API Response (Success)


HTTP/1.1 200 OK
Content-Type: application/json


{
  "success": true,
  "status": 200,
  "data": [
    {
      "role_name": "Super Admin",
      "role_short_name": "SAA",
      "user_role_id": 1,
      "usertype": "staff",
      "role_id": 1
    }
  ]
}

Sequence Diagram

Flow Description

Request Initiation: Client sends request to protected endpoint with JWT Bearer token.
CORS Validation: Checks origin and headers.
Rate Limiting: Validates request frequency per client/IP.
Token Processing: Extracts and validates JWT.
User Authentication: Loads user details and sets security context.
Authorization: Grants or denies access based on token validity.
Business Logic: Executes controller/service operations.
Response: Returns data or error message.
- Validate token against user context
- Set security context for authenticated user
Authorization Decision: Grant access for valid tokens or return 401 for invalid/missing tokens
Business Logic: Execute controller and service layer operations with authenticated context
Response: Return requested data or error message with appropriate HTTP status