SAIF.Web.API dependencies

SAIF.Web.API declares no <ProjectReference>s: SAIF.Web.API.csproj references only NuGet packages. It references ErrorResponse / SAIF.API.Exceptions.* types by fully-qualified name at compile time, but which assembly actually supplies those types — the sibling SAIF.Web.API.Core project or the SAIF.Framework.Core package — is unresolved (see Internal dependencies).** All actual authorization, logging, and environment-configuration behavior is delegated to services assumed to be supplied by the hosting application through SAIF.Framework.Core; no such registration exists inside this library.*

Internal dependencies

SAIF.Web.API declares no <ProjectReference>s of any kind, so no internal same-repo project qualifies for this table under the canonical Reference Type enum (Project Reference | NuGet Package | NuGet Package (same-repo)). The unresolved compile-time reference to ErrorResponse / SAIF.API.Exceptions.* types is not a confirmed dependency on any specific project or package and is therefore documented as an open question in Dependency risks and notes rather than as a table row here.

Dependency	Reference Type	Usage
SAIF.Framework.Core	NuGet Package	Supplies SAIF.Core.Services.IEnvironmentService, ILogService, ILogServiceForApi, SAIF.Core.Services.UserProfile.ISecurityApiClient, SAIF.Common.Extensions (string/URI extension methods), MissingDependencyException, and Enforce. Resolved per request via ASP.NET Web API's IDependencyScope (service locator), not constructor injection.

External dependencies

Dependency	Version	Usage
Grpc.Core	2.44.0	Referenced with ExcludeAssets: runtime;native;contentfiles;analyzers;buildtransitive (compile-time reference/compile assembly only, no runtime binaries deployed). No Grpc.Core.* types are used anywhere in this library's own source; the reason for the reference could not be determined from source alone.**
Microsoft.AspNet.WebApi.WebHost	5.2.3	Provides the System.Web.Http.* types (ActionFilterAttribute, AuthorizeAttribute, HttpActionContext, DelegatingHandler support, etc.) used throughout ApiResponseHandler, SaifAuthorizeAttribute, and RequireSSLAttribute.

Dependency risks and notes

• Undeclared compile-time coupling to an unresolved supplier. SAIF.Web.API references ErrorResponse / SAIF.API.Exceptions.* by fully-qualified type name at compile time with no <ProjectReference>/<PackageReference> naming an explicit supplier. The sibling SAIF.Web.API.Core project declares matching types, and the SAIF.Framework.Core package is an equally plausible source; which one the build actually resolves is unconfirmed and is recorded as an open question requiring inspection of the restored SAIF.Framework.Core 2.0.25119.2 assembly.**
• Nuspec dependency drift. Two .nuspec files exist for this package: a templated src\SAIF.Web.API\SAIF.Web.Api.nuspec (dependencies resolved from the .csproj at pack time) and a separate, hard-coded nuspec\SAIF.Web.API\SAIF.Web.API.nuspec that pins SAIF.Framework.Core at version 1.0 and lists Microsoft.AspNet.WebApi.Client/Microsoft.AspNet.WebApi.Core as dependencies — none of which match the .csproj's actual references (SAIF.Framework.Core 2.0.25119.2, Microsoft.AspNet.WebApi.WebHost only). Which nuspec is authoritative for the actual nuget pack step could not be confirmed from local pipeline YAML alone (the build-steps-nuget.yml template lives in an external repository).**
• Grpc.Core reference rationale is unknown. No gRPC types are used anywhere in this library's source, yet the package is referenced with most asset types excluded; this could be a vestigial reference or a compile-time requirement of an undetermined transitive consumer.**
• Host must register IEnvironmentService and ISecurityApiClient. Both are resolved via IDependencyScope per request rather than constructor-injected. No registration call site exists inside this library, so this describes a requirement on the hosting application rather than an observed registration.* If either is unregistered by the hosting application's IDependencyResolver, SaifAuthorizeAttribute.IsAuthorized throws MissingDependencyException, surfacing as an unhandled server error rather than a 401/403 response.
• ISecurityApiClient implementation is opaque to this library. The concrete authorization mechanism behind ISecurityApiClient.IsAuthorized(user, role) (WCF SecurityService, HTTP API, or another mechanism) is defined in SAIF.Framework.Core and could not be determined from this repository.**
• Pipeline path/casing drift. pipelines\build-vars-webapi.yml declares SolutionPath/ProjectPath values (SAIF.Web.Api.sln, SAIF.Web.Api\SAIF.Web.Api.csproj) whose casing differs from the actual on-disk repository paths (SAIF.Web.API.sln, SAIF.Web.API\SAIF.Web.API.csproj); likely harmless on case-insensitive Windows build agents but flagged for completeness.

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Related documentation

• Index
• Overview
• Architecture
• Configuration
• Operations and processes
• Business rules
• Security and authorization
• API reference

Sources

• src/SAIF.Web.API/SAIF.Web.API.csproj
• src/SAIF.Web.API/ApiResponseHandler.cs
• src/SAIF.Web.API/ExceptionHandler.cs
• src/SAIF.Web.API/SaifAuthorizeAttribute.cs
• src/SAIF.Web.API/RequireSSLAttribute.cs
• src/SAIF.Web.API/SAIF.Web.Api.nuspec
• src/SAIF.Web.API.Core/SAIF.Web.API.Core.csproj
• src/SAIF.Web.API.sln
• nuspec/SAIF.Web.API/SAIF.Web.API.nuspec
• pipelines/build-vars-webapi.yml
• pipelines/build-webapi.yml
• pipelines/release-webapi.yml