RESTful API Best Practices for .NET Developers (.NET 10) – The Complete 2026 Guide to Production-Ready APIs

// BAD: Relying on server-side session
app.MapPost("/api/orders", (HttpContext context) =>
{
    var userId = context.Session.GetInt32("UserId"); // Session state!
    // Create order for this user
});

// GOOD: All context in the request
app.MapPost("/api/orders", (CreateOrderRequest request, ClaimsPrincipal user) =>
{
    var userId = user.FindFirst(ClaimTypes.NameIdentifier)?.Value; // From JWT
    // Create order for this user
});

app.MapGet("/api/products/{id}", async (int id, ProductService service) =>
{
    var product = await service.GetByIdAsync(id);
    return product is null
        ? Results.NotFound()
        : Results.Ok(product);
})
.CacheOutput(policy => policy.Expire(TimeSpan.FromMinutes(10))); // Cacheable for 10 minutes

Cache-Control: public, max-age=600
ETag: "abc123"

/api/users              → Collection of users
/api/users/42           → Specific user
/api/users/42/orders    → Orders belonging to user 42

{
  "id": 42,
  "name": "John Doe",
  "email": "john@example.com",
  "createdAt": "2026-01-02T10:30:00Z"
}

POST /api/users HTTP/1.1
Host: api.example.com
Content-Type: application/json    ← How to parse the body
Accept: application/json          ← What format I want back
Authorization: Bearer eyJhb...    ← How to authenticate me

{"name": "John Doe", "email": "john@example.com"}

{
  "id": 42,
  "name": "John Doe",
  "_links": {
    "self": { "href": "/api/users/42" },
    "orders": { "href": "/api/users/42/orders" },
    "update": { "href": "/api/users/42", "method": "PUT" },
    "delete": { "href": "/api/users/42", "method": "DELETE" }
  }
}

┌────────┐    ┌───────────┐    ┌──────────────┐    ┌────────────┐
│ Client │ ─► │ Cloudflare│ ─► │ API Gateway  │ ─► │ .NET API   │
│        │    │ CDN       │    │ (Auth, Rate  │    │ (Business  │
│        │    │           │    │  Limiting)   │    │  Logic)    │
└────────┘    └───────────┘    └──────────────┘    └────────────┘
                    ▲
                    │
          Client thinks it's
          talking directly to API

// The method IS the verb
app.MapGet("/api/users", GetUsers);          // GET = retrieve
app.MapPost("/api/users", CreateUser);       // POST = create
app.MapPut("/api/users/{id}", UpdateUser);   // PUT = replace
app.MapDelete("/api/users/{id}", DeleteUser);// DELETE = remove

GET /api/users        → Returns list of users
GET /api/users/42     → Returns single user
POST /api/users       → Creates a user (in the users collection)

# Orders belong to users
GET /api/users/42/orders          → All orders for user 42
GET /api/users/42/orders/7        → Order 7 for user 42
POST /api/users/42/orders         → Create order for user 42

# Items belong to orders
GET /api/orders/7/items           → All items in order 7
POST /api/orders/7/items          → Add item to order 7

# Too deep - hard to read and use
GET /api/users/42/orders/7/items/3/options/1

# Better - flatten when entities can stand alone
GET /api/order-items/3/options/1

GET /api/orders?userId=42         → Alternative to /users/42/orders

GET /api/users/42                 → User with ID 42
GET /api/products/abc-123         → Product with slug abc-123

GET /api/users?role=admin&sort=name       → Filter and sort
GET /api/products?category=electronics    → Filter by category
GET /api/orders?page=2&pageSize=20        → Pagination

# BAD: Path for filtering
GET /api/users/role/admin/sort/name/page/2

# GOOD: Query for filtering
GET /api/users?role=admin&sort=name&page=2

app.MapGet("/api/users", async (UserService service) =>
{
    var users = await service.GetAllAsync();
    return Results.Ok(users);
});

app.MapGet("/api/users/{id:int}", async (int id, UserService service) =>
{
    var user = await service.GetByIdAsync(id);
    return user is null ? Results.NotFound() : Results.Ok(user);
});

app.MapPost("/api/users", async (CreateUserRequest request, UserService service) =>
{
    var user = await service.CreateAsync(request);
    return Results.Created($"/api/users/{user.Id}", user);
});

app.MapPut("/api/users/{id:int}", async (int id, UpdateUserRequest request, UserService service) =>
{
    var user = await service.GetByIdAsync(id);
    if (user is null)
        return Results.NotFound();

    await service.UpdateAsync(id, request);
    return Results.NoContent();
});

app.MapPatch("/api/users/{id:int}", async (int id, JsonPatchDocument<User> patchDoc, UserService service) =>
{
    var user = await service.GetByIdAsync(id);
    if (user is null)
        return Results.NotFound();

    patchDoc.ApplyTo(user);
    await service.UpdateAsync(id, user);
    return Results.NoContent();
});

public record PatchUserRequest(string? Name, string? Email);

app.MapPatch("/api/users/{id:int}", async (int id, PatchUserRequest request, UserService service) =>
{
    var user = await service.GetByIdAsync(id);
    if (user is null)
        return Results.NotFound();

    // Only update provided fields
    if (request.Name is not null) user.Name = request.Name;
    if (request.Email is not null) user.Email = request.Email;

    await service.UpdateAsync(id, user);
    return Results.NoContent();
});

app.MapDelete("/api/users/{id:int}", async (int id, UserService service) =>
{
    var user = await service.GetByIdAsync(id);
    if (user is null)
        return Results.NotFound();

    await service.DeleteAsync(id);
    return Results.NoContent();
});

// Current user state
{
  "id": 42,
  "name": "John Doe",
  "email": "john@example.com",
  "phone": "555-1234"
}

// PUT request - replaces everything
PUT /api/users/42
{
  "name": "John Smith",
  "email": "john.smith@example.com"
}
// Result: phone is now NULL (not provided)

// PATCH request - updates only provided fields
PATCH /api/users/42
{
  "name": "John Smith"
}
// Result: phone and email unchanged

QUERY /api/v1/products HTTP/1.1
Host: api.example.com
Content-Type: application/json
Accept: application/json

{
  "category": "electronics",
  "priceRange": { "min": 100, "max": 500 },
  "tags": ["wireless", "noise-cancelling"],
  "sort": [{ "field": "price", "direction": "desc" }],
  "page": 1,
  "pageSize": 20
}

HTTP/1.1 200 OK
Content-Type: application/json
Content-Location: /api/v1/products?q=a1b2c3

{ "data": [ ... ], "pagination": { ... } }

app.MapMethods("/api/v1/products", ["QUERY"], async (
    HttpContext http,
    IProductService service) =>
{
    // The query lives in the request body, not the URL
    var query = await http.Request.ReadFromJsonAsync<ProductQuery>();
    if (query is null)
        return Results.BadRequest();

    var (products, totalCount) = await service.SearchAsync(query);

    return Results.Ok(new
    {
        data = products,
        pagination = new { query.Page, query.PageSize, totalCount }
    });
});

public record ProductQuery(
    string? Category,
    PriceRange? PriceRange,
    string[]? Tags,
    int Page = 1,
    int PageSize = 20);

public record PriceRange(decimal Min, decimal Max);

public static class QueryEndpointExtensions
{
    public static IEndpointConventionBuilder MapQuery(
        this IEndpointRouteBuilder endpoints,
        string pattern,
        Delegate handler) =>
        endpoints.MapMethods(pattern, ["QUERY"], handler);
}

// Now it reads just like the other verbs:
app.MapQuery("/api/v1/products", SearchProducts);

using var client = new HttpClient { BaseAddress = new Uri("https://api.example.com") };

var request = new HttpRequestMessage(new HttpMethod("QUERY"), "/api/v1/products")
{
    Content = JsonContent.Create(new ProductQuery(
        Category: "electronics",
        PriceRange: new PriceRange(100, 500),
        Tags: ["wireless"]))
};

var response = await client.SendAsync(request);
var result = await response.Content.ReadFromJsonAsync<ProductSearchResult>();

POST /api/v1/payments
Idempotency-Key: 3f1d8c9a-2b6e-4f0a-9c1d-7a5b2e8f1c44
Content-Type: application/json

{ "amount": 4999, "currency": "usd" }

app.MapPost("/api/v1/payments", async (
    PaymentRequest request,
    HttpContext http,
    IDistributedCache cache,
    IPaymentService payments) =>
{
    if (!http.Request.Headers.TryGetValue("Idempotency-Key", out var key) ||
        string.IsNullOrWhiteSpace(key))
    {
        return Results.BadRequest("Missing Idempotency-Key header.");
    }

    var cacheKey = $"idemp:{key}";
    var existing = await cache.GetStringAsync(cacheKey);
    if (existing is not null)
        return Results.Ok(JsonSerializer.Deserialize<PaymentResult>(existing)); // Replay

    var result = await payments.ChargeAsync(request);

    await cache.SetStringAsync(cacheKey, JsonSerializer.Serialize(result),
        new DistributedCacheEntryOptions { AbsoluteExpirationRelativeToNow = TimeSpan.FromHours(24) });

    return Results.Ok(result);
})
.RequireRateLimiting("fixed");

// 200 OK - returning data
return Results.Ok(users);

// 201 Created - new resource with location
return Results.Created($"/api/users/{user.Id}", user);

// 204 No Content - success but nothing to return
return Results.NoContent();

// 400 Bad Request - validation failed
return Results.BadRequest(new { errors = validationErrors });

// 401 Unauthorized - no/invalid credentials
return Results.Unauthorized();

// 403 Forbidden - authenticated but not allowed
return Results.Forbid();

// 404 Not Found - resource doesn't exist
return Results.NotFound();

// 409 Conflict - can't complete due to state
return Results.Conflict(new { message = "Email already registered" });

// BAD: Success status with error body
return Results.Ok(new { success = false, error = "User not found" });

// GOOD: Appropriate error status
return Results.NotFound(new { error = "User not found" });

// BAD: Server error for bad input
throw new Exception("Invalid email format"); // Results in 500

// GOOD: Client error for bad input
return Results.BadRequest(new { error = "Invalid email format" });

// 401: "Who are you?" - Authentication issue
// 403: "I know who you are, but you can't do this" - Authorization issue

{
  "type": "https://www.rfc-editor.org/rfc/rfc9110#section-15.5.1",
  "title": "One or more validation errors occurred.",
  "status": 400,
  "errors": {
    "email": ["The email field is required."],
    "name": ["Name must be between 2 and 100 characters."]
  }
}

{
  "type": "https://www.rfc-editor.org/rfc/rfc9110#section-15.5.5",
  "title": "Not Found",
  "status": 404,
  "detail": "User with ID 42 was not found.",
  "instance": "/api/users/42"
}

{
  "type": "https://example.com/problems/duplicate-email",
  "title": "Conflict",
  "status": 409,
  "detail": "A user with email john@example.com already exists.",
  "conflictingResource": "/api/users/17"
}

builder.Services.AddProblemDetails(options =>
{
    options.CustomizeProblemDetails = context =>
    {
        context.ProblemDetails.Instance = context.HttpContext.Request.Path;
        context.ProblemDetails.Extensions["traceId"] = context.HttpContext.TraceIdentifier;
    };
});

var app = builder.Build();

app.UseExceptionHandler();   // Converts exceptions to Problem Details
app.UseStatusCodePages();    // Converts bare 4xx/5xx to Problem Details

public sealed class AppExceptionHandler : IExceptionHandler
{
    public async ValueTask<bool> TryHandleAsync(
        HttpContext context, Exception exception, CancellationToken ct)
    {
        var (status, title) = exception switch
        {
            NotFoundException   => (StatusCodes.Status404NotFound, "Not Found"),
            ValidationException => (StatusCodes.Status400BadRequest, "Validation Error"),
            _                   => (StatusCodes.Status500InternalServerError, "Server Error")
        };

        return await context.RequestServices
            .GetRequiredService<IProblemDetailsService>()
            .TryWriteAsync(new ProblemDetailsContext
            {
                HttpContext = context,
                ProblemDetails = new ProblemDetails
                {
                    Status = status,
                    Title = title,
                    Detail = exception.Message
                }
            });
    }
}

// Program.cs
builder.Services.AddExceptionHandler<AppExceptionHandler>();

GET /api/v1/users
GET /api/v2/users

var v1 = app.MapGroup("/api/v1");
var v2 = app.MapGroup("/api/v2");

v1.MapGet("/users", GetUsersV1);
v2.MapGet("/users", GetUsersV2);

GET /api/users?api-version=1.0
GET /api/users?api-version=2.0

GET /api/users
X-API-Version: 2.0

builder.Services.AddApiVersioning(options =>
{
    options.DefaultApiVersion = new ApiVersion(1, 0);
    options.AssumeDefaultVersionWhenUnspecified = true;
    options.ReportApiVersions = true;
    options.ApiVersionReader = new UrlSegmentApiVersionReader();
})
.AddApiExplorer(options =>
{
    options.GroupNameFormat = "'v'VVV";
    options.SubstituteApiVersionInUrl = true;
});

app.MapGet("/api/v1/users", GetUsersV1)
   .WithMetadata(new ObsoleteAttribute("Use /api/v2/users instead. Sunset: 2026-06-01"));

GET /api/users?page=2&pageSize=20

{
  "data": [...],
  "pagination": {
    "page": 2,
    "pageSize": 20,
    "totalPages": 15,
    "totalCount": 287,
    "hasNext": true,
    "hasPrevious": true
  }
}

GET /api/users?cursor=eyJpZCI6NDJ9&limit=20

public record PagedResponse<T>(
    IEnumerable<T> Data,
    PaginationMeta Pagination
);

public record PaginationMeta(
    int Page,
    int PageSize,
    int TotalPages,
    int TotalCount,
    bool HasNext,
    bool HasPrevious
);

app.MapGet("/api/users", async (
    int page = 1,
    int pageSize = 20,
    UserService service) =>
{
    pageSize = Math.Clamp(pageSize, 1, 100); // Enforce max page size

    var (users, totalCount) = await service.GetPagedAsync(page, pageSize);
    var totalPages = (int)Math.Ceiling(totalCount / (double)pageSize);

    return Results.Ok(new PagedResponse<User>(users, new PaginationMeta(
        page, pageSize, totalPages, totalCount,
        HasNext: page < totalPages,
        HasPrevious: page > 1
    )));
});

GET /api/products?category=electronics&minPrice=100&maxPrice=500&inStock=true

public record ProductFilter(
    string? Category,
    decimal? MinPrice,
    decimal? MaxPrice,
    bool? InStock,
    string? Search
);

app.MapGet("/api/products", async ([AsParameters] ProductFilter filter, ProductService service) =>
{
    var products = await service.GetFilteredAsync(filter);
    return Results.Ok(products);
});

GET /api/users?sort=name&order=asc
GET /api/users?sort=-createdAt      # Prefix with - for descending

app.MapGet("/api/users", async (
    string? sort = "id",
    string? order = "asc",
    UserService service) =>
{
    var allowedSortFields = new[] { "id", "name", "email", "createdAt" };
    if (!allowedSortFields.Contains(sort, StringComparer.OrdinalIgnoreCase))
        sort = "id";

    var users = await service.GetSortedAsync(sort, order == "desc");
    return Results.Ok(users);
});

GET /api/products?category=electronics&minPrice=100&sort=-price&page=1&pageSize=20

Cache-Control: public, max-age=3600        # Cache for 1 hour
Cache-Control: private, max-age=300        # User-specific, cache 5 min
Cache-Control: no-cache                    # Validate before using cache
Cache-Control: no-store                    # Never cache (sensitive data)

ETag: "abc123"                             # Version identifier
Last-Modified: Wed, 01 Jan 2026 10:00:00 GMT

app.MapGet("/api/products/{id}", async (int id, ProductService service, HttpContext context) =>
{
    var product = await service.GetByIdAsync(id);
    if (product is null)
        return Results.NotFound();

    var etag = $"\"{product.Version}\"";

    // Check if client has current version
    if (context.Request.Headers.IfNoneMatch == etag)
        return Results.StatusCode(304); // Not Modified

    context.Response.Headers.ETag = etag;
    context.Response.Headers.CacheControl = "private, max-age=60";

    return Results.Ok(product);
});

builder.Services.AddOutputCache(options =>
{
    options.AddBasePolicy(builder => builder.Expire(TimeSpan.FromMinutes(10)));

    options.AddPolicy("Products", builder =>
        builder.Expire(TimeSpan.FromMinutes(30))
               .Tag("products"));

    options.AddPolicy("UserSpecific", builder =>
        builder.Expire(TimeSpan.FromMinutes(5))
               .SetVaryByQuery("userId"));
});

app.UseOutputCache();

app.MapGet("/api/products", GetProducts)
   .CacheOutput("Products");

app.MapGet("/api/users/{id}/profile", GetUserProfile)
   .CacheOutput("UserSpecific");

app.MapPost("/api/products", async (
    CreateProductRequest request,
    ProductService service,
    IOutputCacheStore cache) =>
{
    var product = await service.CreateAsync(request);

    // Invalidate product list cache
    await cache.EvictByTagAsync("products", CancellationToken.None);

    return Results.Created($"/api/products/{product.Id}", product);
});

app.MapPut("/api/v1/products/{id:int}", async (
    int id, UpdateProductRequest request, HttpContext http, IProductService service) =>
{
    var product = await service.GetByIdAsync(id);
    if (product is null)
        return Results.NotFound();

    var currentEtag = $"\"{product.Version}\"";

    // Reject the write if the client edited a stale copy
    if (http.Request.Headers.IfMatch is { Count: > 0 } ifMatch &&
        ifMatch != currentEtag)
    {
        return Results.StatusCode(StatusCodes.Status412PreconditionFailed);
    }

    await service.UpdateAsync(id, request);
    return Results.NoContent();
});

if (!app.Environment.IsDevelopment())
{
    app.UseHsts();
}
app.UseHttpsRedirection();

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
    {
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateIssuer = true,
            ValidateAudience = true,
            ValidateLifetime = true,
            ValidateIssuerSigningKey = true,
            ValidIssuer = builder.Configuration["Jwt:Issuer"],
            ValidAudience = builder.Configuration["Jwt:Audience"],
            IssuerSigningKey = new SymmetricSecurityKey(
                Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]!))
        };
    });

app.UseAuthentication();
app.UseAuthorization();

builder.Services.AddRateLimiter(options =>
{
    options.AddFixedWindowLimiter("fixed", config =>
    {
        config.Window = TimeSpan.FromMinutes(1);
        config.PermitLimit = 100;
        config.QueueLimit = 10;
    });

    options.AddSlidingWindowLimiter("sliding", config =>
    {
        config.Window = TimeSpan.FromMinutes(1);
        config.SegmentsPerWindow = 6;
        config.PermitLimit = 100;
    });

    options.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
});

app.UseRateLimiter();

app.MapGet("/api/users", GetUsers)
   .RequireRateLimiting("fixed");

public record CreateUserRequest(
    [Required, StringLength(100, MinimumLength = 2)] string Name,
    [Required, EmailAddress] string Email,
    [Required, MinLength(8)] string Password
);

app.MapPost("/api/users", async (CreateUserRequest request, UserService service) =>
{
    // ASP.NET Core validates automatically when using [Required], etc.
    var user = await service.CreateAsync(request);
    return Results.Created($"/api/users/{user.Id}", user);
})
.WithParameterValidation(); // Requires MinimalApis.Extensions

builder.Services.AddOpenApi();

var app = builder.Build();

app.MapOpenApi(); // Available at /openapi/v1.json

using Scalar.AspNetCore;

app.MapScalarApiReference(); // Available at /scalar/v1

app.MapGet("/api/users/{id}", async (int id, UserService service) =>
{
    var user = await service.GetByIdAsync(id);
    return user is null ? Results.NotFound() : Results.Ok(user);
})
.WithName("GetUserById")
.WithSummary("Get a user by ID")
.WithDescription("Returns a single user based on their unique identifier. Returns 404 if the user doesn't exist.")
.Produces<User>(StatusCodes.Status200OK)
.Produces(StatusCodes.Status404NotFound)
.WithTags("Users");

public record Product
{
    public int Id { get; init; }
    public required string Name { get; set; }
    public required string Description { get; set; }
    public decimal Price { get; set; }
    public int Stock { get; set; }
    public string? Category { get; set; }
    public DateTime CreatedAt { get; init; } = DateTime.UtcNow;
    public DateTime? UpdatedAt { get; set; }
}

public record CreateProductRequest(
    [property: Required, StringLength(200)] string Name,
    [property: Required] string Description,
    [property: Range(0.01, 1000000)] decimal Price,
    [property: Range(0, int.MaxValue)] int Stock,
    string? Category
);

// UpdateProductRequest mirrors CreateProductRequest (full replacement).
// PatchProductRequest makes every field nullable (partial update).

public record ProductResponse(
    int Id, string Name, string Description, decimal Price,
    int Stock, string? Category, DateTime CreatedAt, DateTime? UpdatedAt
);

using Scalar.AspNetCore;

var builder = WebApplication.CreateBuilder(args);

// Services
builder.Services.AddSingleton<IProductService, ProductService>();
builder.Services.AddOpenApi();
builder.Services.AddProblemDetails();

var app = builder.Build();

// Middleware
app.UseExceptionHandler();
app.MapOpenApi();
app.MapScalarApiReference();

// API Routes
var api = app.MapGroup("/api/v1");

api.MapGet("/products", async (
    int page = 1,
    int pageSize = 20,
    IProductService service) =>
{
    pageSize = Math.Clamp(pageSize, 1, 100);
    var (products, totalCount) = await service.GetPagedAsync(page, pageSize);
    var totalPages = (int)Math.Ceiling(totalCount / (double)pageSize);

    return Results.Ok(new
    {
        data = products.Select(p => new ProductResponse(
            p.Id, p.Name, p.Description, p.Price, p.Stock, p.Category, p.CreatedAt, p.UpdatedAt)),
        pagination = new
        {
            page,
            pageSize,
            totalPages,
            totalCount,
            hasNext = page < totalPages,
            hasPrevious = page > 1
        }
    });
})
.WithName("GetProducts")
.WithSummary("Get all products with pagination")
.WithTags("Products");

api.MapGet("/products/{id:int}", async (int id, IProductService service) =>
{
    var product = await service.GetByIdAsync(id);
    return product is null
        ? Results.NotFound(new { error = $"Product with ID {id} not found" })
        : Results.Ok(new ProductResponse(
            product.Id, product.Name, product.Description,
            product.Price, product.Stock, product.Category,
            product.CreatedAt, product.UpdatedAt));
})
.WithName("GetProductById")
.WithSummary("Get a product by ID")
.Produces<ProductResponse>(StatusCodes.Status200OK)
.Produces(StatusCodes.Status404NotFound)
.WithTags("Products");

api.MapPost("/products", async (CreateProductRequest request, IProductService service) =>
{
    var product = await service.CreateAsync(request);
    var response = new ProductResponse(
        product.Id, product.Name, product.Description,
        product.Price, product.Stock, product.Category,
        product.CreatedAt, product.UpdatedAt);

    return Results.Created($"/api/v1/products/{product.Id}", response);
})
.WithName("CreateProduct")
.WithSummary("Create a new product")
.Produces<ProductResponse>(StatusCodes.Status201Created)
.Produces(StatusCodes.Status400BadRequest)
.WithTags("Products");

api.MapPut("/products/{id:int}", async (int id, UpdateProductRequest request, IProductService service) =>
{
    var product = await service.UpdateAsync(id, request);
    return product is null
        ? Results.NotFound(new { error = $"Product with ID {id} not found" })
        : Results.NoContent();
})
.WithName("UpdateProduct")
.WithSummary("Update an existing product")
.Produces(StatusCodes.Status204NoContent)
.Produces(StatusCodes.Status404NotFound)
.WithTags("Products");

api.MapPatch("/products/{id:int}", async (int id, PatchProductRequest request, IProductService service) =>
{
    var product = await service.PatchAsync(id, request);
    return product is null
        ? Results.NotFound(new { error = $"Product with ID {id} not found" })
        : Results.NoContent();
})
.WithName("PatchProduct")
.WithSummary("Partially update a product")
.Produces(StatusCodes.Status204NoContent)
.Produces(StatusCodes.Status404NotFound)
.WithTags("Products");

api.MapDelete("/products/{id:int}", async (int id, IProductService service) =>
{
    var deleted = await service.DeleteAsync(id);
    return deleted
        ? Results.NoContent()
        : Results.NotFound(new { error = $"Product with ID {id} not found" });
})
.WithName("DeleteProduct")
.WithSummary("Delete a product")
.Produces(StatusCodes.Status204NoContent)
.Produces(StatusCodes.Status404NotFound)
.WithTags("Products");

app.Run();