What authentication and authorization rules should APIs enforce?

What authentication and authorization rules should APIs enforce?

APIs should identify the caller, verify that the requested action is allowed, and validate the data being submitted. A successful login proves identity; it does not grant unrestricted access to every wedding, event, task, or guest record.

Check identity and resource scope

For an authenticated request, validate the session or credential using the application's chosen identity mechanism. Then look up the caller's relevant membership and permissions for the target wedding.

When a request names both a wedding and an event, verify that the event belongs to that wedding. Do not assume a valid identifier is an authorized identifier. The same principle applies to task assignees and guest records.

Restrict actions and editable fields

An organizer may manage invitations, while a collaborator may only update permitted tasks. Define these rules explicitly and apply them in server-side code for each operation.

Accept only fields the operation allows. A task-status update should not silently accept a new wedding owner or membership role. Validate field types and allowed values, and return only the information the caller needs.

Handle limited guest access deliberately

If guests can respond without full accounts, treat invitation access as a restricted capability. Use a carefully designed credential flow, validate its scope and state, and allow only the intended guest and event responses. Apply appropriate abuse protection and avoid exposing other guests' information.

Test direct API requests as well as the interface. Include expired credentials, removed collaborators, mismatched wedding identifiers, and attempts to edit forbidden fields. Ask AI to review the access matrix and implementation for gaps, but verify every finding against the actual server behavior before considering the feature complete.