ASP.NET Core Web API for the CloudSystem ERP platform.
CloudSystemAPI provides a secure and scalable backend for ERP modules such as Employees, Payroll, Inventory, Customers, Suppliers, Branches, Menus, and more.
CloudSystem is designed as a separated frontend and backend architecture:
CloudSystem
|
+-----------+-----------+
| |
CloudSystemAPI CloudSystem.Web
ASP.NET Core Blazor
Web API Web App
| |
+-----------+-----------+
|
PostgreSQL
Backend
CloudSystemAPI
ASP.NET Core Web API
REST API
API Key authentication
HTTPS
OpenAPI / Swagger
Business logic
Entity Framework Core
PostgreSQL
Frontend
CloudSystem.Web
Blazor Web App
Syncfusion / MudBlazor
API-based communication
Session / Local Storage
UI permissions
🔐 API Security
CloudSystemAPI uses a simple Client ID + Client Secret authentication system.
Every protected API request must include:
X-Client-ID: YOUR_CLIENT_ID
X-Client-Secret: YOUR_CLIENT_SECRET
Example:
GET /branches
X-Client-ID: Azzo@123
X-Client-Secret: YOUR_SECRET
Invalid or missing credentials return:
401 Unauthorized
Example:
{
"detail": "Missing X-Client-ID."
}
🔑 Authentication Flow
Client Application
|
| HTTPS
|
| X-Client-ID
| X-Client-Secret
v
CloudSystemAPI
|
v
ApiKeyMiddleware
|
+------ Invalid ------> 401 Unauthorized
|
+------ Valid --------> Controller
|
v
Service
|
v
Database
🛡️ Security Middleware
API authentication is handled globally through:
Security/
ApiKeyMiddleware.cs
The middleware validates:
X-Client-ID
X-Client-Secret
before the request reaches the controller.
This means all ERP endpoints can automatically be protected.
For example:
GET /employees
POST /employees
PUT /employees/{id}
DELETE /employees/{id}
GET /payroll
POST /payroll
GET /inventory
POST /inventory
GET /customers
POST /customers
No separate authentication code is required inside every controller.
🌐 Public Endpoints
The following endpoints are public:
GET /
GET /health
GET /swagger
All business APIs are protected.
📚 Current API
Branches
GET /branches
Example response:
{
"success": true,
"count": 3,
"total": 3,
"pages": 1,
"data": [
{
"id": "1",
"name": "Riyadh"
},
{
"id": "2",
"name": "Jeddah"
},
{
"id": "3",
"name": "Dammam"
}
],
"timestamp": "2026-08-27T11:09:03Z"
}
Menus
GET /menus
Example response:
{
"success": true,
"count": 3,
"total": 3,
"pages": 1,
"data": [
{
"id": "1",
"name": "Employees"
},
{
"id": "2",
"name": "Payroll"
},
{
"id": "3",
"name": "Inventory"
}
],
"timestamp": "2026-08-27T11:09:46Z"
}
Health
GET /health
Example response:
{
"success": true,
"status": "Healthy",
"timestamp": "2026-08-27T11:09:30Z"
}
📖 Swagger
Swagger UI is available when the API is running:
https://localhost:7144/swagger
Swagger provides an Authorize button.
Enter:
ClientIDAuth
and:
ClientSecretAuth
Swagger will automatically send:
X-Client-ID
X-Client-Secret
with protected API requests.
⚙️ Configuration
Development configuration is stored in:
appsettings.json
Example:
{
"ApiSecurity": {
"ClientId": "YOUR_CLIENT_ID",
"ClientSecret": "YOUR_CLIENT_SECRET"
},
"Logging": {
"LogLevel": {
"Default": "Information",
"Microsoft.AspNetCore": "Warning"
}
},
"AllowedHosts": "*"
}
⚠️ Production Security
Do not commit real production credentials to GitHub.
Do NOT use:
{
"ClientId": "real-client-id",
"ClientSecret": "real-production-secret"
}
in a public repository.
For production deployment, store secrets using a secure secret-management solution such as:
Google Cloud Secret Manager
Azure Key Vault
AWS Secrets Manager
Environment Variables
CI/CD Secret Variables
The application should read the values from configuration.
🛠️ Technologies
Backend
.NET 10
ASP.NET Core Web API
C#
OpenAPI
Swagger
Entity Framework Core
PostgreSQL
Frontend
Planned:
Blazor Web App
C#
Syncfusion
MudBlazor
📦 Installation
Requirements
Install:
.NET 10 SDK
PostgreSQL
Visual Studio 2026 or Visual Studio Code
Git
Clone Repository
git clone https://github.com/YOUR_USERNAME/CloudSystemAPI.git
Enter the project:
cd CloudSystemAPI
Restore Packages
dotnet restore
Build
dotnet build
Run
dotnet run
The API will be available at:
https://localhost:7144
Swagger:
https://localhost:7144/swagger