By the end of this session, you will be able to:

• Demonstrate a working Task Management API that exercises every concept from the course
• Verify your project against the requirements checklist before you present it
• Deliver a tight 5–7 minute demo: live walkthrough, one code decision, one honest reflection
• Give and receive structured feedback using the evaluation rubric
• Name the specific area you will deepen next — and the first project that will take you there

A Task Management API — a real, multi-user, authenticated REST service. Not a tutorial clone: a system a frontend team could genuinely build against.

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddDbContext<AppDbContext>(options =>
    options.UseNpgsql(builder.Configuration.GetConnectionString("Default")));

builder.Services.AddScoped<ITaskRepository, TaskRepository>();
builder.Services.AddScoped<ITaskService, TaskService>();
builder.Services.AddScoped<ITokenService, TokenService>();

builder.Services.AddValidatorsFromAssemblyContaining<CreateTaskRequestValidator>();
builder.Services.AddFluentValidationAutoValidation();

builder.Services.AddApiVersioning(options =>
{
    options.DefaultApiVersion = new ApiVersion(1, 0);
    options.AssumeDefaultVersionWhenUnspecified = true;
    options.ReportApiVersions = true;
}).AddApiExplorer(options => options.GroupNameFormat = "'v'VVV");

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(options =>
        options.TokenValidationParameters = JwtSetup.Build(builder.Configuration));

builder.Services.AddAuthorization(options =>
    options.AddPolicy("AdminOnly", policy => policy.RequireRole("Admin")));

builder.Services.AddHealthChecks().AddDbContextCheck<AppDbContext>();
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen(SwaggerSetup.Configure);

var app = builder.Build();

if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}
else
{
    app.UseHsts();
}

app.UseExceptionHandler();        // ProblemDetails, never a stack trace
app.UseHttpsRedirection();
app.UseRouting();
app.UseCors("AllowFrontend");     // after routing, before auth
app.UseRateLimiter();
app.UseAuthentication();          // who are you?
app.UseAuthorization();           // what may you do?

app.MapControllers();
app.MapHealthChecks("/health");

app.Run();

[HttpPut("{id:int}")]
[Authorize]
public async Task<IActionResult> Update(
    int id, UpdateTaskRequest request, CancellationToken ct)
{
    var userId = int.Parse(User.FindFirstValue(ClaimTypes.NameIdentifier)!);
    var isAdmin = User.IsInRole("Admin");

    var result = await _service.UpdateAsync(id, request, userId, isAdmin, ct);

    return result.Status switch
    {
        UpdateStatus.NotFound  => NotFound(),
        UpdateStatus.Forbidden => Forbid(),
        UpdateStatus.Updated   => Ok(result.Task),
        _ => StatusCode(StatusCodes.Status500InternalServerError)
    };
}

public async Task<PagedResult<TaskDto>> QueryAsync(TaskQuery query, CancellationToken ct)
{
    IQueryable<TaskItem> tasks = _db.Tasks.AsNoTracking();

    if (query.Status is not null)
        tasks = tasks.Where(t => t.Status == query.Status);

    if (!string.IsNullOrWhiteSpace(query.Search))
        tasks = tasks.Where(t => t.Title.Contains(query.Search));

    tasks = query.SortBy?.ToLowerInvariant() switch
    {
        "duedate" => query.Desc ? tasks.OrderByDescending(t => t.DueDate)
                                : tasks.OrderBy(t => t.DueDate),
        "title"   => query.Desc ? tasks.OrderByDescending(t => t.Title)
                                : tasks.OrderBy(t => t.Title),
        _         => tasks.OrderByDescending(t => t.CreatedAt)
    };

    var total = await tasks.CountAsync(ct);
    var items = await tasks.Skip((query.Page - 1) * query.PageSize)
                           .Take(query.PageSize)
                           .Select(t => t.ToDto())
                           .ToListAsync(ct);

    return new PagedResult<TaskDto>(items, query.Page, query.PageSize, total);
}

[ApiController]
[ApiVersion("1.0")]
[ApiVersion("2.0")]
[Route("api/v{version:apiVersion}/tasks")]
public class TasksController : ControllerBase
{
    [HttpGet("{id:int}")]
    [MapToApiVersion("1.0")]
    public async Task<ActionResult<TaskDto>> GetV1(int id, CancellationToken ct)
        => await _service.GetAsync(id, ct) is { } dto ? Ok(dto) : NotFound();

    [HttpGet("{id:int}")]
    [MapToApiVersion("2.0")]
    public async Task<ActionResult<TaskDetailDto>> GetV2(int id, CancellationToken ct)
        => await _service.GetDetailAsync(id, ct) is { } dto ? Ok(dto) : NotFound();
}

{
  "type": "https://tools.ietf.org/html/rfc9110#section-15.5.1",
  "title": "One or more validation errors occurred.",
  "status": 400,
  "traceId": "00-4bf92f3577b34da6a3ce929d0e0e4736-00f067aa0ba902b7-01",
  "errors": {
    "Title": [ "Title is required." ],
    "DueDate": [ "DueDate must be in the future." ]
  }
}

public class TaskServiceTests
{
    [Fact]
    public async Task UpdateAsync_ReturnsForbidden_WhenCallerIsNotOwnerOrAdmin()
    {
        var repository = new Mock<ITaskRepository>();
        repository.Setup(r => r.GetByIdAsync(42, It.IsAny<CancellationToken>()))
                  .ReturnsAsync(new TaskItem { Id = 42, OwnerId = 7 });

        var sut = new TaskService(repository.Object);

        var result = await sut.UpdateAsync(
            42, new UpdateTaskRequest("New title"),
            userId: 9, isAdmin: false, CancellationToken.None);

        Assert.Equal(UpdateStatus.Forbidden, result.Status);
        repository.Verify(r => r.SaveAsync(It.IsAny<CancellationToken>()), Times.Never);
    }
}

FROM mcr.microsoft.com/dotnet/sdk:8.0 AS build
WORKDIR /src
COPY TaskApi.sln .
COPY src/TaskApi/TaskApi.csproj src/TaskApi/
RUN dotnet restore src/TaskApi/TaskApi.csproj
COPY . .
RUN dotnet publish src/TaskApi/TaskApi.csproj -c Release -o /app/publish

FROM mcr.microsoft.com/dotnet/aspnet:8.0 AS final
WORKDIR /app
COPY --from=build /app/publish .
EXPOSE 8080
ENV ASPNETCORE_URLS=http://+:8080
ENTRYPOINT ["dotnet", "TaskApi.dll"]

# .gitignore must cover at least these
appsettings.*.json
.env
*.pfx

# Development secrets live outside the repository
dotnet user-secrets init --project src/TaskApi
dotnet user-secrets set "Jwt:Key" "development-only-key-at-least-32-chars"

# Search the whole history, not just the working tree
git log --all -p -S "Jwt:Key" -- appsettings.json
git log --all --name-only --diff-filter=A | grep -i "\.env$"

# 1. Clean build with warnings treated as errors
dotnet build -warnaserror

# 2. Tests green
dotnet test --logger "console;verbosity=normal"

# 3. Schema reproducible from scratch
dotnet ef database update --project src/TaskApi

# 4. Container builds and boots
docker build -t taskapi:capstone -f src/TaskApi/Dockerfile .
docker run --rm -p 8080:8080 --env-file .env.local taskapi:capstone

# 5. Health endpoint answers
curl -f http://localhost:8080/health && echo "READY"

# 1. Register a fresh user
curl -X POST https://localhost:7001/api/v1/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"amina@example.com","password":"Str0ng!Pass"}'

# 2. Log in and capture the token
TOKEN=$(curl -s -X POST https://localhost:7001/api/v1/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"amina@example.com","password":"Str0ng!Pass"}' \
  | jq -r .accessToken)

# 3. Create a task — expect 201 and a Location header
curl -i -X POST https://localhost:7001/api/v1/tasks \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"title":"Prepare the demo","dueDate":"2026-08-10T00:00:00Z"}'

# 4. List with filter, sort and paging applied
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://localhost:7001/api/v1/tasks?status=InProgress&sortBy=dueDate&page=1&pageSize=5"

# 401 — no token at all
curl -i -X POST https://localhost:7001/api/v1/tasks -d '{}'
# HTTP/1.1 401 Unauthorized

# 403 — a valid token, but the caller is neither owner nor Admin
curl -i -X DELETE https://localhost:7001/api/v1/tasks/42 \
  -H "Authorization: Bearer $OTHER_USER_TOKEN"
# HTTP/1.1 403 Forbidden

# 429 — rate limiter on the login endpoint
for i in $(seq 1 10); do
  curl -s -o /dev/null -w "%{http_code} " -X POST \
    https://localhost:7001/api/v1/auth/login -d '{}'
done
# 400 400 400 400 400 429 429 429 429 429

Pick one decision that required judgement. Strong candidates:

public record GetTaskByIdQuery(int Id) : IRequest<TaskDto?>;

public class GetTaskByIdHandler : IRequestHandler<GetTaskByIdQuery, TaskDto?>
{
    private readonly AppDbContext _db;
    public GetTaskByIdHandler(AppDbContext db) => _db = db;

    public Task<TaskDto?> Handle(GetTaskByIdQuery request, CancellationToken ct) =>
        _db.Tasks.AsNoTracking()
                 .Where(t => t.Id == request.Id)
                 .Select(t => t.ToDto())
                 .FirstOrDefaultAsync(ct);
}

// The controller collapses to one line per endpoint
[HttpGet("{id:int}")]
public async Task<IActionResult> Get(int id, CancellationToken ct) =>
    await _mediator.Send(new GetTaskByIdQuery(id), ct) is { } dto ? Ok(dto) : NotFound();

builder.Services.AddStackExchangeRedisCache(options =>
{
    options.Configuration = builder.Configuration.GetConnectionString("Redis");
    options.InstanceName = "taskapi:";
});

public async Task<TaskDto?> GetAsync(int id, CancellationToken ct)
{
    var key = $"task:{id}";
    var cached = await _cache.GetStringAsync(key, ct);
    if (cached is not null)
        return JsonSerializer.Deserialize<TaskDto>(cached);

    var dto = await _repository.GetDtoAsync(id, ct);
    if (dto is not null)
        await _cache.SetStringAsync(key, JsonSerializer.Serialize(dto),
            new DistributedCacheEntryOptions
            {
                AbsoluteExpirationRelativeToNow = TimeSpan.FromMinutes(5)
            }, ct);

    return dto;
}

There is no Session 26. This is where the syllabus ends and your own roadmap starts.

• Ship the capstone publicly. A live URL and a clean README are the portfolio piece — not the code alone
• Go deeper before going wider. One advanced topic taken to production beats five skimmed tutorials
• Read other people's APIs. Stripe, GitHub, and Twilio documentation will teach you API design faster than any course
• Contribute or collaborate. Reviewing someone else's pull request builds judgement that solo work cannot
• Keep the repository alive. An API you still maintain in six months says more than one you finished in a weekend

Submit the finished capstone: a repository link plus a README.md that lets a stranger run your API in under five minutes.

• All thirteen checklist items complete, each mapped in the README to the file or command that proves it
• A clean clone passes dotnet build -warnaserror, dotnet test, and docker build with no manual edits
• A Postman collection committed to the repository covering the happy path plus a deliberate 401, 403, and 429
• git log --all -S finds no connection string, JWT key, or password anywhere in history
• A RETROSPECTIVE.md of roughly 300 words: hardest problem, what you would redo, and the one topic you will learn next