Update api-endpoint-auth.md

Author: wadepickett

aspnetcore/security/authentication/api-endpoint-auth.md

@@ -9,61 +9,42 @@ ms.date: 08/06/2025
 uid: security/authentication/api-endpoint-auth
 ---
 
+---
+title: API endpoint authentication behavior in ASP.NET Core
+author: wadepickett
+description todescription: Learn how ASP.NET Core handles authentication failures for API endpoints using cookie authentication.
+ai-usage: ai-assisted
+monikerRange: '>= aspnetcore-10.0'
+ms.author: wpickett
+ms.date: 08/06/2025
+uid: security/authentication/api-endpoint-auth
+---
+
 # API endpoint authentication behavior in ASP.NET Core
 
 :::moniker range=">= aspnetcore-10.0"
 
-When using cookie authentication, API endpoints return the appropriate HTTP status codes (such as 401 or 403) for authentication failures instead of redirecting unauthenticated requests to login pages. This behavior, which is more suitable for programmatic API access, was introduced in ASP.NET Core in .NET 10.
-
-## The problem
+When using cookie authentication, API endpoints return appropriate HTTP status codes—such as 401 (Unauthorized) or 403 (Forbidden)—when authentication fails. This approach avoids redirecting unauthenticated requests login pages, which is more suitable for programmatic access scenarios like API clients. This behavior was introduced starting with ASP.NET Core in .NET 10.
 
-In previous versions of ASP.NET Core, when using cookie authentication, all unauthenticated requests would trigger a redirect to the configured login page. This behavior was problematic for API endpoints because:
+## How ASP.NET Core identifies API endpoints
 
-- API clients don't expect HTML login pages
-- Redirects return 302 status codes instead of proper 401/403 codes
-- API clients need clear HTTP status codes to handle authentication failures appropriately
+ASP.NET Core automatically applies this behavior to endpoints it recognizes as API-related, including:
 
-## The solution in ASP.NET Core 10
-
-ASP.NET Core 10 automatically detects known API endpoints and modifies the authentication behavior:
-
-- **Web pages**: Continue to redirect to login pages as before
-- **API endpoints**: Return appropriate 401 (Unauthorized) or 403 (Forbidden) status codes without redirects
-
-## Which endpoints are considered API endpoints?
-
-The framework automatically identifies the following as API endpoints:
-
-- Controllers decorated with `[ApiController]` attribute
+- Controllers decorated with the `[ApiController]` attribute
 - Minimal API endpoints registered with `MapGet`, `MapPost`, `MapPut`, `MapDelete`, etc.
 - Endpoints that explicitly request JSON responses
 - SignalR hubs and endpoints
 
-## Behavior differences
-
-### Before ASP.NET Core 10
+## Default behavior and customization
 
-```http
-GET /api/secure-data HTTP/1.1
-Host: example.com
+By default, ASP.NET Core applies cookie authentication logic based on the endpoint type:
 
-HTTP/1.1 302 Found
-Location: /Account/Login?ReturnUrl=%2Fapi%2Fsecure-data
-```
-
-### ASP.NET Core 10 and later
-
-```http
-GET /api/secure-data HTTP/1.1
-Host: example.com
-
-HTTP/1.1 401 Unauthorized
-WWW-Authenticate: Cookie
-```
+- **Web pages**: Redirect to login pages
+- **API endpoints**: Return 401 or 403 status codes without redirects
 
 ## Configuring the behavior
 
-While the default behavior works for most scenarios, you can customize it if needed:
+While the default behavior works for most scenarios, it can be customize if needed:
 
 ```csharp
 builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
@@ -75,7 +56,7 @@ builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationSc
     });
 ```
 
-If you need to override the automatic detection for specific endpoints, you can use the `[Authorize]` attribute with specific authentication schemes or implement custom authentication handlers.
+If you need to override the automatic detection for specific endpoints, use the `[Authorize]` attribute with specific authentication schemes or implement custom authentication handlers.
 
 ## Migration considerations
 
@@ -106,4 +87,4 @@ public async Task UnauthorizedApiRequest_Returns401()
 - <xref:fundamentals/minimal-apis/responses>
 - <xref:signalr/authn-and-authz>
 
-:::moniker-range-end
+:::moniker-range-end