The paths nobody tests

404, 401, 409 and the shape of the error body. The half of the API that only shows up in production.

Intermediate18 min on the clock5 graded checks · 100 pointsTesting an ASP.NET Core APIPro

Graded by reading your code against the checklist below.

What you build

Three failure paths asserted by exact status code, and the error body checked as ProblemDetails.

Published in full, before you start — every point is one of these and there is nothing else.

A 404 is asserted for something missing+20Failing in a shape callers can read
A 401 is asserted when no token is sent+20Roles and policies
The error body is checked as ProblemDetails+25Failing in a shape callers can read
A 409 is asserted for a duplicate+20Failing in a shape callers can read
It no longer leans on IsSuccessStatusCode+15Failing in a shape callers can read

A raw exception string tells the caller nothing they can act on; RFC 7807 ProblemDetails gives every failure the same machine-readable shape.

Authentication is who you are; authorization is what you are allowed to do. Policies keep that rule in one place instead of scattered if-statements.