.NET 10 is the current Long-Term Support (LTS) release, bringing native validation for Minimal APIs, OpenAPI 3.1 by default, and significant performance improvements. ASP.NET Core combines C# with a modular architecture suited for enterprise applications. This guide covers building a production-ready REST API from initial setup to deployment.

.NET 10 LTS

.NET 10 is supported until late 2028. Built-in validation for Minimal APIs, OpenAPI 3.1 support, and Native AOT improvements make it the optimal choice for new API projects.

Project Setup with .NET 10 CLI

Creating an ASP.NET Core API project uses the .NET CLI to generate an optimized project structure. Configuring essential NuGet packages prepares the foundation for development.

bash

# terminal
# Check installed .NET version
dotnet --version
# Expected: 10.0.x

# Create the API project
dotnet new webapi -n ProductApi -o ProductApi
cd ProductApi

# Add essential packages
dotnet add package Microsoft.EntityFrameworkCore.SqlServer
dotnet add package Microsoft.EntityFrameworkCore.Design
dotnet add package Swashbuckle.AspNetCore

These commands create an API project with dependencies for Entity Framework Core and Swagger documentation. Note that FluentValidation is no longer required for basic validation in .NET 10.

Program.cscsharp

using Microsoft.EntityFrameworkCore;
using ProductApi.Data;
using ProductApi.Services;

var builder = WebApplication.CreateBuilder(args);

// Configure Entity Framework Core with SQL Server
builder.Services.AddDbContext<AppDbContext>(options =>
    options.UseSqlServer(builder.Configuration.GetConnectionString("DefaultConnection")));

// Register business services
builder.Services.AddScoped<IProductService, ProductService>();
builder.Services.AddScoped<ICategoryService, CategoryService>();

// Configure controllers with built-in validation (.NET 10)
builder.Services.AddControllers();
builder.Services.AddValidation();

// Configure OpenAPI 3.1 (default in .NET 10)
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen(c =>
{
    c.SwaggerDoc("v1", new() { Title = "Product API", Version = "v1" });
});

var app = builder.Build();

// Middleware pipeline
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseHttpsRedirection();
app.UseAuthorization();
app.MapControllers();

app.Run();

The AddValidation() method enables built-in validation introduced in ASP.NET Core 10, eliminating the need for third-party libraries like FluentValidation for common scenarios.

Data Models and Entity Framework Core 10

Models represent the business entities of the application. Entity Framework Core handles object-relational mapping with fluent configuration and smart conventions.

Models/Product.cscsharp

namespace ProductApi.Models;

public class Product
{
    // Primary key with auto-increment
    public int Id { get; set; }

    // Required properties (non-nullable in C# 14)
    public required string Name { get; set; }
    public required string Description { get; set; }

    // Price with decimal precision
    public decimal Price { get; set; }

    // Stock with default value
    public int StockQuantity { get; set; } = 0;

    // Product status
    public bool IsActive { get; set; } = true;

    // Relationship with Category (foreign key)
    public int CategoryId { get; set; }
    public Category? Category { get; set; }

    // Automatic tracking dates
    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
    public DateTime? UpdatedAt { get; set; }
}

The required keyword ensures essential properties are always initialized during creation.

Models/Category.cscsharp

namespace ProductApi.Models;

public class Category
{
    public int Id { get; set; }

    public required string Name { get; set; }

    // Slug for friendly URLs
    public required string Slug { get; set; }

    public string? Description { get; set; }

    // Inverse navigation: list of products in this category
    public ICollection<Product> Products { get; set; } = new List<Product>();

    public DateTime CreatedAt { get; set; } = DateTime.UtcNow;
}

Data/AppDbContext.cscsharp

using Microsoft.EntityFrameworkCore;
using ProductApi.Models;

namespace ProductApi.Data;

public class AppDbContext : DbContext
{
    public AppDbContext(DbContextOptions<AppDbContext> options) : base(options)
    {
    }

    // DbSets for each entity
    public DbSet<Product> Products => Set<Product>();
    public DbSet<Category> Categories => Set<Category>();

    protected override void OnModelCreating(ModelBuilder modelBuilder)
    {
        // Product entity configuration
        modelBuilder.Entity<Product>(entity =>
        {
            // Index on name for fast search
            entity.HasIndex(p => p.Name);

            // Price precision: 18 digits, 2 decimals
            entity.Property(p => p.Price)
                .HasPrecision(18, 2);

            // Relationship with Category
            entity.HasOne(p => p.Category)
                .WithMany(c => c.Products)
                .HasForeignKey(p => p.CategoryId)
                .OnDelete(DeleteBehavior.Restrict);
        });

        // Category entity configuration
        modelBuilder.Entity<Category>(entity =>
        {
            // Unique slug
            entity.HasIndex(c => c.Slug).IsUnique();

            // Maximum name length
            entity.Property(c => c.Name).HasMaxLength(100);
        });
    }
}

The Fluent API configuration provides precise control over the database schema generated by EF Core migrations.

Entity Framework Core Migrations

Migrations version the database schema. Run dotnet ef migrations add InitialCreate then dotnet ef database update to apply changes.

DTOs and Built-in Validation in ASP.NET Core 10

DTOs (Data Transfer Objects) separate domain models from data exposed via the API. ASP.NET Core 10 introduces built-in validation using DataAnnotations, removing the need for third-party libraries in most cases.

DTOs/ProductDtos.cscsharp

using System.ComponentModel.DataAnnotations;

namespace ProductApi.DTOs;

// DTO for product creation with DataAnnotations
public record CreateProductDto(
    [Required(ErrorMessage = "Product name is required.")]
    [MaxLength(200, ErrorMessage = "Name cannot exceed 200 characters.")]
    string Name,

    [Required(ErrorMessage = "Description is required.")]
    [MinLength(10, ErrorMessage = "Description must contain at least 10 characters.")]
    string Description,

    [Range(0.01, 999999.99, ErrorMessage = "Price must be between 0.01 and 999,999.99.")]
    decimal Price,

    [Range(0, int.MaxValue, ErrorMessage = "Stock cannot be negative.")]
    int StockQuantity,

    [Required(ErrorMessage = "A valid category is required.")]
    int CategoryId
);

// DTO for product update
public record UpdateProductDto(
    [MaxLength(200)]
    string? Name,
    string? Description,
    [Range(0.01, 999999.99)]
    decimal? Price,
    [Range(0, int.MaxValue)]
    int? StockQuantity,
    bool? IsActive
);

// DTO for response (read)
public record ProductDto(
    int Id,
    string Name,
    string Description,
    decimal Price,
    int StockQuantity,
    bool IsActive,
    string CategoryName,
    DateTime CreatedAt
);

// DTO for list with pagination
public record ProductListDto(
    int Id,
    string Name,
    decimal Price,
    int StockQuantity,
    bool IsActive,
    string CategoryName
);

Using C# records makes DTOs immutable and concise, with automatic value equality. The built-in validation automatically returns structured 400 errors when validation fails. For interview preparation on ASP.NET Core patterns, see the ASP.NET Core interview questions guide.

Ready to ace your .NET interviews?

Practice with our interactive simulators, flashcards, and technical tests.

Explore .NET

Business Services and Abstraction Layer

The service layer encapsulates business logic and database operations, facilitating testing and maintenance.

Services/IProductService.cscsharp

using ProductApi.DTOs;

namespace ProductApi.Services;

public interface IProductService
{
    // Retrieval with pagination
    Task<(IEnumerable<ProductListDto> Items, int TotalCount)> GetAllAsync(
        int page = 1,
        int pageSize = 10,
        string? search = null,
        int? categoryId = null);

    // Retrieval by ID
    Task<ProductDto?> GetByIdAsync(int id);

    // Creation
    Task<ProductDto> CreateAsync(CreateProductDto dto);

    // Update
    Task<ProductDto?> UpdateAsync(int id, UpdateProductDto dto);

    // Deletion
    Task<bool> DeleteAsync(int id);
}

Services/ProductService.cscsharp

using Microsoft.EntityFrameworkCore;
using ProductApi.Data;
using ProductApi.DTOs;
using ProductApi.Models;

namespace ProductApi.Services;

public class ProductService : IProductService
{
    private readonly AppDbContext _context;

    public ProductService(AppDbContext context)
    {
        _context = context;
    }

    public async Task<(IEnumerable<ProductListDto> Items, int TotalCount)> GetAllAsync(
        int page = 1,
        int pageSize = 10,
        string? search = null,
        int? categoryId = null)
    {
        // Build base query
        var query = _context.Products
            .Include(p => p.Category)
            .AsQueryable();

        // Filter by text search
        if (!string.IsNullOrWhiteSpace(search))
        {
            query = query.Where(p =>
                p.Name.Contains(search) ||
                p.Description.Contains(search));
        }

        // Filter by category
        if (categoryId.HasValue)
        {
            query = query.Where(p => p.CategoryId == categoryId.Value);
        }

        // Total count before pagination
        var totalCount = await query.CountAsync();

        // Apply pagination
        var items = await query
            .OrderByDescending(p => p.CreatedAt)
            .Skip((page - 1) * pageSize)
            .Take(pageSize)
            .Select(p => new ProductListDto(
                p.Id,
                p.Name,
                p.Price,
                p.StockQuantity,
                p.IsActive,
                p.Category!.Name))
            .ToListAsync();

        return (items, totalCount);
    }

    public async Task<ProductDto?> GetByIdAsync(int id)
    {
        // Retrieve with category inclusion
        var product = await _context.Products
            .Include(p => p.Category)
            .FirstOrDefaultAsync(p => p.Id == id);

        if (product == null) return null;

        // Map to DTO
        return new ProductDto(
            product.Id,
            product.Name,
            product.Description,
            product.Price,
            product.StockQuantity,
            product.IsActive,
            product.Category?.Name ?? "Uncategorized",
            product.CreatedAt);
    }

    public async Task<ProductDto> CreateAsync(CreateProductDto dto)
    {
        // Create entity
        var product = new Product
        {
            Name = dto.Name,
            Description = dto.Description,
            Price = dto.Price,
            StockQuantity = dto.StockQuantity,
            CategoryId = dto.CategoryId
        };

        // Add and save
        _context.Products.Add(product);
        await _context.SaveChangesAsync();

        // Load category for response
        await _context.Entry(product)
            .Reference(p => p.Category)
            .LoadAsync();

        return new ProductDto(
            product.Id,
            product.Name,
            product.Description,
            product.Price,
            product.StockQuantity,
            product.IsActive,
            product.Category?.Name ?? "Uncategorized",
            product.CreatedAt);
    }

    public async Task<ProductDto?> UpdateAsync(int id, UpdateProductDto dto)
    {
        // Retrieve existing entity
        var product = await _context.Products
            .Include(p => p.Category)
            .FirstOrDefaultAsync(p => p.Id == id);

        if (product == null) return null;

        // Conditional field updates
        if (!string.IsNullOrEmpty(dto.Name))
            product.Name = dto.Name;

        if (!string.IsNullOrEmpty(dto.Description))
            product.Description = dto.Description;

        if (dto.Price.HasValue)
            product.Price = dto.Price.Value;

        if (dto.StockQuantity.HasValue)
            product.StockQuantity = dto.StockQuantity.Value;

        if (dto.IsActive.HasValue)
            product.IsActive = dto.IsActive.Value;

        // Update modification date
        product.UpdatedAt = DateTime.UtcNow;

        await _context.SaveChangesAsync();

        return new ProductDto(
            product.Id,
            product.Name,
            product.Description,
            product.Price,
            product.StockQuantity,
            product.IsActive,
            product.Category?.Name ?? "Uncategorized",
            product.CreatedAt);
    }

    public async Task<bool> DeleteAsync(int id)
    {
        // Direct deletion without prior loading (EF Core 7+)
        var result = await _context.Products
            .Where(p => p.Id == id)
            .ExecuteDeleteAsync();

        return result > 0;
    }
}

Using ExecuteDeleteAsync improves performance by avoiding entity loading before deletion. For advanced patterns, see the Clean Architecture with .NET guide.

API Controllers and REST Endpoints

Controllers expose REST endpoints and orchestrate calls to business services with appropriate HTTP status code handling.

Controllers/ProductsController.cscsharp

using Microsoft.AspNetCore.Mvc;
using ProductApi.DTOs;
using ProductApi.Services;

namespace ProductApi.Controllers;

[ApiController]
[Route("api/[controller]")]
[Produces("application/json")]
public class ProductsController : ControllerBase
{
    private readonly IProductService _productService;

    public ProductsController(IProductService productService)
    {
        _productService = productService;
    }

    /// <summary>
    /// Retrieves the list of products with pagination and filters.
    /// </summary>
    [HttpGet]
    [ProducesResponseType(typeof(PaginatedResponse<ProductListDto>), StatusCodes.Status200OK)]
    public async Task<IActionResult> GetAll(
        [FromQuery] int page = 1,
        [FromQuery] int pageSize = 10,
        [FromQuery] string? search = null,
        [FromQuery] int? categoryId = null)
    {
        // Validate pagination parameters
        if (page < 1) page = 1;
        if (pageSize < 1 || pageSize > 100) pageSize = 10;

        var (items, totalCount) = await _productService.GetAllAsync(
            page, pageSize, search, categoryId);

        // Standardized paginated response
        var response = new PaginatedResponse<ProductListDto>
        {
            Items = items,
            Page = page,
            PageSize = pageSize,
            TotalCount = totalCount,
            TotalPages = (int)Math.Ceiling(totalCount / (double)pageSize)
        };

        return Ok(response);
    }

    /// <summary>
    /// Retrieves a product by its identifier.
    /// </summary>
    [HttpGet("{id:int}")]
    [ProducesResponseType(typeof(ProductDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    public async Task<IActionResult> GetById(int id)
    {
        var product = await _productService.GetByIdAsync(id);

        if (product == null)
        {
            return NotFound(new { message = $"Product with ID {id} not found." });
        }

        return Ok(product);
    }

    /// <summary>
    /// Creates a new product.
    /// </summary>
    [HttpPost]
    [ProducesResponseType(typeof(ProductDto), StatusCodes.Status201Created)]
    [ProducesResponseType(StatusCodes.Status400BadRequest)]
    public async Task<IActionResult> Create([FromBody] CreateProductDto dto)
    {
        // Validation is automatic via AddValidation()
        var product = await _productService.CreateAsync(dto);

        // Returns 201 with the created resource URL
        return CreatedAtAction(
            nameof(GetById),
            new { id = product.Id },
            product);
    }

    /// <summary>
    /// Updates an existing product.
    /// </summary>
    [HttpPut("{id:int}")]
    [ProducesResponseType(typeof(ProductDto), StatusCodes.Status200OK)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    [ProducesResponseType(StatusCodes.Status400BadRequest)]
    public async Task<IActionResult> Update(int id, [FromBody] UpdateProductDto dto)
    {
        var product = await _productService.UpdateAsync(id, dto);

        if (product == null)
        {
            return NotFound(new { message = $"Product with ID {id} not found." });
        }

        return Ok(product);
    }

    /// <summary>
    /// Deletes a product.
    /// </summary>
    [HttpDelete("{id:int}")]
    [ProducesResponseType(StatusCodes.Status204NoContent)]
    [ProducesResponseType(StatusCodes.Status404NotFound)]
    public async Task<IActionResult> Delete(int id)
    {
        var deleted = await _productService.DeleteAsync(id);

        if (!deleted)
        {
            return NotFound(new { message = $"Product with ID {id} not found." });
        }

        // 204 No Content for successful deletion
        return NoContent();
    }
}

The ProducesResponseType attributes document possible response codes for automatic Swagger documentation generation.

DTOs/PaginatedResponse.cscsharp

namespace ProductApi.DTOs;

public class PaginatedResponse<T>
{
    public IEnumerable<T> Items { get; set; } = Enumerable.Empty<T>();
    public int Page { get; set; }
    public int PageSize { get; set; }
    public int TotalCount { get; set; }
    public int TotalPages { get; set; }
    public bool HasPreviousPage => Page > 1;
    public bool HasNextPage => Page < TotalPages;
}

Route Constraints

Using constraints like {id:int} prevents routing conflicts and automatically returns a 404 if the format is incorrect.

Global Error Handling Middleware

An error handling middleware centralizes exception processing for consistent and secure responses.

Middleware/ExceptionMiddleware.cscsharp

using System.Net;
using System.Text.Json;

namespace ProductApi.Middleware;

public class ExceptionMiddleware
{
    private readonly RequestDelegate _next;
    private readonly ILogger<ExceptionMiddleware> _logger;
    private readonly IHostEnvironment _env;

    public ExceptionMiddleware(
        RequestDelegate next,
        ILogger<ExceptionMiddleware> logger,
        IHostEnvironment env)
    {
        _next = next;
        _logger = logger;
        _env = env;
    }

    public async Task InvokeAsync(HttpContext context)
    {
        try
        {
            // Continue pipeline
            await _next(context);
        }
        catch (Exception ex)
        {
            // Log the error
            _logger.LogError(ex, "An unhandled exception occurred");

            // Prepare response
            context.Response.ContentType = "application/json";
            context.Response.StatusCode = (int)HttpStatusCode.InternalServerError;

            // Different response based on environment
            var response = _env.IsDevelopment()
                ? new ErrorResponse(
                    StatusCode: context.Response.StatusCode,
                    Message: ex.Message,
                    Details: ex.StackTrace)
                : new ErrorResponse(
                    StatusCode: context.Response.StatusCode,
                    Message: "An internal error occurred.",
                    Details: null);

            // Serialize with camelCase options
            var options = new JsonSerializerOptions
            {
                PropertyNamingPolicy = JsonNamingPolicy.CamelCase
            };

            var json = JsonSerializer.Serialize(response, options);
            await context.Response.WriteAsync(json);
        }
    }
}

// DTO for error responses
public record ErrorResponse(int StatusCode, string Message, string? Details);

// Extension to register middleware
public static class ExceptionMiddlewareExtensions
{
    public static IApplicationBuilder UseExceptionMiddleware(this IApplicationBuilder app)
    {
        return app.UseMiddleware<ExceptionMiddleware>();
    }
}

Program.cs (adding middleware)csharp

var app = builder.Build();

// Exception middleware must be first
app.UseExceptionMiddleware();

if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}
// ... rest of configuration

Configuration and Environment Variables

Externalized configuration allows adapting the application to different environments without code changes.

appsettings.jsonjson

{
  "ConnectionStrings": {
    "DefaultConnection": "Server=localhost;Database=ProductDb;User Id=sa;Password=YourPassword;TrustServerCertificate=true"
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning",
      "Microsoft.EntityFrameworkCore": "Warning"
    }
  },
  "ApiSettings": {
    "DefaultPageSize": 10,
    "MaxPageSize": 100,
    "ApiVersion": "1.0"
  }
}

Configuration/ApiSettings.cscsharp

namespace ProductApi.Configuration;

public class ApiSettings
{
    public int DefaultPageSize { get; set; } = 10;
    public int MaxPageSize { get; set; } = 100;
    public string ApiVersion { get; set; } = "1.0";
}

Program.cs (injecting configuration)csharp

builder.Services.Configure<ApiSettings>(
    builder.Configuration.GetSection("ApiSettings"));

// Usage in a service
public class ProductService : IProductService
{
    private readonly ApiSettings _settings;

    public ProductService(IOptions<ApiSettings> settings)
    {
        _settings = settings.Value;
    }
}

Unit Testing with xUnit

Unit tests validate the behavior of services and controllers in isolation.

Tests/ProductServiceTests.cscsharp

using Microsoft.EntityFrameworkCore;
using ProductApi.Data;
using ProductApi.DTOs;
using ProductApi.Models;
using ProductApi.Services;
using Xunit;

namespace ProductApi.Tests;

public class ProductServiceTests
{
    private AppDbContext CreateInMemoryContext()
    {
        // Configure in-memory database
        var options = new DbContextOptionsBuilder<AppDbContext>()
            .UseInMemoryDatabase(databaseName: Guid.NewGuid().ToString())
            .Options;

        return new AppDbContext(options);
    }

    [Fact]
    public async Task CreateAsync_ValidDto_ReturnsProductDto()
    {
        // Arrange
        using var context = CreateInMemoryContext();

        // Add test category
        var category = new Category { Id = 1, Name = "Electronics", Slug = "electronics" };
        context.Categories.Add(category);
        await context.SaveChangesAsync();

        var service = new ProductService(context);
        var dto = new CreateProductDto(
            Name: "Test Product",
            Description: "Test Description",
            Price: 99.99m,
            StockQuantity: 10,
            CategoryId: 1);

        // Act
        var result = await service.CreateAsync(dto);

        // Assert
        Assert.NotNull(result);
        Assert.Equal("Test Product", result.Name);
        Assert.Equal(99.99m, result.Price);
        Assert.Equal("Electronics", result.CategoryName);
    }

    [Fact]
    public async Task GetByIdAsync_NonExistent_ReturnsNull()
    {
        // Arrange
        using var context = CreateInMemoryContext();
        var service = new ProductService(context);

        // Act
        var result = await service.GetByIdAsync(999);

        // Assert
        Assert.Null(result);
    }

    [Fact]
    public async Task DeleteAsync_ExistingProduct_ReturnsTrue()
    {
        // Arrange
        using var context = CreateInMemoryContext();

        var category = new Category { Id = 1, Name = "Test", Slug = "test" };
        var product = new Product
        {
            Id = 1,
            Name = "To Delete",
            Description = "Will be deleted",
            Price = 10.00m,
            CategoryId = 1
        };

        context.Categories.Add(category);
        context.Products.Add(product);
        await context.SaveChangesAsync();

        var service = new ProductService(context);

        // Act
        var result = await service.DeleteAsync(1);

        // Assert
        Assert.True(result);
        Assert.Null(await context.Products.FindAsync(1));
    }
}

Tests are run with dotnet test from the project root. For more on EF Core performance patterns, including testing strategies, see the dedicated guide.

Sources

What's new in ASP.NET Core 10 - Built-in validation, OpenAPI 3.1 support
What's new in .NET 10 - LTS release details, C# 14 features
Entity Framework Core documentation - EF Core 10 updates
Announcing .NET 10 - Official release announcement

Checklist for Building Production .NET APIs

.NET 10 with ASP.NET Core provides a complete and performant ecosystem for building professional REST APIs. The combination of built-in validation, Entity Framework Core for data access, and native dependency injection enables maintainable and testable applications.

Separate DTOs from domain models
Implement a service layer for business logic
Use built-in validation with DataAnnotations (.NET 10+)
Configure global error handling middleware
Externalize configuration with IOptions
Write unit tests for services
Document the API with OpenAPI 3.1

Start practicing!

Test your knowledge with our interview simulators and technical tests.

Create my free account

The layered architecture (Controllers, Services, Repository/DbContext) promotes separation of concerns and facilitates application evolution. .NET 10 features like built-in validation, OpenAPI 3.1 by default, and improved Native AOT support modernize API development while improving performance.

.NET 10: Building a REST API with ASP.NET Core