Managing API authorization

A computer-implemented method for processing requests, comprising:

• under the control of one or more computer systems configured with executable instructions,
• determining a request object including first metadata, the request object associated with a variant and a request;
• determining an inspection to perform based at least in part on the first metadata;
• inspecting the request object, based at least in part on the determined inspection, to determine if the request is available for processing, the request object having a plurality of non-public fields contained in the request object;
• validating that the request is available for processing, based at least in part on the plurality of non-public fields contained in the request object;
• as a result of the determining that the request is available for use:
• processing the request object;
• invoking a post-processor based at least in part on second metadata of a return object formed from the processing the request object, the post-processor processing one or more fields of the return object to be consistent with the variant and the request.

A computer system for managing request variants, comprising:

• one or more computing resources having one or more processors and memory including executable instructions that, when executed by the one or more processors, cause the one or more processors to implement at least:
• a pre-processor that performs an inspection on a request object and determines whether the request object represents an authorized request to use a variant of a request represented by the request object based at least in part on the pre-processor validating one or more fields contained in the request object;
• a post-processor that inspects proposed return information after processing the request object to ensure the proposed return information is compatible with the variant of the request represented by the request object;
• a request processor that receives requests having different variants through an application programming interface, constructing the request object having metadata that dynamically identifies the pre-processor at runtime, providing to the pre-processor the request object to determine whether the request object is authorized to be processed, processing the request object that has been determined to be authorized by the pre-processor and providing the proposed return information from the processing of the request object to the post-processor.

One or more non-transitory computer-readable storage media having collectively stored thereon executable instructions that, when executed by one or more processors of a computer system, cause the computer system to at least:

• tag a class of request objects with tag information to identify a request handler to process instances from the class of request objects, the class of request objects supporting multiple variants of a request;
• process a received request using the class of request objects into a client request instance associated with a variant;
• invoke the request handler, based at least in part on the tag information, to process the client request instance to determine if a client is authorized to perform the variant associated with the received request based at least in part on validating one or more fields contained in the client request instance;
• and
• process the client request instance when the client is determined to be authorized.