The requirement is declared, not wired: that is what makes it readable. A guard buried in a
middleware list protects the endpoint but tells nothing else about it, so the contract cannot say
the endpoint is protected and a caller reads its 401 as a bug. Declared on the route or the handler,
the same fact serves both the runtime and the documentation.
Anonymous callers get an AuthenticationError (401); an authenticated caller missing a scope gets
an InsufficientScopeError (403). Routes that declare nothing pass straight through.
Route middleware: enforce what a route or a handler declared it requires.
The requirement is declared, not wired: that is what makes it readable. A guard buried in a middleware list protects the endpoint but tells nothing else about it, so the contract cannot say the endpoint is protected and a caller reads its 401 as a bug. Declared on the route or the handler, the same fact serves both the runtime and the documentation.
Anonymous callers get an
AuthenticationError(401); an authenticated caller missing a scope gets anInsufficientScopeError(403). Routes that declare nothing pass straight through.