# Tony Champion

> Technical notes, articles, and deep dives on Azure, .NET, and modern developer practices.

This is an Authority Hub — a knowledge graph of atomic technical notes and
long-form articles, organized into pillars and topics. Every note documents
a real problem encountered in production and what actually resolved it.

Written by Tony Champion — 8x Microsoft MVP · .NET Consultant · Developer Educator.

Two content types. **Notes** are atomic: one problem, one resolution.
**Articles** are long-form and cover a subject end to end. **Series** are
ordered sets of either. Entries carry a status: `verified` means the
approach was confirmed in production, `published` means it is written up
and current. Dates below are publication dates; `reviewed` marks the last
time a claim was re-checked against a current runtime.

## Pillars

- [Apis](https://tonychampion.net/pillars/apis): Topics: Long Running Operations, Security, Idempotency, Background Processing, Performance, Observability, Resilience, Api Design, Webhooks
- [Azure Architecture](https://tonychampion.net/pillars/azure-architecture): Topics: Messaging

## Notes

- [Designing the Status Endpoint for a Long-Running API](https://tonychampion.net/notes/status-endpoint-design): The status endpoint is a contract. Publish a small, stable state vocabulary instead of your internal states, report a failed job as a successful status call, and pick one status code convention and hold it. (2026-11-13)
- [Idempotency Matters More Now That AI Is Calling Your API](https://tonychampion.net/notes/idempotency-ai-callers): AI agents decide at runtime how many times to call your API, which turns every POST into a retry risk. Make operations naturally idempotent where you can, detect and replay where you can't, and enforce it at write time. (2026-11-12)
- [Canonical Serialization: Why the Same Object Hashes Differently](https://tonychampion.net/notes/canonical-serialization-hashing): Serialization isn't canonical, so the same object can hash differently across systems. If a payload hash drives duplicate detection, sort the token tree with an ordinal comparer and decide arrays and nulls on purpose. (2026-11-11)
- [Assigning Operation IDs When Your API Returns a 202](https://tonychampion.net/notes/assigning-operation-ids-202): Using the client's ID as the operation ID will eventually point one customer at another customer's job. Key uniqueness on the client plus their value, and enforce authorization on every status call. (2026-11-10)
- [Service Bus Topics vs Queues: Which One Do You Actually Need?](https://tonychampion.net/notes/service-bus-topics-vs-queues): Most teams reach for a Service Bus topic because it sounds more flexible. Count workflows, not services: if one workflow consumes the message, a queue is the right call. (2026-11-09)
- [What 202 Accepted Actually Means for a Long-Running API](https://tonychampion.net/notes/202-accepted-long-running-api): A 202 is as easy to return as a 200. What it commits you to is validating before you accept, publishing a way to track the work, and having an answer ready when the work finishes and nobody is listening. (2026-11-08)
- [Webhooks Are Four Problems, Not One HTTP Call](https://tonychampion.net/notes/webhooks-are-four-problems): Calling a customer's URL sounds trivial. It's really four problems: who may subscribe, proving the call came from you, surviving their outage, and not slowing down the request that triggered it. (2026-11-05)
- [Idempotency-Key: Same Key, Same Outcome](https://tonychampion.net/notes/idempotency-key-header): A POST that timed out leaves the caller with nothing safe to do. An Idempotency-Key header, backed by a key derived into the data and a database that rejects duplicates, makes the retry safe. (2026-11-03)
- [The Gap Between Saving and Announcing](https://tonychampion.net/notes/gap-between-saving-and-announcing): Save the record, then publish the event, and a crash in between means nobody hears about it. The outbox pattern closes the gap, and the price is at-least-once delivery your handlers have to survive. (2026-10-29)
- [Retries Multiply: Designing How Your API Fails](https://tonychampion.net/notes/retries-multiply): Three layers that each retry 3 times turn one click into 27 database calls during an incident. Retry at one layer, fit every budget inside its caller's, and only retry writes that are safe to repeat. (2026-10-27)
- [Readiness Checks That Don't Turn a Slowdown Into an Outage](https://tonychampion.net/notes/readiness-checks-slowdown-outage): A health check that fails on slowness is powerful and easy to overdo. If every instance reports unready at once, the load balancer has nowhere to send traffic and your probe caused the outage. (2026-10-24)
- [Paging and Caching Decisions That Bite Later](https://tonychampion.net/notes/paging-caching-decisions): Making an API fast is easy. Making it fast without serving stale data or someone else's data means picking your paging shape before callers depend on it and never letting a cache key forget who asked. (2026-10-22)
- [CORS Is Not Security (and Your Rate Limiter Probably Isn't Global)](https://tonychampion.net/notes/cors-is-not-security): CORS only tells browsers what they may read, and the built-in rate limiter counts per instance. Both work in the demo and leak in production once you forget which assumption you were making. (2026-10-20)
- [403 or 404, and Other Authorization Calls to Make on Purpose](https://tonychampion.net/notes/403-or-404-authorization-decisions): A 403 tells the caller the thing exists. Which status you return on a denial, where identity comes from, and whether endpoints depend on how roles are issued are all decisions most APIs make by default. (2026-10-17)
- [What Counts as a Breaking Change in Your API](https://tonychampion.net/notes/what-counts-as-breaking-change-api): Cleaning up your error handling can break callers. Know which changes are breaking, keep validation rules where they belong, and version from day one so v1 gets deprecated on a schedule instead of broken on a Tuesday. (2026-10-15)
- [Vertical Slices or Controllers: What You Actually Trade](https://tonychampion.net/notes/vertical-slices-vs-controllers): Controller to service to store means a one-line change touches three folders. Vertical slices fix that, at the cost of some duplication and a conventions problem you should solve early. (2026-10-13)

## Optional

- [Full text of every entry](https://tonychampion.net/llms-full.txt): complete content, no crawling required
- [RSS feed](https://tonychampion.net/rss.xml): full content feed
- [Sitemap](https://tonychampion.net/sitemap-index.xml)
- [About the author](https://tonychampion.net/about)