FastAPI 0.162

Apply the included Pydantic 2.13 and Python 3 prompts. These rules cover FastAPI 0.162 applications, their dependencies, request and response handling, and deployment boundaries.

Authentication and authorization

• If adding Starlette Route entries with HTTPEndpoint classes, set an explicit methods allowlist and authorize every enabled handler, including HEAD where applicable; do not assume FastAPI path-operation dependencies protect direct Starlette routes.
• Put authentication and authorization in Depends or Security dependencies attached to every protected path operation or router. Check mounted applications separately; a parent application's dependencies do not secure an independent mounted app.
• Treat OAuth2PasswordBearer, HTTPBearer, and API-key helpers as credential extractors, not token verification. Verify the credential, load the current principal, reject disabled accounts, and authorize the operation and tenant-scoped object before side effects. With auto_error=False, explicitly reject missing credentials on protected routes. Send API keys in headers rather than query strings, and exclude them from examples and request logs.
• In JWT dependencies, apply the baseline's signature, issuer, audience, and expiry checks before trusting sub or scopes. Validate the subject and claim types; never let a signed token's resource identifier replace an object-access check. When tokens are verified with PyJWT, as the FastAPI tutorial does, also apply the PyJWT prompt.
• Enforce every scope in SecurityScopes.scopes in application code. When issuing