ASP.NET Core remains a strong default for enterprise APIs — especially when teams already live in the Microsoft stack.
Contracts first
Version endpoints, validate inputs centrally, and keep DTOs explicit. Ambiguous JSON shapes create silent client bugs.
Auth and tenancy
Push identity and tenant resolution into middleware. Controllers should not reinvent authorization checks.
Observability
Structured logs, correlation IDs, and health endpoints make production support possible without SSH archaeology.