The path of a request through the layers

When: POST /read/{id} or GET /read/{id}

sequenceDiagram
    participant C as Client
    participant F as Filter chain (CIAS)
    participant R as REST layer
    participant S as System layer
    participant P as Persistence
    participant DB as Database
    participant H as Hooks
    C->>F: POST /read/{id} + token
    F->>F: check token, fill RequestContext
    F->>R: pass on
    R->>R: resolve response (fields, references)
    R->>S: readObject(id, field selection)
    S->>S: check read role
    S->>S: add security filters (owner, attributes)
    S->>P: query
    P->>DB: SELECT only the requested columns
    DB-->>P: row
    P-->>S: entity
    S->>H: after hook (READ), e.g. decrypt a field
    S->>S: convert the entity into a DTO
    S->>S: load references one by one, each with its own permission check and READ hook
    S-->>R: DTO
    R-->>C: data + meta

Result: No match, or the match is not visible: 404. The READ hook sees every loaded object before it becomes the response.

When: POST /create

sequenceDiagram
    participant C as Client
    participant F as Filter chain (CIAS)
    participant R as REST layer
    participant S as System layer
    participant H as Hooks
    participant P as Persistence
    C->>F: POST /create + token
    F->>R: RequestContext filled
    R->>R: take over files, resolve response
    R->>S: createObject(DTO)
    S->>S: check role, copy fields,<br/>set defaults, collect violations,<br/>create children recursively
    S->>H: before hooks
    S->>S: report all violations at once (422)
    S->>P: store
    S->>H: after hooks
    S->>P: flush, then read back (with READ hook)
    S-->>R: DTO
    R-->>C: data + meta

Result: The hooks run before validation. So a hook may fill a required field that the client does not even know about.

When: PUT, PATCH, DELETE, rollback

Result: You can only change or delete what you can also read.

When: POST /query

Result: No matches is not an error: 200 with an empty list.