title: ASP.NET Core Authorization based on query string
body: <p>I have an endpoint in my Web API which looks like this:</p>
  
  <pre><code>api/customers?salesRepId=123
  </code></pre>
  
  <p>Now, if I don't supply the salesRepId in the querystring, I want to be able to pull all customers. If the salesRepId is supplied, I want to pull only the sales rep's customers.</p>
  
  <p>Only administrators are allowed to view all customers, which means that when I am logged in as salesRepId 123, and invoke api/customers without the querystring, the API should respond with a 401 (unauthorized) error.</p>
  
  <p>How can I do this in ASP.NET Core 2.0 Web API?</p>
  
  <p>The other alternative is to expose 2 endpoints, which I wish to avoid.</p>