On this topic on [How to secure API with EntraID
(/questions/78366047/how-to-secure-api-with-entraid), Rukmini helped setup the Azure app to secure an on-premise API and pass the auth token to it.
But I’m missing the part required on the API endpoint to actually validate the token and get the details of the user.

Also, the endpoint needs to be anonymous and then we do the validation by code or we can decorate it with some attributes to make it accessible only with the proper tokens?

Do you have any sample code that shows how this works?