I have an ASP.NET Core v8.0.5 application with OpenIdConnect enabled. There are minimal API endpoints which are secured using a custom AuthorizationHandler to check the logged in user has appropriate permissions to execute the API request.

This is all working except for one small detail. When I request the API from my Angular client without permission ASP.NET forces a 302 redirect which causes the client API to fail. I have code in my error handler to handle a 401 so the app can gracefully redirect to an Access Denied route but I cannot get a 401 returned to my app?

Can anybody suggest how I can control the response code returned?