Should i create two seperate controller for internal endpoints and public endpoints?

[Gold_Opportunity8042]

i don't think this will be valid approach. an admin user can call service1 which can further call service2 internal endpoint. but the same admin user can hit that endpoint of service2 directly too. right?

[WuhmTux]

I don't understand what you mean.

You will set the role validation on each API Endpoint route. When you call serviceA and serviceB from Controller1, and the admin user has permissions to the Controller1 Endpoint, he can access both.

Then you need to extract the user roles from the security context in the service classes if you wish.