///

{* ../../docs_src/security/tutorial005_an_py310.py hl[157] *}

## Declare scopes in *path operations* and dependencies { #declare-scopes-in-path-operations-and-dependencies }

Now we declare that the *path operation* for `/users/me/items/` requires the scope `items`.

For this, we import and use `Security` from `fastapi`.

 * session events and their originating operations in the application code. The trace structure
 * supports the following key features:
 *
 * <ul>
 *   <li>Maintains parent-child relationships between requests to track operation nesting</li>
 *   <li>Carries contextual data describing the current request or operation</li>
 *   <li>Supports both internal session operations and client-provided trace information</li>
 * </ul>
 *

### Top-level application { #top-level-application }

First, create the main, top-level, **FastAPI** application, and its *path operations*:

{* ../../docs_src/sub_applications/tutorial001_py39.py hl[3, 6:8] *}

### Sub-application { #sub-application }

Then, create your sub-application, and its *path operations*.

	MTime                time.Time // Is only set in POST/PUT operations
	Expires              time.Time // Is only used in POST/PUT operations

	DeleteMarker            bool // Is only set in DELETE operations for delete marker replication
	CheckDMReplicationReady bool // Is delete marker ready to be replicated - set only during HEAD
	Tagging                 bool // Is only in GET/HEAD operations to return tagging metadata along with regular metadata and body.

And we can add a list of `dependencies` that will be added to all the *path operations* in the router and will be executed/solved for each request made to them.

/// tip

## Usar `async` o no usar `async` { #to-async-or-not-to-async }

Como las dependencias también serán llamadas por **FastAPI** (lo mismo que tus *path operation functions*), las mismas reglas aplican al definir tus funciones.

Puedes usar `async def` o `def` normal.

		// Info operations
		adminRouter.Methods(http.MethodGet).Path(adminVersion + "/info").HandlerFunc(adminMiddleware(adminAPI.ServerInfoHandler, traceAllFlag, noObjLayerFlag))
		adminRouter.Methods(http.MethodGet, http.MethodPost).Path(adminVersion + "/inspect-data").HandlerFunc(adminMiddleware(adminAPI.InspectDataHandler, noGZFlag, traceHdrsS3HFlag))

		// StorageInfo operations

## To `async` or not to `async` { #to-async-or-not-to-async }

As dependencies will also be called by **FastAPI** (the same as your *path operation functions*), the same rules apply while defining your functions.

You can use `async def` or normal `def`.

Y todas estas miles de *path operations* pueden ser tan pequeñas como 3 líneas:

{* ../../docs_src/security/tutorial002_an_py310.py hl[30:32] *}

## Resumen { #recap }

Ahora puedes obtener el usuario actual directamente en tu *path operation function*.

Ya estamos a mitad de camino.

Solo necesitamos agregar una *path operation* para que el usuario/cliente envíe realmente el `username` y `password`.

<img src="/img/tutorial/sub-applications/image01.png">

Y luego, abre la documentación para la sub-aplicación, en <a href="http://127.0.0.1:8000/subapi/docs" class="external-link" target="_blank">http://127.0.0.1:8000/subapi/docs</a>.

Verás la documentación automática de la API para la sub-aplicación, incluyendo solo sus propias _path operations_, todas bajo el prefijo correcto del sub-path `/subapi`: