By default when you configure the WSFederation middleware in ASP.NET Core, you will be redirected to the Identity Provider when an unauthenticated request arrives on the server.
This is what you would expect when the middleware is invoked from an ASP.NET Core MVC or Razor Pages webpage but probably not what you want when it is an API. In that case a 401 would be a better response.
To achieve this you should handle the OnRedirectToIdentityProvider event and change the response to 401: