c# - How to Avoid Injecting User Object Throughout my Web API -

i have project have embedded jwt in header of calls restful web services. jwt includes relevant user information (name, username, roles, etc...) , each of web api controllers pulls session headers , makes available local private variable use in endpoint specific authorization.

but need information not @ restful endpoints, need each call database (auditing). only, doesn't seem elegant pass user object every call , have calls pass along in calls too.

ultimately, have auditing component embedded in guts of ef logs every call , database. want user object attached have clear audit trail includes not changed, changed it...

is there way make user object (which grabbed constructor of web api controller) available may need without injecting each call?

*session have worked nicely, services restful , subsequently, session not available.