Why is it permissible to annotate only public methods in a controller?

In Java, controllers are often used within MVC or similar architectures, where they interact with external components (such as web requests). Annotating public methods is permissible because they form the public API of the controller — entry points for external calls.

Reasons:

• Encapsulation: Private and protected methods are intended for internal use and should not be accessible from outside, so annotations (e.g., for routing or serialization) are only applied to public methods.

• Framework expects public methods: Many frameworks (Spring, JAX-RS) invoke controller methods via reflection and look specifically for public methods with the necessary annotations.

• Security and maintainability: Annotating private methods can lead to unexpected behavior and complicate code maintenance.

Therefore, only public methods should be annotated to explicitly define the controller's interface and avoid errors.