Attribute routing to controller action isn't working in ASP.NET Core

Question

I've set breakpoints, and followed the flow. The controller is being instantiated, and the parameters are being validated (I have some Data Annotations set up), but the controller method itself isn't being invoked.

I think the problem is routing, but I'm not sure where it might be broken. I haven't set up any global routing; everything is done via attributes. The Swagger docs are being generating, too, and documenting the controller endpoints.

In fact, everything seems to work OK on the surface. Send a request, and I'll get back a 200 OK. Send a request that fails the declarative validations, and I'll get back a BadRequest.

Here's the controller:

[Route("licensing")]
public class LicenseController
    : Controller
{
    [HttpPut]
    [Route("create-license/{licenseKey}")]
    public async Task<LicenseDetails> CreateLicenseAsync(string licenseKey, [FromBody]CreateLicenseRequest license)
    {
        DoSomething(licenseKey);  //A breakpoint here will never be hit
    }
}

A request looks like this:

{
  "Username": "test@example.com",
  "LicenseKey": "license-key-string",
  "ProductName": "SomeProduct",
  "ProductVersion": "2017.5",
  "ActivationLimit": 2147483647,
  "UtcExpiration": "9998-12-31T23:59:59.9999999"
}

The PUT would be against a URL like this:

https://api.example.com/licensing/create-license/license-key-string

I use Basic Authentication in the headers, which exercises a basic authentication filter I wrote, and that all works fine. (I stepped through; in the event of a failure, a NotAuthorized is returned.)

Here's most of the composition root:

public Startup(IHostingEnvironment env)
{
    var builder = new ConfigurationBuilder()
        .SetBasePath(Directory.GetCurrentDirectory())
        .AddJsonFile("hosting.json", optional: false, reloadOnChange: true)
        .AddJsonFile("appsettings.json", optional: true, reloadOnChange: true)
        .AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true)
        .AddEnvironmentVariables();
    Configuration = builder.Build();
}

public void ConfigureServices()
{
    //...non-ASP.NET stuff snipped
    services.AddMvc(options =>
    {
        options.Filters.Add(new ValidateModelStateAttribute());
        options.Filters.Add(new BasicAuthenticationAttribute(authorizationManager));
        options.Filters.Add(new ApiExceptionFilter());
        options.OutputFormatters.Clear();
        options.OutputFormatters.Add(new JsonOutputFormatter(jsonSerializerSettings, ArrayPool<char>.Shared));
    })
    .AddJsonOptions(setupAction: options =>
    {
        //...
    });

    services.AddSingleton<IControllerActivator>(new LicenseKeyControllerActivator(keyService));
    services.AddSwaggerGen(c =>
    {
        c.SwaggerDoc("v1", new Info { Title = "Licensing API", Version = "v1" });
    });
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
    loggerFactory.AddConsole(Configuration.GetSection("Logging"));
    loggerFactory.AddDebug();

    app.UseMvc();
    app.UseSwagger();
    app.UseSwaggerUI(c =>
    {
        c.SwaggerEndpoint("/swagger/v1/swagger.json", "Licensing API v1");
    });
}