API Gateway
An API gateway accepts external requests and routes them to internal targets using published routes.
- External contractStable route, method, and error shape for clients.
- Edge controlApply TLS, identity, rate limit, and deadline consistently.
- RoutingSelect a reachable target and preserve correlation.
Context
Why this is important
The gateway owns edge concerns such as TLS, authentication, rate limits, and routing; business rules and long-running process state remain behind it.
The distributed extension in the shop scenario is hypothetical; the current shop remains a modular monolith with seven modules and one shared database.
API Gateway: decision boundaries
The current shop remains a modular monolith with seven modules. Hypothetically, Browser and Customer Service receive separate public routes through a gateway to Catalog and Shipping. The gateway checks identity, rate limit, and deadline and routes to registered targets. The team simulates an unreachable target and invalid authorization and proves unambiguous status codes, correlation ID, bounded retry, and unchanged internal contracts.
This is how you read the picture
- External contract Public route
- Edge control Shared policy
- Routing Discovery plus timeout
| Comparison | Aspect | Sound use | Limit |
|---|---|---|---|
| Routing | Several internal targets behind a stable entry | Routes are versioned and observed | Misrouting or loops affect all clients |
| Edge control | Shared access policy | Centrally verified and audited | Gateway becomes a critical capacity boundary |
| Aggregation | Few calls with fixed deadline | Client saves round trips | Fan-out and partial failures remain visible |
Benefits & limitations
Helps if:
- Routes are versioned and observed
- Centrally verified and audited
- Client saves round trips
Boundaries
- Misrouting or loops affect all clients
- Gateway becomes a critical capacity boundary
- Fan-out and partial failures remain visible
In practice
- Define external routes for product lookup and shipping status. Check that clients know only public contracts and internal addresses remain replaceable.
- Send an unauthorized request and simulate an unreachable target. Trace rejection, timeout, and correlation ID across gateway and destination.
- Assess which functions may remain centralized at the gateway. Check whether domain aggregation or durable workflow logic belongs in another component.
Read the detailed explanation
Clients know one stable external contract while internal targets may change. The gateway authenticates, authorizes the route, sets a time budget, and passes correlation to the target.
Central edge functions simplify consistency but make gateway capacity and configuration critical. Aggregation needs clear deadlines; durable business flows belong in a separate coordinator.
Backend for Frontend shapes contracts for client families. Service Discovery supplies reachable internal targets to the gateway.
Check your understanding
Test yourself in three stages
ReadingCheck in the picture
What is the core task of API Gateway?
View the solution with justification
An API gateway accepts external requests and routes them to internal targets using published routes.
ApplyingTransferred to a new situation
Which assumption is hypothetical in the shop?
View the solution with justification
Hypothetically, Browser and Customer Service receive separate public routes through a gateway to Catalog and Shipping. The gateway checks identity, rate limit, and deadline and routes to registered targets.
EvaluateWeighing an alternative
Which three points require evidence before adoption?
View the solution with justification
External contract, Edge control, Routing.
Explore further
These building blocks continue the thoughts of this page.