Skip to main content

API Gateway

Purpose​

Single entry point for all client traffic. Handles routing, authentication, rate limiting, and CORS.

Responsibilities​

  • Route requests to downstream services
  • Validate JWT tokens
  • Rate limiting per client/IP
  • Request/response logging
  • CORS policy enforcement

Non-Responsibilities​

  • Business logic
  • Direct database access
  • Payment processing

APIs​

MethodEndpointDescription
*/api/v1/auth/**Route to Auth Service
*/api/v1/customers/**Route to Customer Service
*/api/v1/accounts/**Route to Account Service
*/api/v1/payments/**Route to Payment Service
*/api/v1/portfolios/**Route to Portfolio Service
GET/actuator/healthHealth check

Database​

Stateless — no database. Configuration from Config Server.

Kafka​

Produces: None Consumes: None

Dependencies​

Sync: All downstream services, Redis (rate limit counters), Config Server Async: None

Failure Handling​

  • Downstream timeout → 504 Gateway Timeout
  • Invalid JWT → 401 Unauthorized
  • Rate limit exceeded → 429 Too Many Requests

Scaling​

Horizontally scalable (stateless). Bottleneck: downstream service latency. Use connection pooling and circuit breakers.

Security​

Validates JWT on every request. Enforces RBAC via token claims. TLS termination at ALB.

Observability​

Metrics: api_request_count, api_error_count, gateway_latency. Logs: structured JSON with correlation ID.