An API gateway pattern provides one entry point between clients and multiple backend APIs. It reduces client knowledge of separate endpoints and centralizes security and governance. section 9.1
A gateway can help teams:
- Apply authentication, authorization, schema validation, rate limiting, monitoring, and consistent API policies. section 9.1
- Translate different backend styles into one consumer-facing style, such as exposing GraphQL, REST, and asynchronous APIs through REST. section 9.1
- Hide backend complexity and tailor interfaces to particular clients through the backends-for-frontends pattern. section 9.1
- Maintain an explicit inventory of exposed APIs and versions, improving visibility into the attack surface and shadow endpoints. section 9.1
An e-commerce platform
An e-commerce backend may distribute APIs across serverless systems, Kubernetes clusters, and dedicated servers. Without a gateway, clients must discover and secure each URI separately; with one, traffic passes through a consistent control point. section 9.1
Figure 9.1 API gateways serve as single entry points to multiple backend APIs, helping us provide a unified API style, manage our API inventory, apply consistent access controls and security configuration, and improve observability.
Use the figure to see how a gateway unifies backend access, security configuration, API inventory, and observability. section 9.1
