2.3. API Gateway and Service Contracts

The gateway is the single front door through which all external traffic enters — and therefore the single place to enforce authentication, routing, rate limits, and request shaping without duplicating that logic in every service. It is also a potential single point of failure and a latency tax on every call. This chapter covers the gateway and Backend-for-Frontend patterns, contract-first development with OpenAPI, and the idempotency guarantees that make retries safe.

Topics Covered

• 2.3.1. API Gateway Pattern: Single Entry Point, Routing, Auth: Establishes the gateway as the single entry point for routing, authentication, and request shaping.
• 2.3.2. Backend for Frontend (BFF) Pattern: Explains the Backend-for-Frontend pattern, giving each client type an API tailored to its needs.
• 2.3.3. OpenAPI / Swagger: Contract-First Development: Covers contract-first development with OpenAPI, generating servers, clients, and documentation from one spec.
• 2.3.4. Consumer-Driven Contract Testing (Pact): Introduces consumer-driven contract testing with Pact to catch breaking changes before they reach production.
• 2.3.5. Idempotency and Safe HTTP Methods: Defines idempotency and safe HTTP methods, and how idempotency keys make retries safe to replay.
• 2.3.6. Throttling and Rate Limiting at the Gateway Level: Covers rate-limit policy and placement at the gateway: per-tenant quotas, 429 semantics, and distributed counters.