API gateway operations

API gateway operations interviews centralize routing, auth delegation, quotas, transforms, and telemetry while keeping domain ownership in backend services.

Subtopics: gateway routing and auth delegation, limits and request transformation, and gateway observability.

On interviews: route by host/path/version/tenant, pass identity to services without replacing authorization checks, and instrument per-consumer SLOs at the edge.

Common pitfalls: gateways executing business rules, transforms that break idempotency, and quotas without identity-aware keys.

The trade-off is balancing simplicity, performance, safety, and operability — name which axis you optimized and what cost you accepted.

Checklist:

• Route on health, version, and tenant dimensions.
• Delegate authentication; enforce authorization in services.
• Apply quotas, bursts, and schema-aware validation at edge.
• Propagate request IDs, traces, and upstream timing.