API Gateway Platform  ·  View 01 of 21  ·  Context and scope

System Context

One boundary, and the fact that there is no way around it.

Editable source SVG draw.io All views
Who changes it Platform SRE API product owner Security engineer Callers outside the boundary Partner backend mTLS, 40 partners Customer integration 50,000 orgs, 6 SDKs Integration developer Inside the product Upstream services 120 services, 800 routes Sandbox estate same policy path Webhook delivery separate platform API Gateway Platform The only ingress path Dependencies it cannot be independent of Authorisation server token issue Billing and plans plan tiers Public DNS + anycast global edge server-to-server calls key or OAuth portal, keys, docs mTLS, signed identity sandbox credentials outbound, out of scope rollout, revert products, plans edge rules introspection usage records traffic arrives here API Gateway Platform — System Context Person or role External / third party Application we own Security / platform synchronous event / async two-way East-west service-to-service traffic belongs to the service mesh and is deliberately outside this boundary. v 1.0 · owner Integration Platform Architecture · date 2026-09

Decisions

  • The gateway is the only ingress path for external API traffic. A side door would make every policy on every later view advisory.
  • East–west service-to-service traffic is explicitly outside the boundary and belongs to the service mesh — two different problems that share a word.
  • Outbound delivery to customer endpoints is a separate platform (webhook delivery). This one is synchronous and inbound, and mixing the two produces a component with two availability models.

Assumptions

  • 50,000 developer organisations, 500,000 active credentials, 40 mTLS partners.
  • 120 upstream services behind 800 route definitions, at most three live versions per API.
  • ≈ 10 billion requests/day. All stated assumptions from ask.md, to be replaced by measured traffic before build.

Risks

  • The authorisation server is the one identity dependency the platform cannot issue itself. Its outage behaviour is ADR-04, not an operational footnote.
  • A single global boundary is a single global blast radius. Cellular partitioning is named in the MVP as Phase 3 and left open in ADR-17.
All views High-Level Architecture  ▶
Solution Architecture v1.0 · Google Cloud · Integration Platform Architecture · 2026-09 · 21 views · 18 architecture decision records01-system-context