API Gateway Platform · View 09 of 21 · Data
Decisions
- Configuration becomes an immutable, signed version before it is distributed, so distribution is a content-addressed pull rather than a mutation (ADR-02).
- Every proxy reports the config version it is actually running. Coverage is a measured number, which is what makes the 10 s propagation SLO falsifiable.
- Billing is derived from access records, never from rate-limit counters — counters are approximate by design (ADR-06).
Numbers
- Config change visible in ≥ 99% of instances within 10 s, 100% within 60 s (assumption).
- Usage pipeline RPO ≤ 60 s; access records 90 days, aggregated metrics 13 months, audit 7 years (assumptions).
Risks
- A fleet split across two config versions for longer than 60 s is a correctness problem, not a lag problem: two callers can get two different answers to the same request. It is alerted on (view 18).