API Gateway Platform  ·  View 10 of 21  ·  Data

Data Architecture and Ownership

Four classes, four write rules, and three kinds of data deliberately absent.

Editable source SVG draw.io All views
Configuration — strongly consistent, globally replicated, immutable per version Written only by the Config API, under review Routes and upstreams 800 routes Policies and limits per plan + override API products versions, lifecycle Derived, rebuildable Signed snapshots object store, N and N-1 Credential — strongly consistent on write, eventually consistent at the edge Authoritative Key verifiers 500k, no secrets Scope grants per application Revocation list push source Projected to the edge Edge credential cache 5 min TTL Edge denylist 30 s propagation Counter — approximate by design, bounded overshoot, loss tolerated In-region, ephemeral Shared counters sharded by principal Local buckets per proxy instance Never authoritative for money Billable usage from access records Evidence — append-only, eventually consistent, retention by class Sampled Access records 90 days Aggregated metrics 13 months Never sampled Auth decisions 7 years Config changes 7 years, immutable Request bodies deliberately not stored Credential secrets never recoverable Response payloads cache excepted, per route push derived Data Architecture — Four Classes, Four Write Rules Data store Risk / gap event / async batch The three red boxes are the data this platform deliberately does not hold. A gateway that logs bodies becomes the largest breach surface in the company. v 1.0 · owner Integration Platform Architecture · date 2026-09

Decisions

  • Configuration is written only through the Config API, under review, and is immutable once versioned.
  • Credential secrets are stored only as computationally-hard verifiers. A breach of this store does not yield a usable credential.
  • Counters are explicitly not durable. Losing them is acceptable; losing the bound they enforce is not.

What is absent, on purpose

  • Request bodies and response payloads are not logged. A gateway that logs bodies becomes the largest concentration of customer data in the company, in the component with the widest access.
  • Credential secrets are never recoverable, which is why rotation exists.
  • Per-field logging opt-in rather than opt-out, so a new header is not logged by default.

Risks

  • Residency-constrained tenants need their traffic confined to a permitted region set, including on failover. That constrains the evacuation design in view 16 and is deferred to Phase 3 in ask.md.
◀  Data Flow All views Core Data Model  ▶
Solution Architecture v1.0 · Google Cloud · Integration Platform Architecture · 2026-09 · 21 views · 18 architecture decision records10-data-ownership-zones