API Gateway Platform  ·  View 11 of 21  ·  Data

Core Data Model

Fourteen entities, and one foreign key that carries the architecture.

Editable source SVG draw.io All views
developer_org org_id PK tenant_id FK plan_tier residency_set created_at application app_id PK org_id FK -> developer_org environment status credential cred_id PK app_id FK -> application type verifier not_after revoked_at subscription sub_id PK app_id FK -> application product_id FK version_pin scopes api_product product_id PK name owner_team default_plan_id FK api_version version_id PK product_id FK -> api_product label lifecycle_state sunset_at schema_ref route route_id PK version_id FK -> api_version host path_pattern method upstream_group_id FK upstream_group group_id PK service health_policy timeout_ms retry_budget plan plan_id PK tier burst_rps sustained_per_hour concurrency limit_override override_id PK scope_type scope_ref plan_id FK -> plan expires_at approver config_version config_version PK author approved_by created_at digest parent_version rollout rollout_id PK config_version FK -> config_version route_id FK weight state verdict access_record request_id PK cred_id FK -> credential route_id FK -> route config_version FK status gw_latency_ms up_latency_ms audit_event event_id PK actor subject_type subject_ref action outcome at 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N 1 : N Core Data Model credential -> access_record and credential -> audit_event are real foreign keys, omitted from the drawing to keep the lower half readable. v 1.0 · owner Integration Platform Architecture · date 2026-09

The load-bearing key

  • access_record.config_version makes every response attributable to the exact configuration that produced it. Without it, "what changed?" is answered by correlating timestamps.
  • api_product outlives api_version: the product is the durable subject, versions are disposable. Ownership, plans and subscriptions attach to the product.
  • limit_override carries expires_at and approver, so a quota exception ages visibly instead of becoming the permanent state.

Assumptions

  • 800 route rows, ~500k credential rows, ~50k org rows — small enough that the configuration dataset fits comfortably in a globally replicated store.
  • access_record is partitioned by day and tenant; it is the only high-volume table here.

Omitted

  • credential → access_record and credential → audit_event are real foreign keys, left undrawn so the lower half of the page stays readable.
◀  Data Architecture and Ownership All views A Request From TLS to Upstream  ▶
Solution Architecture v1.0 · Google Cloud · Integration Platform Architecture · 2026-09 · 21 views · 18 architecture decision records11-data-model