URL Shortener & Link Management Service  ·  View 02 of 23  ·  Context and scope

High-Level Architecture

Seven stages from a claimed code to an accounted-for click, with the one-way propagation boundary in the middle.

Editable source SVG draw.io All views
1 · Create Management API Container Apps Alias reservation conditional create 2 · Own Link table Cosmos DB · 12B links 3 · Propagate Revocation publisher own channel · 60 s Projection publisher change feed · 5 min 4 · Resolve Front Door edge anycast · 30 s cache Regional resolver read-only Hot set cache Azure Cache for Redis 5 · Redirect Clicker's browser 302 + no-store 6 · Count Edge access log Event Hubs Click store Azure Data Explorer 7 · Police Destination screening at create, then periodic Review and appeal human in the loop claim 3% miss point read deny-set warm every click, cached or not block Link Platform — High-Level Architecture Application we own Data store Queue / topic Interface / broker External / third party Security / platform synchronous event / async failure / alternate Stage 4 reads only stages 3's output. No arrow runs from the redirect path back into the link table. v 1.0 · owner Platform Architecture · date 2026-09

The shape

  • Create and own (stages 1–2) are the management plane; resolve and redirect (stages 4–5) are the redirect plane; stage 3 is the only thing that joins them.
  • Counting happens in stage 6, after the response has left, from the edge access log rather than from application code.
  • Policing (stage 7) writes back only through the revocation channel, which is why an abuse block can be fast without the rest of propagation being fast.

What is deliberately absent

  • No arrow runs from the redirect path back into the link table for the purpose of serving a click — only the cold read on a cache miss.
  • No arrow runs from the click pipeline into the redirect path at all. An analytics outage is invisible to a clicker.
  • No synchronous dependency on the management plane exists anywhere in stages 4–5, which is what lets creation fail for four hours without a single failed redirect.

Risks

  • Stage 3 is a single logical component owning two very different promises (60 s and 5 min); if it is built as one channel, the tighter promise silently costs what the looser one does not need.
  • Stage 6 depends on the edge log being complete. A sampled or truncated log becomes a billing dispute, not a monitoring gap.