URL Shortener & Link Management Service  ·  View 12 of 23  ·  Data

Data Model

Eleven entities, and the one that exists purely so that a code can be retired without ever being reused.

Editable source SVG draw.io All views
tenant tenant_id PK plan link_quota redirect_quota created_at domain domain PK tenant_id FK -> tenant verified_at cert_state cert_expires_at link domain PK code PK tenant_id FK -> tenant destination_url state is_alias expires_at (TTL) created_by created_at code_reservation domain PK code PK claimed_at claimed_by retired bool routing_rule rule_id PK domain FK -> link code FK -> link match_kind match_value destination_url priority revocation_entry domain PK code PK reason source effective_at expires_from_set_at click_event event_id PK domain FK -> link code FK -> link occurred_at country device_class referrer_host traffic_class edge_pop audit_entry audit_id PK tenant_id FK -> tenant subject_code action actor before after at abuse_decision decision_id PK domain FK -> link code FK -> link feed score verdict reviewer decided_at click_rollup_daily domain PK code PK day PK human_clicks bot_clicks unique_estimate top_country api_key key_id PK tenant_id FK -> tenant scopes created_at revoked_at 1 : N 1 : N 1 : N 1 : N 1 : 1 1 : N 1 : N 0 : 1 1 : N N : 1 Data Model — Code, Destination, Click code_reservation exists separately from link so that a retired code can never be claimed again — the record outlives the link it once identified. v 1.0 · owner Platform Architecture · date 2026-09

The load-bearing shapes

  • link is keyed by (domain, code) — per-domain namespacing, so two customers can each own /sale on their own domain (ADR-06).
  • code_reservation is separate from link and outlives it: the claim record, with a retired flag, is what makes reuse structurally impossible (ADR-04).
  • revocation_entry is separate from link state because it propagates on a different channel with a different deadline (ADR-02).

Deliberate absences

  • click_event carries no IP address, no user id and no cookie — country, device class and referrer host only, which is why no consent mechanism appears anywhere in the set.
  • No click counter on link. Counting on the link record would put a write on the read path, which ADR-10 forbids.

Assumptions

  • Link record ≤ 1 KB; destination URL median 120 bytes, hard cap 2,048.
  • Partitioning is by code hash rather than tenant, so a tenant with 2 million links cannot create a hot partition (ADR-09); the by-tenant index serves listing.
◀  Storage Zones All views Two Propagation Paths  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 23 views · 16 architecture decision records12-data-model