Practice: Design API Gateway System
Design a production-grade API Gateway that provides authentication, authorization, rate limiting, request routing, and observability for multiple backend services.
Build this system yourself on the canvas below. Add components, connect them, and run traffic simulations to see where your design holds up and where it breaks.
Functional requirements
- Terminate TLS and accept client requests for multiple backend APIs.
- Authenticate requests (JWT/OAuth/API keys) and attach identity to the request context.
- Authorize requests (RBAC/ABAC) based on route, method, tenant, and user.
- Route requests to the correct internal service based on host/path/headers.
- Apply per-tenant quotas and per-user/IP rate limits.
- Emit access logs, metrics, and traces with correlation IDs.
- Support safe configuration updates (new routes, policy changes) with rollback.
Non-functional requirements
- p95 gateway added latency should be under 15ms; p99 under 40ms under normal load.
- 99.9% availability for the gateway tier (multi-AZ; no single point of failure).
- Graceful degradation under overload (shed best-effort work before failing core routing/auth).
- Strong security posture: input validation, WAF rules, least-privilege, secrets hygiene.
- High observability: debug a single request end-to-end within minutes (trace + logs + metrics).
- Config changes should propagate safely within minutes with auditability and rollback.
