Request Pipeline

The step-by-step lifecycle of a request as it passes through the ApiReverseProxy.

The Request Journey

Every incoming request passes through a series of specialized middleware components before reaching your upstream service.

1

Observability Init

Correlation IDs are generated and OpenTelemetry spans are started.

2

Routing Resolution

Tenant, Catalog, and Environment are identified; target endpoint is matched.

3

Authentication

Verification of X-Gateway-Client-ID or X-Gateway-Authorization tokens.

4

Authorization

Checks if the Consumer has explicit access to the matched Endpoint or Catalog.

5

Rate Limiting

Enforces the hierarchical throughput limits based on the Consumer and Target.

6

Audit Logging

Request metadata is queued for asynchronous storage in the Audit database.

7

Upstream Forwarding

The request is proxied to the target microservice using high-performance HttpClient pooling.

Failure Modes

If a request fails at any point in the pipeline, the Gateway returns a standard Problem Details (RFC 9457) response.

Pipeline PhasePossible StatusReason
Routing404 Not FoundTenant or Catalog does not exist.
Auth401 UnauthorizedInvalid credentials or expired token.
Authorization403 ForbiddenConsumer exists but lacks specific access rights.
Rate Limit429 Too Many RequestsConsumer quota exceeded.
Upstream502 Bad GatewayTarget service is down or unreachable.

Asynchronous Audit

Unlike many gateways that wait for a logging write, our pipeline uses an In-Memory Async Queue. The logging operation is offloaded to a background worker, meaning the request latency is never affected by the database performance of the audit logs.