# API Gateway Pattern

> API Gateway Pattern

- Skill: `ffsshhttiikk/api-gateway-pattern` (Agent Skill)
- Install (CLI): `npx skillmds@latest add ffsshhttiikk/api-gateway-pattern`
- Raw SKILL.md: https://api.skillmd.com/api/skills/ffsshhttiikk/api-gateway-pattern/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: ffsshhttiikk (https://skillmd.com/u/ffsshhttiikk)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/ffsshhttiikk/api-gateway-pattern

---

# API Gateway Pattern

**Category:** Architecture  
**Skill Level:** Intermediate  
**Domain:** API Design, Microservices, Backend Development

## Overview

The API Gateway Pattern is a server-side design pattern that acts as a single entry point for defined back-end APIs and microservices. It handles request routing, composition, and protocol translation, abstracting the underlying microservice architecture from clients and providing a unified interface for external consumers.

## Description

The API Gateway Pattern emerged as a solution to the complexity introduced by microservice architectures, where multiple small services replace monolithic applications. In a distributed system, clients often need to interact with multiple services to fulfill a single user request, leading to complex client-side logic, multiple network round-trips, and tight coupling between clients and internal service endpoints.

An API gateway addresses these challenges by serving as a reverse proxy that accepts all application programming interface requests, enforces policies, and routes them to the appropriate backend services. It acts as a facade that hides the internal architecture from external clients, presenting a streamlined, unified API surface. Beyond simple routing, modern API gateways provide essential cross-cutting concerns including rate limiting, authentication, caching, request/response transformation, and metrics collection.

The pattern is particularly valuable in cloud-native environments where scalability, observability, and security are paramount requirements. By centralizing these concerns in a dedicated layer, API gateways reduce the burden on individual services and enable consistent policy enforcement across all endpoints. Major cloud providers offer managed API gateway services including Amazon API Gateway, Google Cloud Apigee, and Azure API Management, while open-source alternatives like Kong, Tyk, and AWS Lambda Edge provide self-hosted options.

## Prerequisites

- Understanding of RESTful API principles and HTTP protocols
- Knowledge of microservice architecture concepts
- Familiarity with reverse proxy concepts (Nginx, HAProxy)
- Basic understanding of network security principles

## Core Competencies

- Designing unified API surfaces for heterogeneous backend services
- Implementing request routing, composition, and protocol translation
- Configuring rate limiting, throttling, and quota management
- Setting up authentication and authorization at the gateway layer
- Implementing request/response transformation and caching strategies
- Monitoring and logging API traffic patterns

## Implementation

```python
from abc import ABC, abstractmethod
from typing import Dict, Any, Optional
from dataclasses import dataclass
from enum import Enum

class HttpMethod(Enum):
    GET = "GET"
    POST = "POST"
    PUT = "PUT"
    DELETE = "DELETE"
    PATCH = "PATCH"

@dataclass
class RouteConfig:
    path_pattern: str
    target_service: str
    target_path: str
    methods: list[HttpMethod]
    auth_required: bool = True
    rate_limit: Optional[int] = None
    timeout_seconds: int = 30

class APIRoute:
    def __init__(self, config: RouteConfig, handler):
        self.config = config
        self.handler = handler

class APIGateway:
    def __init__(self):
        self.routes: Dict[str, RouteConfig] = {}
        self.rate_limiter: Dict[str, list] = {}
        
    def add_route(self, route: APIRoute):
        self.routes[route.config.path_pattern] = route.config
    
    async def handle_request(
        self, 
        path: str, 
        method: HttpMethod,
        headers: Dict[str, str],
        body: Optional[bytes]
    ) -> Dict[str, Any]:
        route = self._find_route(path, method)
        if not route:
            return {"status": 404, "body": "Not Found"}
        
        client_id = headers.get("X-Client-ID", "anonymous")
        if route.rate_limit and not self._check_rate_limit(client_id, route.rate_limit):
            return {"status": 429, "body": "Rate limit exceeded"}
        
        if route.auth_required and not self._validate_auth(headers):
            return {"status": 401, "body": "Unauthorized"}
        
        transformed_body = self._transform_request(body, route)
        
        response = await self._route_to_service(
            route.target_service,
            route.target_path,
            transformed_body
        )
        
        self._log_request(client_id, path, response["status"])
        
        return response
    
    def _find_route(self, path: str, method: HttpMethod) -> Optional[RouteConfig]:
        for pattern, route in self.routes.items():
            if self._match_path(path, pattern) and method in route.methods:
                return route
        return None
    
    def _match_path(self, path: str, pattern: str) -> bool:
        return path.startswith(pattern.rstrip("*"))
    
    def _check_rate_limit(self, client_id: str, limit: int) -> bool:
        import time
        now = time.time()
        if client_id not in self.rate_limiter:
            self.rate_limiter[client_id] = []
        self.rate_limiter[client_id] = [
            t for t in self.rate_limiter[client_id] 
            if now - t < 60
        ]
        return len(self.rate_limiter[client_id]) < limit
    
    def _validate_auth(self, headers: Dict[str, str]) -> bool:
        auth_header = headers.get("Authorization", "")
        return auth_header.startswith("Bearer ")
    
    async def _route_to_service(
        self, 
        service: str, 
        path: str, 
        body: Any
    ) -> Dict[str, Any]:
        return {"status": 200, "body": {"message": f"Routed to {service}{path}"}}
    
    def _transform_request(self, body: Any, route: RouteConfig) -> Any:
        return body
    
    def _log_request(self, client_id: str, path: str, status: int):
        pass

gateway = APIGateway()
```

## Use Cases

- Consolidating multiple microservices under a single API endpoint
- Protecting backend services from excessive traffic through rate limiting
- Implementing authentication and authorization across all APIs
- Transforming legacy API responses to modern formats
- Providing a single metrics and logging endpoint for observability
- A/B testing different backend implementations

## Artifacts

- Kong Gateway configuration (kong.yml)
- AWS API Gateway OpenAPI specification
- Gateway routing middleware for Express.js
- Rate limiting configuration files
- Authentication middleware implementations

## Related Skills

- API Design
- Microservices Architecture
- Rate Limiting
- Authentication
- Circuit Breaker Pattern