API Gateway Patterns Cheat Sheet

services:  - name: users-service    url: http://users.internal:8080    routes:      - name: users-route        paths:          - /api/users    plugins:      - name: rate-limiting        config:          minute: 100          policy: local

plugins:  - name: jwt    config:      claims_to_verify:        - exp      key_claim_name: iss      secret_is_base64: false

routes:  - match:      prefix: "/api/orders"    route:      cluster: orders-service      timeout: 2s      retry_policy:        retry_on: "5xx,reset,connect-failure"        num_retries: 3        per_try_timeout: 0.5s        retry_back_off:          base_interval: 0.1s          max_interval: 1s

plugins:  - name: oauth2-introspection    config:      introspection_url: https://auth.example.com/oauth2/introspect      client_id: gateway-client      client_secret: ${OAUTH_INTROSPECT_SECRET}      token_type_hint: access_token      ttl: 30           # cache introspection result for 30s to cut latency      cache_size: 10000      required_scopes:        - orders:read

http_filters:  - name: envoy.filters.http.grpc_json_transcoder    typed_config:      "@type": type.googleapis.com/envoy.extensions.filters.http.grpc_json_transcoder.v3.GrpcJsonTranscoder      proto_descriptor: "/etc/envoy/proto.pb"      services: ["orders.v1.OrdersService"]      print_options:        add_whitespace: true        always_print_primitive_fields: true

// GET /bff/order-summary/:idapp.get('/bff/order-summary/:id', async (req, res) => {  const { id } = req.params;  try {    const [order, shipment] = await Promise.all([      fetchWithTimeout(`http://orders-svc/orders/${id}`, 800),      fetchWithTimeout(`http://shipping-svc/shipments?orderId=${id}`, 800),    ]);    res.json({      order,      // degrade gracefully instead of failing the whole response      shipment: shipment ?? { status: 'unavailable' },    });  } catch (err) {    res.status(502).json({ error: 'upstream_unavailable' });  }});