Headless 360Intermediaterate-limitingapi-gatewaysecurity
Design rate limiting and API gateway for Salesforce-backed microservices
Real World Scenario
A viral marketing campaign caused partner API quota exhaustion and Commerce API 429 errors affecting all channels.
Expected Answer
• Deploy API gateway (MuleSoft, Apigee, AWS) with per-client quotas and burst allowances
• Prioritize tier-1 channels with reserved capacity pools
• Client-side retry with jitter respecting Retry-After headers
• Cache static catalog responses reducing origin load 80%+
• Circuit breakers returning degraded responses vs hard failures where acceptable
• Real-time quota dashboards alerting before exhaustion
• Post-incident autoscaling rules for Commerce API pod capacity if applicable
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Main difference: use case and scale. Deploy API gateway (MuleSoft, Apigee, AWS) with per-client quotas and burst allowances. Prioritize tier-1 channels with reserved capacity pools. Pick based on your integration pattern and team capability. Shared API pools need fairness—architects isolate blast radius so one partner cannot take down consumer apps. Balance speed of delivery with maintainability.
Architect Perspective
Shared API pools need fairness—architects isolate blast radius so one partner cannot take down consumer apps.