Understand gateway behavior

The gateway fronts the business's declared routes. It verifies the caller and enforces the accepted contract before work reaches the backend. A request must resolve to the intended business environment, route, credential, subscriber and plan.

Trace a request#

Start with the exact method, path, host and environment. Routes declare call surfaces and scopes; tenancy describes member and service identities. The plan must grant access. Managed RBAC can add a member permission requirement. The gateway then applies the relevant structural and monetary bounds and resolves the environment's backend.

Usage limits distinguish rate, quota, concurrency, resource and other enforced bounds. Monetary admission describes reservations, capacity and maximum settlement for work that can spend funding. Admission failure prevents upstream work; a later upstream failure is a different outcome.

Verify the backend boundary#

Use the Backend SDK to verify signed raw-body and context data before handling. Ordinary caller headers cannot establish tenant identity. Application record ownership still belongs in the backend.

Fixed request costs are counted by the gateway. Dynamic measurements come from the verified request's report. Streaming or background reporting preserves the served identity and follows the post-stream contract. Do not replace a missing measurement with a guessed charge.

Handle denial and retry#

Read the structured code and deny envelope using the response reference. Retry only when the documented reaction permits it, respecting Retry-After and bounded attempts. A required upgrade, missing permission or resource cap needs a state change rather than a retry loop.

Use denial diagnosis to locate the first failed boundary. Keep the request and decision IDs and inspect the matching environment. Do not broaden a plan or role merely to make a reproduction pass.

For non-JavaScript consumers, use API consumption. Wire examples are not Python or Go SDKs.