An API gateway became the single entry point for the mobile client, with Node.js services behind it for authentication, orders, portfolios, accounts and market data.
- REST endpoints for order placement, modification, cancellation, portfolio retrieval and account queries
- JSON schema validation at the gateway with a uniform error envelope and machine-readable error codes
- Per-service timeouts, retries with exponential backoff and jitter on idempotent calls only, and circuit breakers on OMS-facing routes
- Token bucket rate limiting per user and per client application
- Independent deployment of each service
