Top 30 API Gateway Interview Questions and Answers [2026]

Core Concepts

1. What does an API gateway do?

An API gateway is the single entry point that routes client requests to backend services and applies shared rules on the way in. Those rules usually cover authentication, rate limiting, TLS, logging and request shaping.

The benefit is that each service stops doing this work on its own. Clients also see one stable host, even as services behind it split, merge or move. The cost is one more hop, and one more component that must be highly available.

A gateway should run as several stateless instances across zones, with shared state such as rate-limit counters kept in an external store.

2. How is a gateway different from a reverse proxy or a load balancer?

A load balancer spreads traffic across identical instances. A reverse proxy forwards HTTP requests by host or path.

An API gateway is a reverse proxy that also understands API concerns: who the caller is, which plan they are on, and what limits apply.

• Load balancer: Layer 4 (TCP) or Layer 7 (HTTP). Health checks and spreading load.
• Reverse proxy: Layer 7 routing, TLS termination, compression.
• API gateway: all of that, plus API keys, token checks, quotas, transformations and developer onboarding.

The lines blur in practice. Envoy, NGINX and HAProxy can each play all three roles, depending on configuration.

3. What is the difference between an API gateway and a service mesh?

A gateway handles north-south traffic, from outside clients into the system. A service mesh handles east-west traffic, between services inside it.

The gateway deals with public concerns: external auth, API keys, quotas and a stable public contract. The mesh deals with internal ones: mTLS between every pair of services, retries and traffic splits on internal calls.

Many systems run both. Gateway API has covered mesh routing in its Standard channel since v1.1, so one set of route resources can now describe both kinds of traffic.

4. What is the backend-for-frontend pattern?

A backend for frontend (BFF) is a separate gateway layer for each client type, such as one for the web app and one for the mobile app. Each BFF shapes and combines responses for its own client.

A mobile screen that needs data from four services can make one call to its BFF, which fans out to the four and returns a small response. The pattern is described by Sam Newman.

The usual rule is that the team that owns the client also owns its BFF, so the two change together.

5. How does a gateway help migrate a monolith?

It lets you move one route at a time from the monolith to new services, with no change for clients. This is the strangler fig approach.

At first, every route points at the monolith. When a new orders service is ready, you change only the /orders route. Weighted routing can shift 5% of traffic first and roll back in seconds if error rates rise.

When no routes point at the monolith, you can switch it off.

6. What should not go into an API gateway?

Business logic. A gateway that checks order totals or joins data from five services becomes a shared monolith that every team must change and redeploy.

Keep the gateway to cross-cutting rules that are the same for many services: auth, limits, routing, headers. Response aggregation for one client belongs in a BFF owned by that client's team.

Per-object permission checks belong in the service that owns the data.

Traffic and Resilience

12. Compare the common rate limiting algorithms.

Token bucket is the usual default because it allows short bursts while holding the average rate. The four common options:

• Token bucket: tokens refill at a fixed rate; each request spends one. Bursts are allowed up to the bucket size. AWS API Gateway uses this.
• Leaky bucket: requests drain from a queue at a fixed rate, which smooths traffic but adds delay.
• Fixed window: a counter per minute. Simple, but a client can send twice the limit around a window boundary.
• Sliding window: weights the previous window's count to remove that boundary spike, at the cost of a little more state.

13. How do you rate limit across many gateway instances?

Use a shared counter, usually in Redis or a dedicated rate-limit service, so ten gateway instances enforce one limit rather than ten.

A pure local limit is faster, but each instance only sees its share of traffic. Many teams combine both: a loose local limit to absorb spikes cheaply, and a global limit for the real quota.

When a client is over the limit, the gateway returns 429 Too Many Requests, defined in RFC 6585, with a Retry-After header. The standard RateLimit header fields that tell clients their remaining quota are still an IETF draft.

14. Explain the circuit breaker pattern at the gateway.

A circuit breaker stops sending requests to a backend that keeps failing, so the backend can recover and clients fail fast. It has three states.

In closed, requests flow and failures are counted. Past a threshold, it trips to open and rejects calls at once, often with a 503 or a fallback. After a cool-down it goes half-open and lets a few trial requests through.

Success closes it; failure opens it again. Martin Fowler's circuit breaker article is the usual reference. In Envoy-based gateways, outlier detection does a similar job per host by ejecting a failing instance from the pool.

15. How should a gateway handle retries and timeouts?

Retry only idempotent requests, with backoff and a cap, and set a timeout on every route. Retrying a POST that timed out can charge a card twice unless the API takes an idempotency key.

Retries also multiply load. Three layers that each retry three times turn one failing call into 27. Limit retries to one layer, usually the gateway or the client.

A retry budget, which caps retries as a share of normal traffic, stops a retry storm during an outage. The gateway's timeout should also be shorter than the client's, so the client gets a clear error rather than a dropped connection.

16. How does a gateway support canary releases?

It splits traffic between two versions of a service by weight or by a rule, such as a header or a user group. You send 1% to the new version, watch error rate and latency, then raise the weight in steps.

In Gateway API, this is a single HTTPRoute with two backendRefs and weights:

apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
  name: orders
spec:
  parentRefs:
  - name: public-gateway
  rules:
  - matches:
    - path: { type: PathPrefix, value: /orders }
    backendRefs:
    - name: orders-v1
      port: 8080
      weight: 95
    - name: orders-v2
      port: 8080
      weight: 5

17. How does response caching at the gateway work, and what can go wrong?

The gateway stores responses under a cache key, usually the method, path and chosen query parameters, and serves repeats until a TTL expires. It suits public, read-heavy data such as product lists.

The classic bug is a cache key that leaves out who the caller is. Then one user's private response is served to the next user. Keep the Authorization header or tenant ID in the key for anything user-specific, or do not cache it.

On AWS, caching is available for REST APIs only.

18. How does distributed tracing pass through a gateway?

The gateway reads the W3C traceparent header if the client sent one, or starts a new trace if not. It then forwards the header to the backend, so every service adds its spans to the same trace.

The gateway's own span shows time spent in auth, rate limiting and waiting on the backend. That makes it the first place to look when a request is slow.

Many teams also return the trace ID in a response header, so a support ticket can point straight to the trace.

What Changed Recently

25. Why are teams moving from Ingress NGINX to Gateway API?

Because Ingress NGINX is retired. The Kubernetes announcement of November 11, 2025 set best-effort maintenance until March 2026.

After that there are "no further releases, no bugfixes, and no updates to resolve any security vulnerabilities". Existing installs keep running, but they will not get security fixes.

The announcement recommends Gateway API as "the modern replacement for Ingress". It also splits roles that Ingress mixed together. A platform team owns the Gateway, with its listeners and certificates.

App teams own HTTPRoute objects in their own namespaces. The annotations each controller invented for Ingress become typed fields, such as weights, header matches and timeouts.

26. What reached GA in Gateway API between v1.1 and v1.6?

Most of what teams used to need annotations for. The release notes show this path into the Standard channel:

• v1.1 (May 2024): GRPCRoute and service mesh support.
• v1.4 (October 2025): BackendTLSPolicy, for TLS from the gateway to backends.
• v1.5 (February 2026): ListenerSet, the HTTPRoute CORS filter, TLSRoute v1 and client certificate validation. It also added an admission policy that blocks unsafe CRD downgrades (v1.5.0 notes).
• v1.6 (June 2026): TCPRoute and UDPRoute graduated to v1 (v1.6.0 notes).

A strong candidate also knows the two channels. Standard holds stable APIs. Experimental holds features that may still change, and v1.5 blocks installing Experimental CRDs over Standard ones.

27. How did AWS change API Gateway timeouts for long responses?

In two steps. In June 2024, AWS let Regional and private REST APIs raise the integration timeout past 29 seconds. The trade-off is that this "might require a reduction in your account-level throttle quota".

In November 2025, it added response streaming for REST APIs. Streaming sends bytes to the client as the backend produces them.

It allows integration timeouts up to 15 minutes and payloads over 10 MB, and it works with Lambda, HTTP proxy and private integrations. AWS pitched both changes at LLM workloads, where a full answer can take longer than 29 seconds.

28. What are routing rules for REST API custom domains?

Routing rules let one custom domain send a request to different REST APIs or stages based on HTTP headers, the base path, or both. AWS added them in June 2025.

Rules run in priority order, lowest number first, and the first rule whose conditions all match wins. Typical uses are header-based API versioning, such as Api-Version: 2, and A/B tests, without a proxy layer in front of API Gateway.

29. What does backend mTLS in API Gateway add?

Since September 8, 2026, a REST API can present a certificate from AWS Certificate Manager to its backend during the TLS handshake. Before that, API Gateway could only present a self-signed certificate that it generated.

The backend can now check that the caller is the gateway, using a CA it already trusts. ACM renewals reach API Gateway without a redeploy. Combined with inbound mTLS for clients, both hops of a request can be mutually authenticated.

30. How are gateways being used for AI agent traffic?

Gateways now translate existing APIs into tools that AI agents can call. In December 2025, AWS added an MCP proxy that exposes REST APIs as Model Context Protocol endpoints through Amazon Bedrock AgentCore Gateway.

For an interview, the design questions matter more than the product. Which identity does the agent use? Which scopes should an agent token get? How do you rate limit a client that can call hundreds of tools in a loop?

The same gateway controls apply: narrow scopes, per-client quotas and full request logs.

Hiring API and Platform Engineers

Gateway work sits between platform and back-end teams, so it needs engineers who understand both networking and APIs.

Second Talent matches companies with pre-vetted API developers and DevOps engineers from Asia, screened with questions like these.

Tell us the stack and we send a shortlist within 24 hours. Start hiring, or see our JWT and API security interview guides.

Ready to hire? Hire API Developers: vetted AI-native talent, with first profiles in 24 hours.