Devnot Tech Leaders Summit 2025

About the talk

Most organisations bought their API gateway to connect systems. A few years later the same gateway decides who may call what, how much traffic a backend can take, and what the auditors will see when they ask who changed a route. It has become an operating layer, but it is still run like plumbing.

The talk walked through what changes when a gateway is treated as that layer:

• Security in one place. Authentication and coarse authorisation enforced at the edge, so that every service does not reimplement it.
• Traffic as policy. Rate limits, timeouts and retries written down per route, not left to defaults.
• Evidence by default. Percentile latency per route, who answered each error, and an audit record for every change.

Replacing a gateway is where these ideas meet their hardest test. We wrote down what we have learned about it:

Why API gateway migrations fail, and what actually works