The Gateway Does Not Know Whose Order That Is: API Management and Delivering a Service
A gateway can verify that a caller is who they claim and has not exceeded its quota. Whether they may see this record only your data can answer.
-
-
API Gateway
A gateway checks that the token is valid and the quota is not spent. Which invoices belong to whom is a question its backend should answer.