The Enterprise Data Gateway is an API gateway for groups of companies. A group usually buys a third-party company-data service with a single official key, yet every subsidiary needs to call it — the key gets passed around, costs cannot be allocated, fields are used inconsistently and nobody can tell who made a call. The gateway keeps the official key on the group side and lets subsidiaries connect through governed sub-keys.
Results
- Costthe first lookup of a company goes upstream and stores 5 records in the database; later lookups of that company are served from cache and never draw on the group quota. The hit rate settles above 70%, so about 70% of lookups no longer incur API fees
- Scale4 subsidiaries across the group, each with 10–20 salespeople looking up about 10 companies a month — roughly 400–800 lookups a month, of which about 280–560 are served straight from cache
- Speedonboarding a subsidiary goes from requesting and forwarding the official key to issuing a sub-key in one click, with permissions and quotas applied at once
Problems it solves
- Key exposurethe official key never leaves the gateway; each subsidiary holds its own sub-key that can be disabled or rotated at any time
- Runaway costrepeat queries are served from cache without spending official quota, and usage is allocated and reported per subsidiary
- Inconsistent fieldseach consumer is bound to a field pack, so one source returns only the fields that business is entitled to
- No traceabilityevery call, login and configuration change is logged
How it differs
- Versus a generic API gateway: the group distribution model (official key → sub-keys), field packs and contract quotas are built in — no custom layer on top
- Versus each subsidiary buying its own: one contract and one cache, with group-wide usage and cost in view
- Four quota layerssubsidiary QPS, daily requests, group daily quota and contract total, so no single business can drain the group's allowance
- Audit at the data layerwrites are recorded at SQL level with automatic masking, not just in application logs
Core capabilities
- Access controlIP allowlist, request signing and per-API authorization
- Cache warm-upbulk pre-loading of frequently queried companies, with rate limits
- Circuit breaking & alerts: time-windowed upstream failure counting, with alerts pushed to an IM bot
- Unified logs5 kinds — calls, logins, errors, operations and more — in one place
- Self-monitoringone screen to tell whether the gateway, the database or the upstream is at fault
- Quality60+ automated tests on auth, rate-limit and quota edges
Note: group and subsidiary names, the data provider, keys and call data are anonymized, and the live address is not shown.