API Management System
Real-time API monitoring & governance platform — token auth, RBAC, rate limiting and GeoIP enrichment, with a full Prometheus + Grafana observability stack.
- Role
- Backend & Platform Engineer
- Timeline
- Solo build · 2025
- Year
- 2025
- Status
- Case Study
Platform · Observability
API Management System
01 The Problem
Teams had no central, real-time view of API health, abuse or access. Spikes, credential misuse and noisy clients went unnoticed until something broke — with no way to answer who called what, from where, how often.
02 The Solution
A monitoring and governance layer in front of services: JWT validation and RBAC at the edge, sliding-window rate limiting per client, GeoIP enrichment on every request, metrics streamed to Prometheus and visualised in Grafana.
03 What it does
- JWT authentication with refresh + rotation
- RBAC authorization down to the endpoint
- Sliding-window rate limiting per API key
- GeoIP tracking & request enrichment
- Prometheus metrics exporter
- Live Grafana dashboards
04 Architecture
Gateway / Edge
JWT validation + rate-limit middleware on every inbound request
Authorization
RBAC policies mapped to roles, scopes and endpoints
Services
Secured REST APIs built on ASP.NET Core
Telemetry
Prometheus exporter + GeoIP enrichment pipeline
Storage
PostgreSQL for identity, audit and request logs
Dashboards
Grafana panels for traffic, latency and abuse
05 Results
<50ms
Middleware overhead
100%
Request observability
Real-time
Abuse detection
RBAC
Endpoint-level access