The VeriOps API platform is a multi-protocol system that exposes 5 API interfaces (REST, GraphQL, gRPC, AsyncAPI, WebSocket) through a unified gateway layer backed by microservices and event-driven infrastructure.
Click any component in the diagram to view its description, key metrics, and technology tags in the detail panel below.
Layer breakdown
Clients layer (4 components)
| Client |
Protocol |
Description |
| SDK Clients |
REST, gRPC |
Auto-generated libraries for Python, JavaScript, Go, and Java |
| Web Dashboard |
REST, WebSocket |
React SPA with real-time project boards and notifications |
| Mobile Apps |
REST, gRPC |
iOS (Swift) and Android (Kotlin) with offline-first architecture |
| Webhook Consumers |
HTTP POST |
External integrations receiving at-least-once event delivery |
Edge and security layer (3 components)
| Component |
Function |
Key metric |
| CDN |
Content delivery, TLS termination, HTTP/2 |
99.99% uptime SLA, 12 points of presence |
| WAF |
SQL injection, XSS, DDoS protection |
2 million malicious request blocks per day |
| Rate Limiter |
Per-key request throttling via Redis |
60 requests per minute default, configurable per plan |
API gateway layer (5 protocols)
| Protocol |
Transport |
Endpoints |
Interactive reference |
| REST |
HTTP/1.1 + JSON |
19 endpoints across 5 resources |
Swagger UI |
| GraphQL |
HTTP POST |
3 operation types (Query, Mutation, Subscription) |
Live playground |
| gRPC |
HTTP/2 + Protobuf |
3 RPC methods on ProjectService |
Gateway tester |
| AsyncAPI |
AMQP 0.9.1 |
3 event channels |
Event tester |
| WebSocket |
WSS (RFC 6455) |
4 real-time channels |
WS playground |
Services layer (4 microservices)
| Service |
Responsibility |
Key capability |
| Auth Service |
JWT validation, OAuth2 flows, RBAC |
50 ms average token validation |
| Project Service |
Project CRUD, status transitions, event emission |
Emits project.created and project.updated events |
| Task Service |
Task lifecycle, priority queue, assignment |
Cascading delete with parent project |
| Notification Service |
Fan-out to WebSocket, webhooks, and email |
Bridges AMQP events to client transports |
Data and infrastructure layer (4 components)
| Component |
Role |
Key metric |
| PostgreSQL |
Primary relational database |
8,500 queries per second, primary + 2 read replicas |
| Redis |
Cache, rate limits, sessions |
94% cache hit rate, 3-node cluster |
| RabbitMQ |
Event broker (AMQP 0.9.1) |
3 exchanges, 7-day message retention |
| Object Storage |
File attachments, backups, audit logs |
S3-compatible, AES-256 encryption, 2.5 TB per day |
Request flow
A typical API request traverses 5 layers in sequence:
- Client sends request to one of the 5 protocol endpoints
- CDN caches static content (24-hour TTL) and forward dynamic requests
- WAF inspects the request payload against OWASP Top 10 rules
- Rate Limiter checks the API key's remaining quota in Redis
- API Gateway routes to the appropriate protocol handler
- Auth Service validates the JWT Bearer token (50 ms average)
- Domain Service processes the business logic (Project or Task Service)
- PostgreSQL persists the state change, Redis updates the cache
- RabbitMQ publishes lifecycle events to subscribed channels
- Notification Service fans out events to WebSocket clients and webhook endpoints
Next steps
