Operations

Endpoints

GET /list      BFF endpoints defined for this product
GET /health    liveness
GET /ready     readiness

Product endpoints are declared per tenant and served from the same surface. GET /list is the inventory, and it is accurate because it is what the runtime resolves against.

Failure policy

Decide per upstream whether a failure is fatal to the response or degrades it. This is the single most consequential operational choice in a BFF.

• A missing returns-policy blurb should not fail an order-detail screen
• A missing order should

Getting this wrong in the permissive direction produces screens that render half-empty with no error. Getting it wrong in the strict direction couples the availability of every screen to the availability of every service behind it — which makes the BFF a reliability liability rather than the improvement it is supposed to be.

Latency

Independent upstream calls run in parallel, so an endpoint costs roughly its slowest upstream rather than the sum. That is most of the latency win over a client doing the same calls sequentially.

The corollary: one slow upstream sets the floor for the whole endpoint. Watch per-upstream latency inside an endpoint, not just the endpoint’s own p99, or you will not know which dependency to chase.

Endpoint sprawl

The failure mode to watch for over time is a BFF that accumulates every screen’s endpoint until it is a second application with its own business logic.

Keep stitching declarative. When an endpoint starts needing conditional branching, derived values, or writes across services, that behaviour belongs in a service — usually the Data API or a workflow.

The signal is qualitative rather than a metric: if changing business rules means editing BFF endpoint definitions, the logic has leaked into the wrong layer.

What to watch

Signal	Why it matters
Per-upstream latency within an endpoint	One slow dependency setting the endpoint’s floor
Per-upstream failure rate	Which backend is degrading behind a still-succeeding screen
Degraded-response rate	Screens rendering with optional sections missing
Response size by endpoint	Field selection drifting as upstream entities grow
Endpoint count trend	Sprawl, and logic leaking into the assembly layer