Skip to main content

Request Lifecycle

Every API request follows the same path: authenticate, validate, authorize, execute.

Steps​

  1. API Gateway receives the request and forwards the JWT or API key to the Lambda authorizer.

  2. Lambda Authorizer resolves the caller's identity from DynamoDB and returns a context with principalId, scopeId, and permissions.

  3. Handler validates the request body, path, and query params against a DTO. If validation fails, returns 400.

  4. Authorization — requirePermission(resource, action) checks that the caller has the required permission in the target scope. If not, returns 403.

  5. Service executes the business logic. Repositories handle data access. Domain entities enforce invariants.

  6. Response is returned to the client. Audit events and webhooks fire asynchronously — they don't add latency to the response.