Context
A healthcare provider integrated multiple external labs and billing systems. Regulators expected minimised clinical field exposure and auditable access reasons tied to caller identity.
Constraints
Legacy interfaces returned wide rows; there was no unified API gateway or coherent rate policy; audit logs were fragmented with inconsistent fields.
What we did
A policy-aware gateway applied field-level filtering and dynamic masking; clinical reads carried purpose_of_use and operator context; external calls used mutual TLS, quotas, and circuit breakers. A centralised audit index enforced retention and access by data class.
Outcomes
Integrators received only contract-permitted fields; spot checks could reconstruct a call chain in one log stream; abnormal traffic was throttled at the edge before core databases saturated.