DoorDash·Software Engineer·Onsite - System Design / Architecture·Senior

Senior

Jun 2026

Summary

System design round at DoorDash focused entirely on how you handle upstream API dependencies in production. Pretty deep, lots of sub-topics crammed into one question.

Questions Asked (1)

When your service calls external upstream APIs in production, what are all the things you need to think about and get right?

System DesignAPI & IntegrationsTechnical Trade-offs

Author's notes

This question sprawled in a way I wasn't ready for.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Structure your answer around the lifecycle of an external API call: before, during, and after. Cover reliability, performance, and observability, and tie each consideration to real-world trade-offs like latency vs. consistency. Emphasize how you'd design for failure and measure success in production.

Pro tip: Always mention idempotency and circuit breakers—they show you've operated services at scale. Also, discuss how you'd handle partial failures and degrade gracefully, which is critical for user-facing systems like DoorDash.

1. Define requirements and SLAs

Clarify the expected latency, throughput, and availability of the upstream API, and how critical it is to your service. Establish SLAs and error budgets to guide design decisions.

2. Design for reliability

Implement retries with exponential backoff and jitter, circuit breakers, timeouts, and fallbacks. Ensure idempotency for safe retries and consider bulkheads to isolate failures.

3. Optimize performance and cost

Use caching, connection pooling, and request batching where appropriate. Consider async calls or parallel requests to reduce latency, and monitor usage to control costs.

4. Ensure observability and testing

Add logging, metrics (latency, error rates, saturation), and distributed tracing. Test failure scenarios with chaos engineering and contract tests to validate integration.

5. Handle security and compliance

Secure API keys, use TLS, validate inputs/outputs, and adhere to data privacy regulations. Implement rate limiting and authentication/authorization mechanisms.

Key Points to Mention

Timeouts, retries with exponential backoff and jitter, and circuit breakers to prevent cascading failures.
Idempotency keys to ensure safe retries for non-idempotent operations.
Caching strategies (e.g., TTL, stale-while-revalidate) to reduce load and improve latency.
Monitoring and alerting on error rates, latency percentiles (p95, p99), and saturation.
Graceful degradation and fallback mechanisms to maintain partial functionality.
Security considerations: API key management, TLS, input validation, and rate limiting.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.