Enterprise API Architecture in .NET: System vs. Process vs. Experience APIs (BFF Pattern)

When building modern microservices and enterprise applications in .NET 8 / 9, one of the most common architectural mistakes developers make is creating a single, monolithic API that handles raw database queries, complex business rules, and UI-specific data formatting all in one place.

As applications scale across Web, Mobile, and 3rd-party consumers, this "Spaghetti API" approach leads to fragile deployments, security risks, and massive code duplication.

To solve this, top tech companies and enterprise architects use a 3-Layer API-Led Architecture paired with the Backend for Frontend (BFF) pattern. In this article, we break down each layer, explore real-world use cases, and walk through a clean .NET solution structure.

The 3-Tier API-Led Architecture at a Glance:

 1. EXPERIENCE APIs (BFF Layer)

   • Web BFF API (Tailored JSON for Angular/React) 

   • Mobile BFF API (Lightweight JSON for iOS/Android) 

                                  ▼

 2. PROCESS APIs (Business Logic & Orchestration) 

  • Checkout & Order Processing API 

  • Customer Onboarding Process API 

                                  ▼

 3. SYSTEM APIs (Core Data & Integrations) 

  • Customer Data System API (SQL Server / EF Core) 

  • Payment Gateway System API (Stripe / PayPal)  

1. System APIs (Core Data Layer)

What it does

System APIs sit at the bottom of the stack. Their sole responsibility is to securely interact with underlying data sources, databases, legacy systems, or third-party platforms.

Key Rules

   - No Business Logic: They do not apply discounts, evaluate user rules, or              aggregate multiple systems.

   - Encapsulation: They abstract raw SQL schemas, Entity Framework Core             models, or SAP/Stripe SDKs behind standardized HTTP endpoints.

2. Process APIs (Business Logic & Orchestration)

What it does

Process APIs sit in the middle tier. They orchestrate work across multiple System APIs to execute a business workflow.

Key Rules

    - Business Logic Lives Here: Rules around order fulfillment, discount                  calculations, validation pipelines, and event publishing belong in this layer.

    - Reusability: A single Process API (e.g., OrderProcessApi) can be called by web         apps, mobile apps, or internal automated jobs.

3. Experience APIs / BFF Pattern (Client Layer)

What it does

Experience APIs sit at the top layer, directly behind an API Gateway. They are tailored specifically for a target end-user client (e.g., React Web App, iOS App, or IoT Device).

Why it matters (The BFF Pattern)

A mobile app operating over a cellular network should not download 50 database columns just to display a user's name and avatar. The Mobile Experience API strips down the payload, returning only the essential fields needed for mobile rendering.

Key Rules

     - Client-Specific: Web and Mobile apps may each have their own separate           Experience API.

     - Aggregation: It shapes and formats responses specifically for the UI without        containing heavy business logic.

Clean .NET Solution Structure

Here is how to organize these 3 layers within a single .NET Solution (.sln):

DotNetFullStack.ApiArchitecture/

│

├── src/

│   ├── Experience/

│   │   ├── DotNetFullStack.Web.Bff.Api/

│   │   └── DotNetFullStack.Mobile.Bff.Api/

│   │

│   ├── Process/

│   │   └── DotNetFullStack.Checkout.Process.Api/

│   │

│   └── System/

│       ├── DotNetFullStack.Customer.System.Api/

│       └── DotNetFullStack.Payment.System.Api/

│

└── tests/

    ├── Process.Tests/

    └── System.Tests/

Why Top Companies Use This Approach

Benefit	Explanation
High Reusability	If you change your database from SQL Server to PostgreSQL, you only rewrite the System API. The Process and Experience layers remain untouched.
Better Security	System and Process APIs remain in a private Virtual Network (VNet). Only Experience APIs are exposed via an API Gateway with OAuth 2.0 / JWT.
Optimal Performance	Mobile devices receive smaller, faster JSON responses through client-tailored Experience APIs.

Summary

1. Use System APIs to encapsulate raw data access and external integrations.

2. Use Process APIs to handle core business logic and multi-system workflows.

3. Use Experience APIs (BFF) to format and deliver lightweight payloads tailored to specific frontends.