Two municipal systems need to exchange case status repeatedly. Leadership wants durable system-to-system access without hard-coding database links between teams. Which pattern best fits?

Durable municipal system-to-system exchange favors authenticated, versioned interfaces over hard-coded production database links. An API gateway with managed identities centralizes authentication, authorization, throttling, and audit while exposing stable contracts that producers can evolve without granting consumers deep table access. That pattern keeps ownership clear: the producing agency remains system of record, and consuming teams integrate through published capabilities rather than scraping internal schemas. Granting each consuming app direct SQL accounts into production tables couples change cycles, spreads credentials, weakens least privilege, and turns every schema tweak into a multi-team outage risk. Emailing nightly CSV extracts without authentication or interface versioning lacks confidentiality controls, lineage, and compatibility management, so silent format drift and insecure distribution become normal. Sharing a writable network folder so any team can overwrite the other’s files collapses integrity and accountability into an ungoverned drop zone. Exam caveat: APIs are not automatically well governed—without versioning, contracts, and identity controls they can still become brittle; the exam emphasis is managed access patterns, not inventing a particular gateway product. Operational check: require managed identities for every inter-system call, publish an OpenAPI or equivalent contract with consumer-visible versioning, log access for audit, and reject new point-to-point production SQL grants for case-status exchange.