Use this playbook to separate invalid upstream responses from upstream wait expiration and deadline exhaustion, and apply timeout budgets, safe retries, and circuit-breaker controls safely.
Last reviewed: February 23, 2026|Editorial standard: source-backed operational guidance
Use 502 when the gateway receives an invalid upstream response. Use 504 when the gateway waits too long for upstream response headers or data. Use DEADLINE_EXCEEDED when the caller deadline expires in RPC flow.
Another hop often enforces a lower timeout first. Gateway limits, client deadlines, upstream keepalive mismatch, or connection-pool starvation can still terminate requests.
Retries should run only on idempotent paths where repeating the request does not create duplicate side effects. Bounded exponential backoff with jitter limits retry synchronization and reduces pressure on degraded upstreams. Circuit breakers should trip when timeout and failure thresholds stay above policy for a sustained window. This posture prevents retry storms while preserving controlled recovery.
Each downstream hop needs a lower timeout budget than its caller to preserve deterministic cancellation order. The hierarchy should follow client > gateway > service > dependency on every request path. Misaligned budgets cause inner hops to run longer than outer callers, which creates wasted work and cascading timeout spikes. Ordered budgets keep failure boundaries clear and reduce cross-layer timeout amplification.