When an integration initiated from the client-side (the browser) fails, the architect must first look at the browser's security policies. In Salesforce, Lightning Web Components are subject to the Lightning Component framework's Content Security Policy (CSP).
CSP is a security layer that prevents cross-site scripting (XSS) and other code injection attacks by restricting which domains the browser is allowed to communicate with. If an LWC attempts to make a fetch() call to an external REST endpoint, the browser will block the request unless that specific domain is whitelisted in CSP Trusted Sites.
Option B (Remote Site Settings) is a common distractor; these settings are strictly for server-side Apex callouts and have no effect on client-side JavaScript requests. Option A (CORS) is also a browser security mechanism, but it must be configured on the external server to allow Salesforce to access its resources.
While CORS is necessary, the first thing to validate within the Salesforce environment for a failing LWC callout is the CSP Trusted Site entry. Without this whitelisting, the request will be terminated by the browser before it even leaves the client, regardless of how the external server is configured.

In the framework of a Salesforce Platform Integration Architect's landscape evaluation, the primary goal is to determine the "system of record" for each business function and identify redundancies between legacy systems and the proposed Salesforce architecture. This process is driven by the alignment of Salesforce's native "Customer 360" capabilities with the specific goals defined by the enterprise stakeholders.
According to Goal 2, the customer intends to leverage Salesforce specifically for marketing, sales, and service processes. Within the standard Salesforce ecosystem, these domains are addressed by the three core cloud products:
* Marketing Cloud provides the capabilities found in the legacy Email Marketing System.
* Sales Cloud replaces the functions of the Sales Activity System.
* Service Cloud is the native replacement for the Case Management System.
By migrating these three domains to a single platform, the organization directly fulfills Goal 1-developing a
360-degree view of the customer. Consolidating these interactions onto the Salesforce platform allows for a unified data model where customer behaviors in marketing, sales, and support are visible in one place, eliminating the silos inherent in the previous landscape.
However, a critical constraint is presented in Goal 3, which explicitly mandates the reuse of existing enterprise capabilities for quoting and order management. In an integration architecture, this signals that the Quoting System and Order Management System (OMS) are designated as external systems of record that must remain active. These systems often contain complex logic, tax calculations, or supply chain integrations (such as with an SAP Business Suite) that the business is not currently ready to migrate.
Therefore, since the Quoting and Order Management systems must be retained, they are excluded from the retirement list. The remaining three systems-Email Marketing, Sales Activity, and Case Management- overlap with Salesforce's native strengths and are not protected by the "reuse" requirement. Retiring them streamlines the technology stack and allows the architect to focus on building robust integration patterns (such as REST or SOAP callouts) to connect Salesforce to the retained Quoting and Order Management systems.

When migrating from a legacy environment to a multi-tenant cloud platform like Salesforce, Data volume and processing volume represent the most critical technical constraints. Legacy systems often operate without the strict governor limits found in Salesforce, meaning they may push large datasets or high- frequency updates that could easily overwhelm standard Salesforce APIs.
An integration architect must evaluate these volumes to determine the appropriate integration pattern:
* Pattern Selection: If the daily volume involves millions of records, the architect must recommend the Bulk API rather than standard REST or SOAP APIs to avoid hitting daily API limits.
* Synchronous vs. Asynchronous: High processing volumes often necessitate asynchronous patterns (such as Fire-and-Forget or Batch) to prevent user-interface lag and "Concurrent Request Limit" errors.
* Data Virtualization: If the legacy data volume is massive but only needs to be viewed occasionally, the architect might consider Salesforce Connect to avoid consuming expensive internal data storage.
While reporting (Option A) and multi-currency (Option C) are important functional requirements, they do not fundamentally dictate the technical "plumbing" or scalability of the integration architecture. By prioritizing the analysis of volume and processing needs, the architect ensures the new modernization effort is stable, performant, and capable of scaling as the business grows within the bounds of the Salesforce platform.

The primary architectural challenge in this scenario is the massive discrepancy between the backend response time (up to 90 seconds) and the API Gateway timeout constraint (9 seconds). In any synchronous integration pattern, the connection must remain open across the entire path; if the API Gateway closes the connection at 9 seconds, a standard Salesforce "Request-Reply" callout will fail long before the 90-second eligibility check is complete.
Option A is non-viable because synchronous polling at a high scale (3,000 concurrent users) would likely hit Salesforce concurrent request limits and place an immense, unnecessary load on the API Gateway. Option B, using Continuation, is designed to handle long-running callouts (up to 120 seconds) without blocking Salesforce threads, but it still requires the external connection path to remain open. It does not bypass the 9- second timeout imposed by the customer's API Gateway.
The optimal recommendation is Option C, which implements an Asynchronous Request-Reply pattern using Platform Events and the empAPI.12
* Request Phase: The Salesforce UI initiates the request. To bypass the 9-second gateway timeout, the ESB (MuleSoft) should be configured to receive the request3 and immediately return an acknowledgment (e.g.,4 HTTP 202 Accepted). This allows the initial Salesforce callout to complete successfully within the 9-second window.56
* Processing Phase: MuleSoft then proceeds with the long-running (up to 90 seconds) call to the external eligibility systems.78
* Callback Phase (Remote Call-In)9: Once the eligibility result is received, MuleSoft calls back into Salesforce via the REST API to publish a Platform Event containing the result.10
* UI Update (empA11PI): The 3,000 sales agents' browsers, having subscribed to the event channel using the empAPI (Lightning's built-in library for streaming events), receive the notification in real- time. The UI then updates to display the "Display Response" step.
This event-driven architecture effectively "insulates" Salesforce and the API Gateway from the backend's high latency, ensures scalability for 3,000 concurrent users, and provides a seamless, real-time user experience without hitting governor limits or timeout constraints.