While you _can_ tack all of those things on to your API, many people (myself included) prefer to separate those concerns. A dedicated API Gateway can prevent a lot of additional load from hitting the backend services. A gateway can also be a nice abstraction of the public interface from the underlying service(s).