Start here. This is the direct spoken answer to practice first.
Why this question matters
Investigate and mitigate API failures caused by a slow or failing downstream dependency. It matters in real backend work because the team needs observability, ownership, and rollback room to recover without guessing. The practical angle is dependency isolation, timeout strategy, retry judgment, graceful degradation, observability, and incident mitigation, tied to a concrete production decision.
I first confirm which dependency is slow and whether the API has a timeout shorter than the caller's total deadline. The outgoing request receives a bounded timeout and the incoming cancellation token, and the API returns a deliberate degraded or failure response when the dependency does not finish. I do not let requests wait indefinitely or convert every timeout into an automatic retry.