Start from the consumer’s experience, not the server’s. Monitor availability and latency per operation rather than per service, because “the API is up” is meaningless when the one endpoint that matters is timing out. Track error rates split by class — 4xx tells you about your consumers and your documentation, 5xx tells you about you.
Then monitor per consumer. Usage against quota, error rate by consumer, and sudden changes in traffic shape. This is how you find the integration that just broke after a consumer’s deploy, the partner quietly about to blow through their plan, and the credential that started behaving strangely at 3am.
Run synthetic checks from outside your own network, against real operations, with real authentication, on the same schedule you would want your consumers to be able to depend on. Internal health checks passing while external calls fail is one of the most common and most embarrassing failure modes.
Connect it all to whatever you have committed to. If you publish an SLA or an SLO, the monitoring has to measure exactly that number, or the commitment is decorative. And alert on the things a consumer would notice, not on the things that page you most easily.
