This is more about architecture question.
I will be developing microservice in Lumen or Slim, it will not be accessible from the public. The private microservice will be dealing private stuff. Laravel backend will communicate with microservice via REST API (Private / Internal use only). Users will know nothing about microservice.
If Frontend website (public) ever get hacked, it will minimise damage from accessing private stuff on the microservice.
However I want users to use Public API to communicate from public Frontend which then execute requests to microservice. To me this seem to duplicated API Requests - One for Public, and other one for Private (Backend to Microservice)? Or is it nothing wrong with that design?