If you are not familiar with the Koa back end framework, we highly recommend you to read the Koa's documentation introduction.
Each part of Strapi's back end can be customized:
the requests received by the Strapi server,
the routes that handle the requests and trigger the execution of their controller handlers,
the policies that can block access to a route,
the middlewares that can control the request flow and the request before moving forward,
the controllers that execute code once a route has been reached,
the services that are used to build custom logic reusable by controllers,
the models that are a representation of the content data structure,
the responses sent to the application that sent the request,
and the webhooks that are used to notify other applications of events that occurred.