Which WordPress pages/URLs should never be cached?

I have a multisite blog that will soon have an Akamai caching service sitting in front of it, serving cached content to visitors (15 minute TTL).

I want to configure Akamai to exclude any important URLs that should never be cached (i.e., don’t want to serve cached login/admin pages). Is there a compilation, or general recommendation, of all important URLs that should never be cached? Here’s what I’ve got so far:

• /wp-* (This would prevent wp-includes/admins/etc)
• /xmlrpc.php
• Any URL with with ?preview=true so that editors can preview

Edit: Additional info below

We are using Akamai edge cache, which is full site caching. Basically, Akamai acts as a reverse proxy server. Our DNS is pointing at Akamai, visitors hit Akamai directly. Akamai only hits us to update pages when TTL expires, or when a page is requested that isn’t already cached.

We have the ability to exclude parts of the site from being fully cached, for example URLs matching wp-*, or any urls with the query string preview=true. Exclusions do allow cookies to be passed through; POST requests are also allowed.

With this additional info, the original question still remains — what WP-specific URLs/paths/etc need to be excluded from the full-site caching to prevent things from breaking? E.g., previews obviously need to be dynamic by nature, so I’ve excluded that by allowing preview=true query string. What else do I need to exclude? Is anything matching wp-* good enough, or are other things missing, i.e. /xmlrpc.php?

I hope things brings some additional context to the original question.

You should not cache anything in the admin so your examples are correct.

A typical nginx reverse proxy cache is set to ignore wp\-.*\.php|wp\-admin

Another option is to not cache logged in users by checking the wp cookies, but you probably don’t have that level of control.

ps. It is highly advisable you test this out before flipping the switch.

tl;dr You should be fine with a vanilla install.