Abuse Prevention

Keeping an API fast and limiting each account's request rate does not always protect the business activity behind it. Imagine a bookstore releasing 100 signed copies. Automated accounts reserve every copy, wait for the holds to expire, and reserve them again. The API stays fast, the requests have valid credentials, and each account stays below its rate limit. Customers still cannot buy the books.

Abuse prevention protects the intended use of an API's business capabilities.

This chapter explains how to identify harmful workflows, enforce durable rules, combine uncertain signals, and respond without unnecessarily blocking legitimate activity. The examples use a fictional bookstore API over HTTPS at api.bookstore.example.