Rate Limiting

An integration does not need malicious intent to overwhelm an API. Suppose a bookstore's catalog integration normally makes a few requests each second, but a deployment introduces a polling loop that sends hundreds. Every request has valid credentials and a valid payload, yet the extra work competes with customers browsing and placing orders.

Rate limiting controls how quickly a caller can introduce work.

This chapter explains how to define a useful policy, choose an algorithm, communicate rejection, and enforce limits across multiple servers. The examples use a fictional bookstore API over HTTPS at api.bookstore.example; all limit values are illustrative design choices.