Controlling how much callers use.
WHY LIMITS EXIST
To protect the service from one caller, whether malicious or mistaken.
WHAT TO LIMIT BY
The authenticated caller, primarily The source address, for unauthenticated requests
WHY NOT ADDRESS ALONE
Many legitimate callers share addresses.
WHAT APPROACHES EXIST
A fixed count per window A sliding window A token bucket, permitting bursts
WHAT A TOKEN BUCKET PROVIDES
Tolerance of short bursts within a sustained average.
WHY THAT SUITS REAL USAGE
Traffic is bursty, and strict windows reject legitimate patterns.
WHAT TO RETURN WHEN EXCEEDED
The too-many-requests status, with how long to wait.
WHY THAT HEADER MATTERS
It lets well-behaved clients back off correctly rather than hammering.
WHAT TO RETURN ON EVERY RESPONSE
The limit, the remaining allowance and when it resets.
WHY ON EVERY RESPONSE
Callers can pace themselves instead of discovering the limit by hitting it.
WHAT TO SET LIMITS FROM
What the service can sustain, not an arbitrary figure.
WHAT TO LIMIT SEPARATELY
Expensive endpoints.
WHY
One search costs what a hundred simple reads do.
WHAT QUOTAS DIFFER FROM RATE LIMITS IN
Covering a longer period, often tied to a plan.
WHAT TO DOCUMENT
Every limit, precisely.
WHAT TO MONITOR
Who is hitting limits, and whether the limit is wrong.
