Protecting against unrestricted resource consumption
The primary way to protect against the overuse of API resources is to implement rate limiting and throttling on your APIs. API rate limiting monitors the access to an API endpoint for a given client (usually based on IP address) and checks to see whether a predetermined allowed number of accesses has been made within a given window. If so, then the client will be rate-limited, typically with 429 Too Many Requests. The client will have the option to back off and retry the request or fail outright.
The server uses several different algorithms to detect the rate-limiting threshold, and some may be quite adaptive to only trigger in extreme cases of abuse. For example, the server can block many requests over a wide window or may only block on very high peak demands (or bursts) of access. The choice will depend on the perceived threats to the API, for example, denial-of-service attacks or mass data exfiltration.
Rate limiting can...
