What is SaaS API Rate Limiting?

The​‍​‌‍​‍‌ SaaS API of a cloud-based application limits the number of API calls to a service for a certain period for a client device, user, IP, key, or tenant. The client is configured to send a specific number of requests. This type of API limiting has implications for service infrastructure capacity, as it also assists with user access limitation and helps with cloud spending management.

Within rate limiting mechanisms, the monitoring of ‘429 Too Many Requests’ messages is a common practice, occurring when servers transmit these to clients after their request threshold is met. In many cases, servers use the “Retry-After” header to inform clients which delay is recommended between retrying requests.

Here is what rate limiting specifically does:

• It is associated with addressing potential system operational issues that may arise from a high volume of requests from an unforeseen origin.
• It prevents activities such as web scraping or brute-force hacking.
• It addresses the cost arising from autoscaling or resource usage by downstream systems.

1. Follow the instructions given in Retry-After headers.
2. Try exponential backoff with a random component.
3. “Queue” the requests or spread the load at high concurrency.
4. You can implement a token bucket for traffic and queue management on the client side for workloads that require ​‍​‌‍​‍‌parallelism.

A typical solution involves various layers: API gateway, edge security platform, and service-control or quota system. The following patterns may be applicable:

• Per-key limits
• Per-tenant limits
• Endpoint-specific limits
• Багаторівневі плани

In cases where rate limiting contributes to a higher quantity of client contacts for support staff, it is advisable to explain the basis for request limitations. The providers should be advised to:
· Use distinct HTTP status codes.
· Show Retry-After and rate-limit headers.
· The limits specified in the documents are to be communicated to the developers.
· Where feasible, display the customer’s usage statistics or their remaining quota.

Rate limiting manages abuse, cost, and fairness, but its effectiveness in resolving issues in distributed systems may have boundaries. The integration of rate limiting with other controls warrants consideration:

• Quotas
• WAF or bot protection
• Authentication and idempotency
• Моніторинг