Hi Team,

We attempted to make 5 API hits per minute using our product's rate limit, but the limit was not being enforced and we were able to make more hits than allowed by our plan for all APIs.Currently, we have developed a single API and product for testing purposes. We have set a rate limit of 5 hits per minute, but we are still able to exceed that limit by calling the API multiple times. Can you please help us how we can configure the same on datapower level if possible for particular one api only?

Did you make the rate limit a "hard limit" ?

The default for rate limits is a soft limit, which means that extra requests will be handled but they will be tracked. If you were doing some kind of billing then you could charge overage.

If you use hard limits then once you exceed the rate limit you will get a 429 response instead.

Different APIs call for different approaches so both are possible and it is up to you to decide what best fits your needs.

Hi Chris Dudley,

 Thanks for reply ,and We have applied the hard limit but we are still able to hit it multiple times even default 100/1 hours is also not working it's seems unlimited times.

what if we have added hard limits to but getting unlimited hits for apic.

Then my guess is that you have not correctly configured the security requirements on your API.

It needs to have client ID security as a minimum on all operations - check you havent accidentally added an empty security requirement in your API meaning no security is required.

If you do that then rate limits will not be enforced since they only apply when security is being enforced.

Did you secure the API with a client_id? You need to subscribe to the plan and use that client_id while accessing the API.

Hi Chris and Anu,

Thanks for your help. We have added the client_id in our api and subscribe the same. Now API is working fine as per rate limit.