Rate Limit Control List

You can configure rate limit control for APIs and endpoints, define identity-based limits, and provide overuse protection. You can configure permitted message count, time interval period length, and time interval unit settings for each API and endpoint.

With this policy, the following settings can be made for each API and endpoint:

• Permitted Message Count (Permitted Message Count): Maximum number of requests allowed within the specified time interval.
• Time Interval Period Length (Time Interval Period Length): The length of the time interval.
• Time Interval (Time Interval): The unit of the time interval (second, minute, hour, day, month).

Rate limit control works as follows:

1. Request Analysis

   When a request arrives, the target variable value (e.g., IP address) is obtained.

2. Identity Check

   It is checked whether this value is in the target identity list.

3. Rate Limit Control

   If the value is in the target identity list or matches with regex, rate limit control is performed for the relevant endpoint.

4. Decision Making

   If the user has exceeded the limit, the request is rejected; if not, processing continues.

5. Response and Statistics

   While responding to the request, if configured, rate limit statistics are added to response headers.

This configuration provides a powerful mechanism to protect your APIs against overuse and set different usage limits for different users.

An image containing Rate Limit control list page settings is shown below:

The fields used for rate limit configuration are shown in the table below.

Field	Description
Name	A name can be written to facilitate the use and management of the configuration. You will need this name during configuration management and selection.
Description	A description can be written to facilitate the use and management of the configuration.
Execution Order (Execution Order)	Determines when the rate limit policy will be applied. Rate limit controls always run after policies on the “ALL” line, but when FIRST is selected, they are applied before other policies on the endpoint, and when LAST is selected, they are applied after other policies on the endpoint.
Interval Window Type (Interval Window Type)	Determines the type of time interval to be used in rate limit calculation. It can take FIXED or SLIDING values. When FIXED is selected, a fixed number of requests are accepted within a certain period (e.g., every hour). When SLIDING is selected, the number of requests within the last certain period (e.g., last 1 hour) is taken into account.
Cache Connection Timeout (second) (Cache Connection Timeout (second))	Determines the maximum time to wait when connecting to the cache service in seconds.
Action for Cache Connection Error (Action for Cache Connection Error)	Determines the action to be taken when an error occurs during connection to the cache service. When FAIL is selected, the request is rejected in case of connection error, and when CONTINUE is selected, the request continues to be processed.
Show Rate Limit Statistics in Response Header (Show Rate Limit Statistics in Response Header)	Determines whether rate limit information will be shown in response headers. When set to TRUE, information such as remaining request count, limit value, and time until limit renewal is added to response headers (RateLimit-Remaining, RateLimit-Limit, RateLimit-Reset, X-RateLimit-Identity, X-RateLimit-Type headers).
Apply by Variable (Apply by Variable)	Determines the variable to be used to identify the user or client to which rate limit will be applied. This can be, for example, IP address, user ID, or API key. This variable value is used for identity identification.
Regular Expressions for Target Credentials (Regular Expressions for Target Credentials)	Regular expressions used to identify target identities. Used to flexibly match identity values in the system.
Target Credentials (Target Credentials)	List of specific identity values to which rate limit will be applied. Rate limit is applied for identity values found in this list.
APIs and Endpoints (APIs and Endpoints)	List of APIs and endpoints to which the rate limit policy will be applied.