What is API rate limiting?
API rate limiting caps how many requests a client can make in a given time window. It protects a service from abuse, brute-force attacks, and accidental overload. Clients that go over the limit usually get an HTTP 429 (Too Many Requests) response.
What the buyer is really asking
Can your service withstand brute force and abuse, and can one customer's traffic slow down another's? Limits often sit in several layers, so say where each one lives.
Other ways buyers ask it
Every one of these wants the same answer:
- “Do you implement API rate limiting?”
- “How do you protect against brute force attacks?”
- “Do you have DDoS protection?”
Evidence to have ready
- Rate limit settings at the gateway, CDN, or identity provider
- DDoS protection provided by your edge network
How Tyrvar answers this
Tyrvar treats every wording above as one question. You write the answer once, attach the evidence, and revisit it when your setup changes. Each buyer gets that approved answer no matter how their questionnaire words it. If you have not answered it yet, Tyrvar flags the question for you and does not make something up. Try it on your own questionnaire.