Configure API Rate Limiting

• From the Console homepage, select Load Balancers service.

• Select your namespace.

• Navigate to Manage > Load Balancers > HTTP Load Balancers.

• Select ... for your load balancer and select Manage Configuration to open load balancer configuration form.

• Select Edit Configuration option located in the top right corner of the form.

• Scroll down to the Security Configuration section.

• In the Rate Limiting field, select the API Rate Limit option.

• Optionally in the IP(s) Allowed without Rate Limiting field, select one of the following to exclude IP addresses from rate limiting:

  • IP Allowed List - Enter IP addresses in the IPv4 Prefix List field. You can add more than one using the Add item option. At least one IP address must be entered for this option.

  • IP Allowed List using IP Prefix Set(s) - Select IP prefix sets using the List of IP Prefix Sets drop-down menu. You can add more than one using the Add item option. At least one pre-configured IP prefix set is required for this option.

Note: No IP addresses are allowed by default for the IP(s) Allowed without Rate Limiting field.

The server URL rules apply rate limiting for an entire domain or base path that contains multiple API endpoints.

• Select Add Item in the Server URLs section and do the following in the ServerUrlRule form:

• Select the Domain field and select either Any Domain or Specific Domain. In case of specific domain, enter the domain in the Specific Domain field. Default option is Any Domain.

• Select on the Base Path field and enter a base path.

Note: Select the Base Path field and click See Suggestions to display suggested list of paths. This shows suggestions only if you have configured an API definition. To know how to create and configure API definition, see Import Swagger and Define APIs.

• Select one of the following options in the Rate Limiter Values:

  • Specific Values:

    • Enter a number for both of the Threshold and Duration fields. The threshold represents the number of allowed requests for the time period set in the duration field.

    • The Count By field sets the HTTP load balancer user identifier for the client identification. You can change this to use a custom user identification. Select User Identification Policy for the Count By field and then select an existing user identification policy or use the Add Item option to create and apply a new user identification policy.

  • External Rate Limiter:

    • In the External Rate Limiter field, select an existing rate limiter. Alternatively, you can also use the Create new Rate Limiter option to create a new rate limiter and apply it here.

Note: See Configure Rate Limiting guide for instructions on how to create rate limiter and user identifiers.

• Select Apply to add the server URL rule. Use the Add Item in the Server URLs section to add more rules.

Note: The rules are processed in the order in which you configure the server rules. The first rule matching the request triggers rate limiting and rest of the rules after that are not executed. Therefore, ensure you set the order of rules as per your requirements.

The API endpoint rules apply rate limiting for specific endpoints.

• Select Add Item in the API Endpoints section and do the following in the New Item form:

• In the Domain field, select either Any Domain or Specific Domain. In the case of specific domain, enter the domain in the Specific Domain field. The default option is Any Domain.

• In the API Endpoint field and enter a specific API endpoint path.

Note: You can use the API Endpoint field's drop-down capability and select See Suggestions to display suggested list of endpoints. The suggestions are shown only if you have configured an API definition. To know how to create and configure API definition, see Import Swagger and Define APIs.

• Select the Method List field under HTTP Methods and select the methods for which the rate limiting is to be applied. You can select more than one method. Alternatively, you can select the methods you for which you don't want to apply rate limiting and then check the Invert Method Matcher, which effectively select all the other methods for rate limiting.

• Select one of the following options for the Rate Limiter Values field:

  • Specific Values:

    • Enter a number for both the Threshold and Duration fields. The threshold represents the number of allowed requests for the time period set in the duration field.

    • The Count By field sets the HTTP load balancer user identifier for the client identification. You can change this to use a custom user identification. Select User Identification Policy for the Count By field, click on the User Identification Policy field, and select an existing user identification policy or use the Create new User Identification option to create and apply a new user identification policy.

  • External Rate Limiter:

    • In the External Rate Limiter field, select an existing rate limiter. Alternatively, you can also use the Create new Rate Limiter option to create a new rate limiter and apply it here.

Note: See Configure Rate Limiting guide for instructions on how to create rate limiter and user identifiers.

• Select Apply to add the server URL rule. Use the Add Item in the API Endpoints section to add more rules.

Note: The rules are processed in the order in which you configure the API endpoint rules. The first rule matching the request triggers rate limiting and rest of the rules after that are not executed. Therefore, ensure you set the order of rules per your requirements.

• Check the order of the rules you added.

• After you finish, select Save and Exit.