Rate Limit An Agent Or Shared API

Use Policy rate limiting to stop one agent or a group of Clients from exhausting a shared upstream connection. Passing the limiter never grants access by itself; later mandatory Policies must still allow the request.

Choose The Scope

Attach Client scopes to a Client Binding. Attach a shared api_instance gate to the API Instance so one Client cannot bypass it through another Binding.

Web Console

1. Create a Structured Policy and select the actions to limit.
2. Set THEN to Rate limit.
3. Enter bounded parameters such as:

{"scope":"client_binding","requests":60,"period_seconds":60,"burst":10}

4. Keep OTHERWISE explicit; normally allow means unmatched actions do not consume this bucket but still continue to later Policies.
5. Add fixtures for a matching rate-limit decision and a non-matching action.
6. Publish, test, enable, and attach at a stable order before the final allow Policy.

CLI

Store the same parameters under the matching Structured Policy outcome, then:

apiz -o json policy publish --project ./agent-rate-limit > policy-review.json
POLICY_ID=$(jq -r '.candidate.policy_id' policy-review.json)
DRAFT_REVISION=$(jq -r '.candidate.draft_revision' policy-review.json)
POLICY_REVISION=$(jq -r '.candidate.current_published_revision' policy-review.json)
jq '{candidate, changes, evidence, traffic_effect}' policy-review.json
apiz -o json policy publish "$POLICY_ID" --project ./agent-rate-limit \
  --expected-draft-revision "$DRAFT_REVISION" \
  --expected-policy-revision "$POLICY_REVISION" --confirm > policy.json
apiz policy test-suite "$POLICY_ID"
apiz policy enable "$POLICY_ID"
apiz client binding policy add <client-binding-id> \
  --policy "$POLICY_ID" --order 50

Verify Allow And Limit

Send controlled requests until the bucket is exhausted. Capacity should continue to the next Policy; exhaustion returns HTTP 429, Retry-After, X-APIZ-Error-Code: apiz_rate_limited, and reason rate_limit_exceeded before Secret Broker release or upstream contact. Redis failure fails closed with apiz_rate_limit_unavailable.

Access Logs record scope, outcome, safe definition identity, and retry timing without using Client, IP, or resource values as unbounded metric labels.

Change Or Remove The Limit

Publish a tested revision to change capacity. Renaming Scripted profiles creates a new bucket identity; updating an existing profile preserves it. Detach the Policy only after confirming another mandatory gate still protects the shared connection. Policy rate limits are authorization controls, not billing ledgers or spend limits.