Beginner LevelREST APIs & Web Services
How does HTTP Rate Limiting work with 429 Too Many Requests and X-RateLimit headers?
❓ Interview Prompt: Explain Rate Limiting, `429 Too Many Requests` status, `X-RateLimit-Limit`, `X-RateLimit-Remaining`, and `Retry-After` headers.
Rate Limiting protects APIs from abuse, denial-of-service (DoS) attacks, and resource exhaustion by capping the number of requests a client can make in a given time window:
Response Headers:
•
'X-RateLimit-Limit': Max requests allowed per window (e.g. '100').
•
'X-RateLimit-Remaining': Remaining requests available in current window (e.g. '5').
•
'X-RateLimit-Reset': Unix epoch timestamp when limit window resets.
•
'Retry-After': Seconds client must wait before retrying after receiving '429' status.
Code Implementation Example
http
HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 60
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1753700000
{
"error": "Rate limit exceeded. Please retry in 60 seconds."
}💡HTTP 429 response returning rate limit headers and Retry-After delay.
🎯 Interview Key Takeaway
Return 429 Too Many Requests with Retry-After and X-RateLimit headers when client request quotas are exceeded.
#Rate Limiting#429#Headers#Beginner
Back to all REST APIs & Web Services Questions→