All APIs must have abuse prevention mechanisms beyond basic rate limiting, including throttling, quotas, circuit breakers, and bot detection, ensuring the stability and availability of APIs for legitimate consumers while protecting the platform from malicious or excessive usage.
APIs Are Protected from Abuse and Misuse
Policies
Abuse Prevention (Security)
Require that every API is designed to resist abuse and misuse, so I want throttling, quotas, anomaly detection, bot and scraping defenses, and sensible request limits treated as part of the contrac...
Rate Limits
Providing details of rate limits being applied as part of each plan, and what is available to consumers as part of their application usage.
Testing
Require that security testing has occurred and publishing results for API security.
Gateways
All APIs are made available via a designated gateway for the company, domain, line of business, or team, ensuring that all APIs have access to shared authentication, rate limits, service compositio...
Experiences
Security
API security is a top priority for any enterprise, with even higher standards for externally available APIs. However, security doesn’t end with the APIs an enterprise produces—it also applies to co...
Trust
Establish trust with API consumers will evolve and build over time, and is something that can be lost in a very short period of time. Trust will depend on other experiences like quality and reliabi...
Reliability
If an API isn’t reliable, consumers will eventually look for alternatives. Reliability starts with the platform and infrastructure where the API is deployed, but it also depends heavily on the pace...
Scalability
Scalability is the experience of an API continuing to work well as demand grows from dozens of consumers to millions of requests. It touches infrastructure, rate limiting, caching, and design decis...
Performance
Performance is the experience of how fast and consistently an API responds under real-world conditions. Latency, throughput, and predictability directly shape how consumers perceive an API and whet...
