How it works
APIs enforce rate limits to protect infrastructure capacity and prevent abuse. Standard HTTP responses use 429 Too Many Requests alongside X-RateLimit-Limit, X-RateLimit-Remaining, and Retry-After headers.
Common mistakes
- Omitting Retry-After header on 429 responses
- Not documenting rate limits in OpenAPI security schemes