API throttling configuration

You can configure API throttling in the API Keys and Traffic Management application. On the API throttling tab, you define throttling that increases whenever an incoming request meets the defined throttling conditions.

When setting up a throttling condition, you can select the following entities:

• specific API keys
• whole key collections
• endpoints and resources (including HTTP method)

You can define up to 1000 throttling counters per account.

Limits on overlapping throttling conditions

When creating a new throttling condition, consider whether it overlaps with any you've already deployed, or are planning to deploy. You can have up to four throttling counters that overlap. If a single request increases more than four counters, it'll return an error.

A single counter may include multiple conditions that a request must meet to increase the counter. The counter increases only if a request meets all conditions.

Configure your throttling condition

The entities available for throttling conditions depend on the access control group (ACG) you choose when you create the counter. The ACG is a combination of the ​Akamai​ contract and group you used when registering APIs and API keys. Only the API or API keys within the selected ACG display in the Throttling conditions section. If you don't see the entity you're looking for, choose another ACG from the Access control group list to see if it's available.

You can set headers to indicate the throttling limit for the entire Akamai edge network in your responses to API consumers' requests. Headers provide valuable information to API consumers and API publishers about the remaining throttling limit and the maximum allowed throttling limit. API consumers may use this information to plan subsequent requests to your API. The default throttling-related headers are:

• X-Throttling-Limit. Provides information about the requests-per-second limit set for a throttling counter.
• X-Throttling-Rate. Provides information about the current rate which throttling is handling in the current second.

You can set up both headers such that edge servers pass them either to the client, to your origin, or both.

Customize your error response

When an API consumer's request reaches the throttling counter limit, edge servers deny a consumer's excessive requests with a 429 "Too Many Requests" HTTP error response. You can also customize the error response as desired in the Error response customization section. This functionality mirrors the one available in API Definitions. For details, see Error response customization.