An API is a set of rules and protocols that enables two software components to communicate with each other and facilitates data sharing among them. APIs play a major role in today’s digital world. With the rapid rise of API usage, understanding how to manage and control API usage effectively is crucially important. When discussing API management, designing the API to be compatible with the backend is particularly important. This is where API throttling and rate limiting come into play.
What is API Throttling?
API throttling is the mechanism of controlling the number of API requests a consumer can make in a given time frame. This helps protect your API from abuse, enables fair usage, and safeguards against system overload. In addition to that, it also helps to enable monetization.
API Throttling with WSO2 API Manager v4
WSO2 API Manager offers a comprehensive solution for API management, including robust throttling capabilities. It empowers organizations to control API traffic, ensure security, and optimize performance, all while providing the flexibility needed to scale and monetize APIs effectively. With WSO2 API Manager, you can implement throttling at different levels such as the API level, application level, resource level and subscription level.
In this article, we discuss how these different throttling levels work and how we can implement a complete throttling solution for a real-world use case.
First, let’s explore how each of these throttling levels works.
1. Subscription-level throttling
This usually goes hand in hand with monetization where it allows API providers to control the number of API requests that API subscribers (i.e. application developers) can make. This control is applied via different throttling tiers (or subscription plans). API providers can define various throttling tiers. Each throttling tier has its own rate limit defined which indicates how many API requests can be made per unit of time (ex: per minute/ per hour).
WSO2 Manager comes with 4 different throttling tiers by default.
- Bronze: Allows 1000 API requests per minute
- Silver: Allows 2000 API requests per minute
- Gold: Allows 5000 API requests per minute
- Unlimited: Allows unlimited API requests
API providers also can create their own custom throttling tiers to fit their business models or customer requirements. Each tier can also have its own pricing which allows the business to monetize their APIs.
Consumers who require more API calls can choose higher-tier subscriptions, providing them with the necessary access while generating revenue for the API provider. WSO2 API Manager’s subscription-level throttling is flexible and can be easily configured to meet the specific needs of different business models, ensuring both optimal API performance and customer satisfaction.
Burst Control
Burst Control helps protect APIs from sudden traffic spikes by enforcing rate limits alongside overall quotas. Suppose for an API a user might have a quota of 3000 requests per day, but without burst control, they could send all those requests in a short time, overwhelming the backend. Burst control allows you to set a per-second limit, such as 10 requests per second to prevent this.
By controlling the rate of requests, burst control ensures that traffic is spread evenly over time. For example, if a user is allowed 60 requests per minute, burst control can limit this to 5 requests per second, ensuring that requests are evenly distributed throughout the minute. This safeguards the backend from sudden spikes, protects against attacks like DDoS, and ensures consistent API performance.
2. Application-level throttling
An application is a logical collection of one or more APIs. When an App developer wants to subscribe to an API they need an application to subscribe to it. App developers can subscribe to one or more APIs using one Application and they can use a single access token to invoke the collection of APIs.
Application-level throttling provides a way to control API requests made by a token (i.e. application user as opposed to application developer) via a specific application, regardless of how many APIs are subscribed to the application. This type of throttling allows API developers to prevent one user with excessive traffic from using up the entire subscription quota purchased for the application, thereby ensuring fair resource allocation across multiple application users.
In WSO2 API Manager, there are 4 default application-level throttling tiers.
- 10PerMin: 10 API requests per minute
- 20PerMin: 20 API requests per minute
- 50PerMin: 50 API requests per minute
- Unlimited: Unlimited access. The Default Application, which is provided out of the box has the tier set to Unlimited.
When applications are created by App developers, they can select throttling tiers to match the subscription tiers they’re planning to purchase as well as their business requirements. Also, admin users can create custom application throttling tiers.
3. API-level throttling
Both Subscription-level throttling and Application-level throttling are typically used for monetization purposes but not for API backend protection. However, it is paramount to protect API backends from excessive traffic and spikes coming from all consumers. That’s how API-level throttling is coming into the picture. By setting an API-level limit, you can ensure that your backend services are not overwhelmed by too many requests, which could lead to degraded performance or even service downtime.
4. Resource-level throttling
An API is a composition of one or more API resources. In some APIs, different resources may have different levels of importance and require different levels of protection. Resource-level throttling allows more granular control by enforcing limits on individual API resources. For example, consider an online shopping API. The product listing API resource might be used frequently by consumers browsing for items, while the checkout items resource is much more sensitive, as it processes payments, and updates the cart. Applying different throttling limits to these API resources allows you to manage traffic more effectively. You can allow a higher rate of traffic to the product listings endpoint but apply stricter throttling to the checkout endpoint to ensure the backend handles each transaction smoothly without overloading. This feature can also ensure that high-traffic resources don’t starve critical, low-traffic ones of the system’s resources.
Now that we have discussed different types of throttling, let’s see how we can use them in a real-world use case, using WSO2 API Manager 4.3.0.
Real-world Use Case: Managing Traffic of StarWeather’s Weather API
StarWeather is a company that collects and publishes weather data. They provide this data through an API called the Weather API. Since StarWeather earns revenue from their API, it is monetized, allowing app developers to build applications using the Weather API.
Suppose Paul is an app developer who plans to develop a weather app called WeatherPredict that pulls real-time forecasts and weather alerts from the Weather API. Once built, users of the app will be able to check the weather, receive alerts, and more.
Not only Paul, but a large number of app developers build applications using this Weather API. Consequently, StarWeather handles a high volume of users across multiple apps. To ensure that their API doesn’t get overloaded—especially during high-demand periods like major storms—they can use throttling to control the number of API requests within a specific timeframe.
Let’s walk through how throttling can be implemented at different levels for this weather app using WSO2 API Manager.
Subscription-Level Throttling: Managing API Plans for Developers
StarWeather offers different subscription plans for developers, like Paul. These plans dictate how many API requests they can make, depending on how much they pay.
By default, WSO2 API Manager offers built-in subscription policies. If StarWeather wants to create its own subscription policy, let’s look at how they can create it in WSO2 API Manager.
Creating a custom subscription policy
- Navigate to API Manager Admin Portal via https://<server_host>[:<server_port>]/admin url. Admin users can access this portal.
- Navigate to Rate Limiting Policies -> Subscription Policies.
- Create a new subscription policy.
- By default, there are 5 subscription rate-limiting policies with different API request quota policies. If the admin wants to create a new subscription rate-limiting policy according to company policies they can create it at the same page.
Click the “Add New Policy” button. Create the policy with the quota limits.
- Optionally, On the same page, you can add the monetization details and burst control configurations.
- Then click on the Save button.
Assign subscription policies to the API
- Open the Publisher Dashboard and select the Weather API.
- Navigate to Portal Configurations -> Subscriptions. You will see the newly created custom subscription policy under the business plans.
- Select the required subscription plans for the API and Save.
- Once the API is published, you can see the Weather API with selected subscription plans as options for App Developers, in the dev portal.
Now the API is ready with the subscription plans. When Paul wants to subscribe to the API, he can choose a business plan according to his requirements.
Application-Level Throttling: Limiting Traffic for an Application
Paul has developed his WeatherPredict app, which is now being used by thousands of users. But to prevent any one user from overwhelming the API with too many requests, StarWeather needs to put limits on how much traffic a single user token can generate. Otherwise one or a few users could use up all quota purchased by Paul for his entire user base.
For this, we can use application throttling.
Create a custom application rate limiting policy.
- Navigate to API Manager Admin console. Admin users can access this portal.
- Navigate to Rate Limiting Policies -> Application Rate Limiting Policies. On this page, you can see the default 3 policies.
- If you want to create a custom application rate limiting policy, click on the Add policy button. Create the policy with the required count/bandwidth details. Additionally, you can configure burst control limits here. Then, save the details.
- When App developers like Paul create applications in devportal, they can pick one of application-level policies.
Assign application policies to the application.
- When an app developer creates an application, they can see both default and custom application policies on the application create page.
- Based on the app developer’s requirements, they can pick a policy and create the application.
Select the subscription plan when subscribing to the API.
- After creating the application, Paul can use that to subscribe to ‘Weather API’. On the same API subscription page, all the available business plans (both free and commercial) are listed. He can pick the business plan according to his requirements and subscribe to the API.
- The WeatherPredict app has chosen the standard plan. So, if the app makes 100 requests in a minute, the Weather API will temporarily stop accepting further requests from it until the next minute begins.
API-Level Throttling: Protecting the entire API from overload.
StarWeather’s API serves many developers and applications, not just Paul. During extreme weather events, API traffic can spike dramatically. StarWeather needs to ensure that the entire API doesn’t get overwhelmed, regardless of who’s making the requests. For that, the API developer can configure API Level rate limits for the API.
- Navigate to API configuration -> Resource of the Weather API in the publisher portal.
- Select the “API Level” and select the “Rate limiting policies” based on the backend capabilities. Here, we can see the default policies.
- If you want to create a custom policy, you can create it from the admin portal.
- Navigate to Rate Limiting Policies -> Advanced Rate Limiting Policies. You can see the default advanced policies.
- If you want a custom policy, you can add it by clicking on the “Add new policy” button.
Resource-Level Throttling: Prioritising critical services.
In StarWeather’s API, various services are offered, such as current weather data, historical weather data, and severe weather alerts. These APIs have distinct resource requirements and usage patterns, making it challenging to apply a one-size-fits-all throttling policy.
For example, APIs like “current weather data” are frequently used and lightweight, requiring minimal backend resources to deliver fast responses. On the other hand, APIs like “severe weather alerts” are more resource-intensive as they involve complex backend operations (e.g., location checks, impact assessments etc.). While the “alerts” API is used less frequently, it needs guaranteed availability when accessed, as users rely on it for critical, time-sensitive information.
Applying a uniform throttling policy across all API resources risks depleting the quota on the more frequently used services, potentially limiting availability for other API resources including high-priority ones. To address this, implementing resource-specific throttling limits can help allocate resources more effectively, ensuring that each service remains responsive and available based on its unique demands and usage patterns.
- Navigate to API configuration -> Resource of the Weather API in the publisher portal.
- Select the “Operation Level”. Then Click on the API resource that you want to apply the resource level throttling policies.
- Select the “Rate limiting policies” based on the backend capabilities. Here, we can see the default policies.
- You can create the custom rate-limiting policies for the API resources the same way you create the custom rate-limiting policies for the API.
Conclusion
APIs are the backbone of modern digital systems, allowing apps to communicate and share data effortlessly. But as API usage rises, managing traffic effectively becomes crucial to ensure stability and fair access. Throttling, especially with WSO2 API Manager, is key to achieving this balance. By setting different limits—like subscription tiers, application controls, and resource-specific restrictions API providers can protect their backend, prevent misuse, and even generate revenue. With features like burst control, WSO2 API Manager enables APIs to handle sudden traffic surges without overwhelming systems. In short, WSO2 API Manager’s robust throttling ensures that APIs stay reliable, scalable, and ready for real-world demands.
Want to discover how your organization can manage API traffic more efficiently and strengthen the stability of your systems? Get in touch with us today we’re happy to help you move forward.
