-
Notifications
You must be signed in to change notification settings - Fork 145
APIMGMT-1962: Enhance rate limiting documentation with route-specific backoff details and configuration options. Include YAML example for enabling backoff in API routes across multiple versions #1105
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -24,6 +24,28 @@ | |
|
|
||
| - **Retry-After**: [seconds to wait before rate limit resets] | ||
|
|
||
| ### Route-specific backoff | ||
|
|
||
| Some APIs may apply an additional route-specific backoff when the same client repeatedly exceeds rate limits across multiple intervals. When backoff is active, the API still returns `429 Too Many Requests`, but the `Retry-After` header may be longer than the standard rate-limit reset window. | ||
|
|
||
| Always wait for the full `Retry-After` value before sending another request. If your integration continues to exceed limits, reduce request concurrency or spread requests over a longer period so each `client_id` stays within the documented limits. | ||
|
|
||
| ### Route-owner configuration | ||
|
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Like Claude mentioned, you should remove the |
||
|
|
||
| Route owners can enable backoff in the API route specification for routes that need escalating retry delays. The authoritative route YAML is maintained in `cloud-api-client-common/api-route-specs/sp-gateway-routes.yaml`. | ||
|
|
||
| ```yaml | ||
| backOffConfig: | ||
| enabled: true | ||
| intervalThreshold: 3 # Distinct violated intervals before backoff triggers | ||
| tiers: [60, 300, 600, 1200] # Backoff durations per escalation tier, in seconds | ||
| violationWindow: 120 # Window for counting violated intervals, in seconds | ||
| tierMemoryWindow: 3600 # How long to remember the last tier after expiry, in seconds | ||
| redisTimeoutMs: 5 # Max time allowed per Redis backoff operation, in milliseconds | ||
| ``` | ||
|
|
||
| Backoff is active only when the route has `backOffConfig.enabled: true` and the gateway backoff rollout control is enabled. Omitted or non-positive values fall back to the gateway defaults. | ||
|
Check failure on line 47 in docs/api/rate-limit.md
|
||
|
Comment on lines
+33
to
+47
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. 🔴 The new "Route-owner configuration" subsection (added to all 6 Extended reasoning...What the bug isThe PR adds two new subsections to The second — Route-owner configuration — is internal-only material that has been published to the public developer portal. The repository's own README states that How the audience mismatch manifestsFour concrete tells in the added block show it's aimed at the wrong audience:
Why the preceding section is already sufficientFor the external audience, only the answer to "what do I do when this happens?" matters. That is fully covered by the prior subsection: clients still receive Impact
Step-by-step proof
How to fixRemove the entire "Route-owner configuration" subsection (including its YAML code block and the trailing "Backoff is active only when…" paragraph) from all 6 files. Keep "Route-specific backoff", which is correctly scoped for the public audience. If the route-owner content is still needed by SailPoint engineers, host it in an internal docs location (internal Confluence, the |
||
|
|
||
| :::info | ||
|
|
||
| Specific APIs may have different rate limiting. Refer to their specifications for this information. | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is good, but maybe expand this section with an explanation of what a backoff is, and when it is applied. Customers are very concerned about rate limiting; I'm still getting questions about the addition of
client_idto the rate limit key.