Systems and methods for API rate limiting and distribution
An API rate limiting system may receive a client request from an API client associated with a tenant, formulate a proxied request with an internal authentication specific to the tenant, and send the proxied request to API endpoints (tenant resources) at a store. The store fulfills the request, accessing and modifying local database(s) as needed, and returns a response to the system. The system returns the response to the API client along with information about the API client's quota for the current time window. The system may calculate the quota based on a resource limit with respect to a number of clients accessing a resource. In some embodiments, the system may implement an exponential distribution function in making a determination on a quota per API client per time window.
1. A method, comprising:
receiving, by an application programming interface (API) proxy system embodied on a cluster of server machines, a client request from an API client;
the API proxy system calculating a quota of requests allowed for the API client for a current time window based at least in part on a number of active API clients during the current time window and a tunable scaling factor, wherein the quota of requests allowed for the API client for the current time window is calculated using an exponential distribution function, wherein the exponential distribution function is formulated as:
S
×
(
1
-
e
-
λ
(
n
+
d
)
)
×
w
n
×
c
where S represents a resource limit per time frame, n represents the number of active API clients, w represents the current time window, λ represents the tunable scaling factor, d represents a multiplier, and C represents a configurable constant;
if the quota has been exceeded for the API client for the current time window, the API proxy system determining whether an exception is applicable;
if the quota has not been exceeded for the API client for the current time window, the API proxy system preparing a proxied request and forwarding the proxied request to one or more API endpoints referenced in the client request from the API client; and
adjusting a value of the current time window to change a volume per timeframe.
2. The method according to claim 1 , wherein C is 3600.
3. The method according to claim 1 , further comprising:
adjusting the tunable scaling factor to account for burst behavior of the API client; or
adjusting the value of the current time window and the tunable scaling factor.
4. The method according to claim 1 , further comprising:
tracking a number of client requests from the API client for the current time window; and
comparing the number of client requests from the API client for the current time window with the quota of requests allowed for the API client for the current time window.
5. The method according to claim 1 , further comprising:
tracking the number of active API clients, wherein tracking the number of active API clients comprises:
determining whether the API client is already connected; and
if the API client is not already connected:
marking the API client as connected; and
incrementing a counter tracking the number of active API clients.
6. An application programming interface (API) proxy system, comprising:
at least one processor;
non-transitory computer memory;
instructions embodied on the non-transitory computer memory and translatable by the at least one processor to perform:
receiving a client request from an API client;
calculating a quota of requests allowed for the API client for a current time window based at least in part on a number of active API clients during the current time window and a tunable scaling factor, wherein the quota of requests allowed for the API client for the current time window is calculated using an exponential distribution function, wherein the exponential distribution function is formulated as:
S
×
(
1
-
e
-
λ
(
n
+
d
)
)
×
w
n
×
c
where S represents a resource limit per time frame, n represents the number of active API clients, w represents the current time window, λ represents the tunable scaling factor, d represents a multiplier, and C represents a configurable constant;
if the quota has been exceeded for the API client for the current time window, determining whether an exception is applicable;
if the quota has not been exceeded for the API client for the current time window, preparing a proxied request and forwarding the proxied request to one or more API endpoints referenced in the client request from the API client; and
adjusting a value of the current time window to change a volume per timeframe.
7. The proxy system of claim 6 , wherein C is 3600.
8. The proxy system of claim 6 , wherein the instructions are further translatable by the at least one processor to perform:
adjusting the tunable scaling factor to account for burst behavior of the API client; or
adjusting the value of the current time window and the tunable scaling factor.
9. The proxy system of claim 6 , wherein the instructions are further translatable by the at least one processor to perform:
tracking a number of client requests from the API client for the current time window; and
comparing the number of client requests from the API client for the current time window with the quota of requests allowed for the API client for the current time window.
10. The proxy system of claim 6 , wherein the instructions are further translatable by the at least one processor to perform:
tracking the number of active API clients, wherein tracking the number of active API clients comprises:
determining whether the API client is already connected; and
if the API client is not already connected:
marking the API client as connected; and
incrementing a counter tracking the number of active API clients.
11. A computer program product comprising at least one non-transitory computer readable medium storing instructions translatable by at least one processor to perform:
receiving a client request from an API client;
calculating a quota of requests allowed for the API client for a current time window based at least in part on a number of active API clients during the current time window and a tunable scaling factor, wherein the quota of requests allowed for the API client for the current time window is calculated using an exponential distribution function, wherein the exponential distribution function is formulated as:
S
×
(
1
-
e
-
λ
(
n
+
d
)
)
×
w
n
×
c
where S represents a resource limit per time frame, n represents the number of active API clients, w represents the current time window, λ represents the tunable scaling factor, d represents a multiplier, and C represents a configurable constant;
if the quota has been exceeded for the API client for the current time window, determining whether an exception is applicable;
if the quota has not been exceeded for the API client for the current time window, preparing a proxied request and forwarding the proxied request to one or more API endpoints referenced in the client request from the API client; and
adjusting a value of the current time window to change a volume per timeframe.
12. The computer program product of claim 11 , wherein
C is 3600.
13. The computer program product of claim 11 , wherein the instructions are further translatable by the at least one processor to perform:
adjusting the tunable scaling factor to account for burst behavior of the API client; or
adjusting the value of the current time window and the tunable scaling factor.
14. The computer program product of claim 11 , wherein the instructions are further translatable by the at least one processor to perform:
tracking a number of client requests from the API client for the current time window; and
comparing the number of client requests from the API client for the current time window with the quota of requests allowed for the API client for the current time window.
15. The computer program product of claim 11 , wherein the instructions are further translatable by the at least one processor to perform:
tracking the number of active API clients, wherein tracking the number of active API clients comprises:
determining whether the API client is already connected; and
if the API client is not already connected:
marking the API client as connected; and
incrementing a counter tracking the number of active API clients.