Systems and methods for API rate limiting and distribution
An API rate limiting system may receive a client request from an API client associated with a tenant, formulate a proxied request with an internal authentication specific to the tenant, and send the proxied request to API endpoints (tenant resources) at a store. The store fulfills the request, accessing and modifying local database(s) as needed, and returns a response to the system. The system returns the response to the API client along with information about the API client's quota for the current time window. The system may calculate the quota based on a resource limit with respect to a number of clients accessing a resource. In some embodiments, the system may implement an exponential distribution function in making a determination on a quota per API client per time window.
1. A method, comprising:
receiving, by an application programming interface (API) proxy system embodied on a cluster of server machines running in a multi-tenant computing environment, a client request from an API client associated with a tenant of the multi-tenant computing environment, the tenant having an application running on a website, the application limited to resources defined for the tenant, the client request referencing a resource of the resources;
calculating, by the API proxy system using an exponential distribution function, a quota of requests allowed for the API client for a current time window, the calculating performed by the API proxy system based on a resource limit with respect to a number of API clients that are currently connected to the API proxy system and that are requesting the resource in the current time window, wherein the exponential distribution function is configured for exponentially scaling the quota of requests allowed for the API client in the current time window utilizing a growth factor and a multiplier, wherein the growth factor is tunable up or down depending upon the number of API clients requesting the resource in the current window, and wherein the multiplier multiplies the growth factor such that the quota of requests thus calculated by the API proxy system for the API client for the current time window also scales exponentially up or down depending upon the number of API clients that are currently connected to the API proxy system and that are requesting the resource in the current time window; and
responsive to receiving an API request from another API client to access the resource, updating, by the API proxy system, the quota of requests calculated for the API client for the current time window.
2. The method according to claim 1 , further comprising:
responsive to the quota not being exceeded by a number of client requests from the API client in the current time window, preparing, by the API proxy system, a proxied request and forwarding the proxied request to a resource referenced in the client request from the API client.
3. The method according to claim 2 , further comprising:
locating the resource in the multi-tenant computing environment;
preparing an internal authentication specific to the API client; and
building the proxied request for the resource using the internal authentication specific to the API client.
4. The method according to claim 1 , further comprising:
responsive to the quota being exceeded by a number of client requests from the API client in the current time window, determining, by the API proxy system, whether an exception to the quota is applicable for the client request from the API client.
5. The method according to claim 4 , further comprising:
responsive to the exception to the quota being applicable for the client request from the API client, adjusting the growth factor for the tenant.
6. The method according to claim 1 , further comprising:
adjusting the growth factor depending upon the number of API clients connected to the API proxy system in the current time window.
7. The method according to claim 1 , further comprising:
determining, by the API proxy system, whether the client request received from the API client references a valid resource.
8. An application programming interface (API) proxy system, comprising:
a processor;
a non-transitory computer-readable medium;
stored instructions translatable by the processor to perform:
receiving a client request from an API client associated with a tenant of a multi-tenant computing environment, the tenant having an application running on a website, the application limited to resources defined for the tenant, the client request referencing a resource of the resources;
calculating, using an exponential distribution function, a quota of requests allowed for the API client for a current time window, the calculating based on a resource limit with respect to a number of API clients that are currently connected to the API proxy system and that are requesting the resource in the current time window, wherein the exponential distribution function is configured for exponentially scaling the quota of requests allowed for the API client in the current time window utilizing a growth factor and a multiplier, wherein the growth factor is tunable up or down depending upon the number of API clients requesting the resource in the current window, and wherein the multiplier multiplies the growth factor such that the quota of requests thus calculated for the API client for the current time window also scales exponentially up or down depending upon the number of API clients that are currently connected to the API proxy system and that are requesting the resource in the current time window; and
responsive to receiving an API request from another API client to access the resource, updating the quota of requests calculated for the API client for the current time window.
9. The API proxy system of claim 8 , wherein the stored instructions are further translatable by the processor to perform:
responsive to the quota not being exceeded by a number of client requests from the API client in the current time window, preparing a proxied request and forwarding the proxied request to a resource referenced in the client request from the API client.
10. The API proxy system of claim 9 , wherein the stored instructions are further translatable by the processor to perform:
locating the resource in the multi-tenant computing environment;
preparing an internal authentication specific to the API client; and
building the proxied request for the resource using the internal authentication specific to the API client.
11. The API proxy system of claim 8 , wherein the stored instructions are further translatable by the processor to perform:
responsive to the quota being exceeded by a number of client requests from the API client in the current time window, determining whether an exception to the quota is applicable for the client request from the API client.
12. The API proxy system of claim 11 , wherein the stored instructions are further translatable by the processor to perform:
responsive to the exception to the quota being applicable for the client request from the API client, adjusting the growth factor for the tenant.
13. The API proxy system of claim 8 , wherein the stored instructions are further translatable by the processor to perform:
adjusting the growth factor depending upon the number of API clients connected to the API proxy system in the current time window.
14. The API proxy system of claim 8 , wherein the stored instructions are further translatable by the processor to perform:
determining whether the client request received from the API client references a valid resource.
15. A computer program product comprising a non-transitory computer-readable medium storing instructions translatable by a processor to perform:
receiving a client request from an API client associated with a tenant of a multi-tenant computing environment, the tenant having an application running on a website, the application limited to resources defined for the tenant, the client request referencing a resource of the resources;
calculating, using an exponential distribution function, a quota of requests allowed for the API client for a current time window, the calculating based on a resource limit with respect to a number of API clients that are currently connected to the API proxy system and that are requesting the resource in the current time window, wherein the exponential distribution function is configured for exponentially scaling the quota of requests allowed for the API client in the current time window utilizing a growth factor and a multiplier, wherein the growth factor is tunable up or down depending upon the number of API clients requesting the resource in the current window, and wherein the multiplier multiplies the growth factor such that the quota of requests thus calculated for the API client for the current time window also scales exponentially up or down depending upon the number of API clients that are currently connected to the API proxy system and that are requesting the resource in the current time window; and
responsive to receiving an API request from another API client to access the resource, updating the quota of requests calculated for the API client for the current time window.
16. The computer program product of claim 15 , wherein the instructions are further translatable by the processor to perform:
responsive to the quota not being exceeded by a number of client requests from the API client in the current time window, preparing a proxied request and forwarding the proxied request to a resource referenced in the client request from the API client.
17. The computer program product of claim 16 , wherein the instructions are further translatable by the processor to perform:
locating the resource in the multi-tenant computing environment;
preparing an internal authentication specific to the API client; and
building the proxied request for the resource using the internal authentication specific to the API client.
18. The computer program product of claim 15 , wherein the instructions are further translatable by the processor to perform:
responsive to the quota being exceeded by a number of client requests from the API client in the current time window, determining whether an exception to the quota is applicable for the client request from the API client.
19. The computer program product of claim 18 , wherein the instructions are further translatable by the processor to perform:
responsive to the exception to the quota being applicable for the client request from the API client, adjusting the growth factor for the tenant.
20. The computer program product of claim 15 , wherein the instructions are further translatable by the processor to perform:
adjusting the growth factor depending upon the number of API clients connected to the API proxy system in the current time window.