Rate Limiting

The API Gateway implements per-tenant rate limiting through the Kong advanced-rate-limiter plugin. Rate limits are configured per tenant with tiered policies that define limits for second, minute, and hour windows. Rate limit counters are stored in Redis for distributed state across gateway instances.

Rate Limit Configuration

TenantRateLimitConfig Properties

Configure Tenant Rate Limit

Endpoint: POST /api/v1/gateway/tenants/:tenantId/rate-limit

curl -X POST http://localhost:8080/api/v1/gateway/tenants/550e8400-e29b-41d4-a716-446655440000/rate-limit \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${TOKEN}" \
  -d '{
    "tier": "professional",
    "secondLimit": 50,
    "secondBurst": 75,
    "minuteLimit": 500,
    "minuteBurst": 750,
    "hourLimit": 10000,
    "hourBurst": 12000,
    "windows": ["second", "minute", "hour"]
  }'

Default Tier Limits

How It Works

When configureTenantRateLimit is called, the service:

1. Creates a route tag of tenant:<tenantId> to scope the rate limit
2. Configures the advanced-rate-limiter Kong plugin with:
   • Scope set to tenant
   • Custom tier configuration with per-window limits and burst allowances
   • Redis backend for distributed counter storage at redis-master.matih-system:6379
3. Enables the plugin on the gateway

Plugin Configuration Structure

{
  "name": "advanced-rate-limiter",
  "enabled": true,
  "config": {
    "scope": "tenant",
    "windows": ["second", "minute", "hour"],
    "custom_tiers": {
      "professional": {
        "second": { "limit": 50, "burst": 75 },
        "minute": { "limit": 500, "burst": 750 },
        "hour": { "limit": 10000, "burst": 12000 }
      }
    },
    "redis_host": "redis-master.matih-system",
    "redis_port": 6379
  }
}

Rate Limit Response Headers

When rate limiting is active, Kong adds the following response headers:

When the limit is exceeded, the gateway returns 429 Too Many Requests with a Retry-After header.

Redis Backend

Rate limit counters are stored in Redis for distributed state. The Redis instance at redis-master.matih-system:6379 is shared across all gateway pods so that rate limits are enforced consistently regardless of which gateway instance receives the request.