What is API rate limiting and how do you test it?

Q: What is API rate limiting and how do you test it?

API Rate Limiting Rate limiting restricts the number of API requests a client can make within a given time window. It protects APIs from abuse, DDoS attacks, and overloading. Common Rate Limit Headers | Header | Value | Meaning | |--------|-------|---------| | X-Rate-Limit-Limit | 100 | Total requests allowed per window | | X-Rate-Limit-Remaining | 45 | Requests remaining in current window | | X-Rate-Limit-Reset | 1718003600 | Unix timestamp when limit resets | | Retry-After | 60 | Seconds to wait before retrying | HTTP Status Code for Rate Limit 429 Too Many Requests — returned when the rate

Answer

API Rate Limiting

Rate limiting restricts the number of API requests a client can make within a given time window. It protects APIs from abuse, DDoS attacks, and overloading.

Common Rate Limit Headers

Header	Value	Meaning
`X-Rate-Limit-Limit`	`100`	Total requests allowed per window
`X-Rate-Limit-Remaining`	`45`	Requests remaining in current window
`X-Rate-Limit-Reset`	`1718003600`	Unix timestamp when limit resets
`Retry-After`	`60`	Seconds to wait before retrying

HTTP Status Code for Rate Limit

429 Too Many Requests — returned when the rate limit is exceeded.

Testing Rate Limiting in Rest Assured

Test 1: Verify Rate Limit Headers Exist

Java

@Test
public void testRateLimitHeadersPresent() {

    Response response = given()
                            .header("Authorization", "Bearer " + token)
                            .when()
                            .get("/api/users");

    // Verify rate limit headers are present
    assertNotNull(response.getHeader("X-Rate-Limit-Limit"));
    assertNotNull(response.getHeader("X-Rate-Limit-Remaining"));

    int remaining = Integer.parseInt(response.getHeader("X-Rate-Limit-Remaining"));
    assertTrue(remaining >= 0);
}

Test 2: Verify 429 When Limit Exceeded

Java

@Test
public void testRateLimitExceeded() {

    int requestCount = 0;
    int statusCode = 200;

    // Keep calling until rate limited
    while (statusCode == 200 && requestCount < 200) {
        statusCode = given()
                         .header("Authorization", "Bearer " + token)
                         .when()
                         .get("/api/users")
                         .getStatusCode();
        requestCount++;
    }

    assertEquals(statusCode, 429, "Expected 429 Too Many Requests after " + requestCount + " calls");
}

Test 3: Verify Retry-After Header on 429

Java

@Test
public void testRetryAfterHeaderOn429() {

    // Simulate rate limit exceeded (use test API key with very low limit)
    Response response = given()
                            .header("X-API-Key", "low-limit-test-key")
                            .when()
                            .get("/api/rate-limited-endpoint");

    if (response.getStatusCode() == 429) {
        assertNotNull(response.getHeader("Retry-After"),
            "Retry-After header must be present on 429 responses");

        int retryAfter = Integer.parseInt(response.getHeader("Retry-After"));
        assertTrue(retryAfter > 0, "Retry-After should be positive seconds");
    }
}

Test 4: Rate Limit Resets After Window

Java

@Test
public void testRateLimitResetsAfterWindow() throws InterruptedException {

    // Exhaust rate limit
    // ... (call API many times)

    // Wait for window to reset (based on Retry-After value)
    Thread.sleep(60_000); // wait 60 seconds

    // Verify requests work again
    given()
        .header("Authorization", "Bearer " + token)
        .when()
        .get("/api/users")
        .then()
        .statusCode(200);
}

Rate Limiting Strategies

Strategy	Description
Fixed window	100 requests per minute
Sliding window	100 requests in any 60-second period
Token bucket	Requests consume tokens; tokens refill over time
Leaky bucket	Requests processed at a fixed rate