Contact UsGet started

Request rate limit

Written by
Updated at January 29, 2025

Warning

This extension is deprecated and discontinued. To limit the request processing rate, employ integration with Yandex Smart Web Security.

Use the x-yc-apigateway-rate-limits and x-yc-apigateway-rate-limit extensions to limit the request processing rate. You can set limits for an API gateway or specific paths and/or HTTP methods. If the number of requests within a given time period exceeds the value set in the specification, new requests will not be processed and billed, and you will get the 429 Too Many Requests HTTP status code.

API Gateway does not guarantee that it will always limit the request processing rate to the exact value provided in the specification.

RateLimitObject

RateLimitObject is a set of OpenAPI specification parameters used to limit the request processing rate.

RateLimitObject object structure:

  allRequests:
    rps: <maximum_number_of_requests_per_second>
    rpm: <maximum_number_of_requests_per_minute>

Specify either rps or rpm but not both at the same time.

x-yc-apigateway-rate-limits extension

With x-yc-apigateway-rate-limits, you can describe the request processing rate limits in the components section. You can reference the limits set in this way using the $ref parameter in the x-yc-apigateway-rate-limit extension and apply them to different paths and operations (HTTP methods) or the entire API gateway. For details, see rateLimit for x-yc-apigateway.

x-yc-apigateway-rate-limit extension

With x-yc-apigateway-rate-limit, you can set request processing rate limits for all operations in a path or for a specific operation. The extension type is RateLimitObject. Limits for paths with greedy parameters are currently not supported.

Specification examples

Example of a specification with a limit on the number of requests per second that applies to the entire API gateway

In this example, the rate is limited for all requests to the API gateway. The limit is set at the top level using the x-yc-apigateway extension's rateLimit parameter.

openapi: "3.0.0"
info:
  version: 1.0.0
  title: Petstore API

x-yc-apigateway:
  rateLimit:
    allRequests:
      rps: 10

paths:
  /pets/{petId}:
    get:
      operationId: petById
      parameters:
        - in: path
          name: petId
          schema:
            type: integer
          required: true
          description: Pet identifier
      responses:
        '200':
          description: Pet
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Pet"
      x-yc-apigateway-integration:
        type: cloud_functions
        function_id: b095c95icn**********

components:
  schemas:
    Pet:
      type: object
      required:
        - id
        - name
      properties:
        id:
          type: integer
        name:
          type: string

Example of a specification with a global limit overridden at the path level

In this example, a general request rate limit set at the top level for the entire API gateway is overridden at the level of a specific path.

openapi: "3.0.0"
info:
  version: 1.0.0
  title: Petstore API

x-yc-apigateway:
  rateLimit:
    allRequests:
      rps: 10

paths:
  /pets/{petId}:
    x-yc-apigateway-rate-limit:
      allRequests:
        rpm: 100
    get:
      operationId: petById
      parameters:
        - in: path
          name: petId
          schema:
            type: integer
          required: true
          description: Pet identifier
      responses:
        '200':
          description: Pet
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Pet"
      x-yc-apigateway-integration:
        type: cloud_functions
        function_id: b095c95icn**********

components:
  schemas:
    Pet:
      type: object
      required:
        - id
        - name
      properties:
        id:
          type: integer
        name:
          type: string

Example of a specification with a limit set for a specific operation

openapi: "3.0.0"
info:
  version: 1.0.0
  title: Petstore API

paths:
  /pets/{petId}:
    get:
      x-yc-apigateway-rate-limit:
        allRequests:
          rpm: 10
      operationId: petById
      parameters:
        - in: path
          name: petId
          schema:
            type: integer
          required: true
          description: Pet identifier
      responses:
        '200':
          description: Pet
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Pet"
      x-yc-apigateway-integration:
        type: cloud_functions
        function_id: b095c95icn**********

components:
  schemas:
    Pet:
      type: object
      required:
        - id
        - name
      properties:
        id:
          type: integer
        name:
          type: string

Example of specification with a limit configured in the components section

openapi: "3.0.0"
info:
  version: 1.0.0
  title: Petstore API

paths:
  /pets/{petId}:
    x-yc-apigateway-rate-limit:
      $ref: "#/components/x-yc-apigateway-rate-limits/get-rate-limit"
    get:
      operationId: petById
      parameters:
        - in: path
          name: petId
          schema:
            type: integer
          required: true
          description: Pet identifier
      responses:
        '200':
          description: Pet
          content:
            application/json:
              schema:
                $ref: "#/components/schemas/Pet"
      x-yc-apigateway-integration:
        type: cloud_functions
        function_id: b095c95icn**********

components:
  x-yc-apigateway-rate-limits:
    get-rate-limit:
      allRequests:
        rpm: 10

  schemas:
    Pet:
      type: object
      required:
        - id
        - name
      properties:
        id:
          type: integer
        name:
          type: string
Previous
Canary release
Next
Response code replacement