This collection explores which requests can be evaluated at an API boundary and which decisions still require application context. Compare API firewall and WAF capabilities by their actual enforcement points rather than by product labels. Then examine rate limits, concurrency, resource budgets, and client recovery as related but distinct design decisions. The goal is to make expensive work predictable without confusing request filtering with resource authorization. Use the examples to frame a rollout review, test expected legitimate behavior, and document the scope and expiry of temporary exceptions.
API rate limiting: protect capacity without breaking good clients
Move beyond one global request limit with endpoint budgets, bounded queues, and observable retry behavior.
API firewall vs WAF: choose the right control for the request
Understand where request filtering helps, what belongs in application authorization, and how to evaluate a layered deployment.