intermediate · security
What Does a 429 Promise?
Your API rate-limits clients. What should a 429 response contain, and what should the rate-limit contract promise?
Practical scenario
A partner's nightly sync retries every 429 immediately in a tight loop, tripling load exactly when the API is already throttling.
What it tests
- • Rate limiting as documented contract behavior, not just protection
- • Retry-After and limit-header mechanics
- • Scope: what the limit is keyed on