Budget API Rate Limits per Tenant

A global API limit can protect infrastructure while still letting one tenant consume the whole allowance. A user-only limit can be bypassed by creating many users within one tenant. Design a hierarchy that matches the product's resource costs and fairness rule. The OWASP API Security Top 10 includes unrestricted resource consumption; AWS tenant guidance also discusses noisy-neighbor effects in pooled systems.

Limit hierarchy

Choose rates from observed workload and capacity, not from a universal security number. Document burst behavior, retry headers, and what happens when the limiter is unavailable. Do not use a caller-supplied tenant header as the key without verifying membership.

Check fairness with synthetic traffic

In a controlled test environment, let Tenant A consume its permitted test allowance while Tenant B makes a small request. B should continue according to the global policy. Test multiple A users, a missing tenant context, and a delayed background job. Keep the test bounded so it does not cause denial of service. Inspect counters and decisions, not just HTTP status.

The AWS tenant isolation whitepaper distinguishes isolation from noisy-neighbor performance. This hierarchy addresses resource use; it does not replace data authorization. The artifact is a limit table with key sources and failure modes. If a customer needs a higher allowance, change it through an owned policy path with an expiry and audit record, not an untracked bypass.

Check which counter is charged when a request fails authorization. An unauthorized caller should not be able to exhaust another tenant's allowance by naming that tenant. Derive the tenant counter only after membership is verified, and keep a separate global abuse limit.