{"ref":"capability:rate-limiting","page":"/capabilities/rate-limiting","json":"/capabilities/rate-limiting.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"rate-limiting","name":"Rate limiting","domain":"security-and-compliance","ecosystems":["cap","btp"],"universal":true,"description":"Capping how many requests a service will accept per tenant or per caller, so one consumer cannot exhaust a shared deployment, whether enforced by a policy in front of the application or inside its own process.","short":"Capping requests per tenant or caller","core_coverage":{"state":"core-and-community","assessed_at":"2026-08-31","relationship":"unassessed","community_adds":"Inside the CAP process, where tenant and user are already resolved, [cds-rate-limit](artifact:soontao-cds-rate-limit) and the rate-limiting feature of [@cap-js-community/common](artifact:cap-js-community-common) cap requests per service and tenant. In front of the application, [API Management](artifact:btp-api-management) from SAP applies its quota and spike-arrest policies on a proxy."},"coverage_by_ecosystem":{"btp":{"state":"core-only","assessed_at":"2026-09-20","what_core_does":"[API Management](artifact:btp-api-management) limits requests with two policies on an API proxy: Quota, a counter per period, and Spike Arrest, a minimum spacing between requests. The apim-as-route-service plan binds the proxy to a Cloud Foundry application's route, so the limit applies whichever URL is called.","where_it_stops":"It stops at the proxy: a call that does not pass through API Management is not counted, and the route-service binding exists for Cloud Foundry applications only. Spike Arrest is kept per API Management server and is not distributed, so its limit is approximate.","sources":[{"url":"https://raw.githubusercontent.com/SAP-docs/btp-integration-suite/33f339544cd06d3c4e272fe8ef57c7248f68c6a2/docs/ISuite_Integrations_APIs/quota-1f742c1.md","title":"Quota — SAP Integration Suite documentation, SAP-docs/btp-integration-suite","checked":"2026-09-20","quote":"API Management maintains a counter that keeps track of the number of calls made to the API."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-integration-suite/33f339544cd06d3c4e272fe8ef57c7248f68c6a2/docs/ISuite_Integrations_APIs/spike-arrest-bf441dc.md","title":"Spike Arrest — SAP Integration Suite documentation, SAP-docs/btp-integration-suite","checked":"2026-09-20","quote":"Since Spike Arrest policy is not distributed, you might see some discrepancy between the actual behavior of the system and your expected results."},{"url":"https://raw.githubusercontent.com/SAP-docs/btp-integration-suite/33f339544cd06d3c4e272fe8ef57c7248f68c6a2/docs/ISuite_Integrations_APIs/managing-cloud-foundry-microservices-through-api-management-e609a3e.md","title":"Managing Cloud Foundry Microservices through API Management — SAP Integration Suite documentation, SAP-docs/btp-integration-suite","checked":"2026-09-20","quote":"This functionality is only available for APIs developed and deployed on the Cloud Foundry environment."}]}},"framing_by_ecosystem":{"btp":{"description":"On BTP rate limiting is a policy on an API proxy in front of the application, configured in [API Management](artifact:btp-api-management) and enforced before a request reaches the application's process."}},"history":[{"date":"2026-10-26","field":"core_coverage.state, core_coverage.relationship, core_coverage.community_adds","from":"community-only","to":"core-and-community, relationship unassessed, with a community_adds sentence naming the in-process and gateway kinds","reason":"Reassessed against the graph (check:capabilities): API Management, an SAP-official service on the BTP door, lists CAP in serves_ecosystems and provides this capability, so the core is present for CAP beside the in-process community plugins. The relationship stays unassessed for lack of documentary evidence on the history."}],"drafted_with_ai":true},"sap_delivery":{"door":"cap","all":null,"by_flavor":{"node":null,"java":null}},"edges":{"use_cases":[],"shared_tasks":[],"related_tasks":[],"options":[{"ref":"artifact:cap-js-community-common","name":"@cap-js-community/common","json":"/artifacts/cap-js-community-common.json","ecosystem":"cap","origin_ring":"community-org"},{"ref":"artifact:btp-api-management","name":"API Management","json":"/artifacts/btp-api-management.json","ecosystem":"btp","origin_ring":"sap-official"},{"ref":"artifact:soontao-cds-rate-limit","name":"cds-rate-limit","json":"/artifacts/soontao-cds-rate-limit.json","ecosystem":"cap","origin_ring":"independent"}],"samples":[],"explained_by":[{"ref":"content:devtoberfest-2026-int23-agent-calls-sap","name":"🔴 Your Agent Wants to Call SAP. Now What?","json":"/content/devtoberfest-2026-int23-agent-calls-sap.json"},{"ref":"content:sap-api-management-for-beginners-part-4-oauth-2-0-kvm-traffic-policies-threat-pr","name":"SAP API Management for Beginners – Part 4: OAuth 2.0, KVM, Traffic Policies, Threat Protection&CORS","json":"/content/sap-api-management-for-beginners-part-4-oauth-2-0-kvm-traffic-policies-threat-pr.json"},{"ref":"content:sap-api-management-for-beginners-part-1-what-is-apim-a-complete-features-tour","name":"SAP API Management for Beginners – Part 1: What Is APIM & A Complete Features Tour","json":"/content/sap-api-management-for-beginners-part-1-what-is-apim-a-complete-features-tour.json"},{"ref":"content:edge-integration-cell-design-deploy-and-manage-apis","name":"Edge Integration Cell : Design, deploy and manage APIs","json":"/content/edge-integration-cell-design-deploy-and-manage-apis.json"}],"normative_context":[]}}