An API developer is improving an application code to prevent DDoS attacks. The solution needs to accommodate instances of a large number of API requests coming for legitimate purposes from…

Calculating limits based on daily averages does not account for legitimate short-term bursts from trusted services and can incorrectly block valid traffic during peak periods while missing rapid DDoS spikes.

REST API Security Essentials is not a specific recognized standard or product for automated rate limiting, and this option does not address the requirement to accommodate legitimate high-volume requests from trustworthy services.

Increasing the reply limit for each API without a per-interval rate control simply raises the ceiling for abuse without providing real-time protection against DDoS traffic patterns.

Rate limiting applies a configurable threshold on requests per API per time interval, allowing legitimate high-volume bursts from trusted services up to the defined limit while automatically blocking or throttling traffic that exceeds it. This approach is more flexible than daily averages because it responds to real-time traffic spikes and can be tuned per API based on expected legitimate load patterns. Blocking or throttling access only when the rate is exceeded ensures that high-volume trusted partners are not impacted during normal operating periods.