Core Platform - Rate Limiting for APIs

Introduction

This article explains what rate limiting is, our current rate limits, and how to increase rate limits for specific networks which exceed it.

What Is Rate Limiting? 

Rate limiting is a technique for limiting network traffic. It puts a restriction on how often an end-user can repeat an action in a time period. This stops certain types of malicious activity, like denial-of-service (where an attacker tries to prevent legitimate use by sending large amounts of traffic) and brute-force attacks (where an attacker uses a trial-and-error method to try and gain access.)

However, it can sometimes be triggered by legitimate use. 

Current Rate Limits

Our current rate limits are set to 180 requests for a 15-minute window. These limits are per endpoint, per unique IP address. These are also represented through the following Header Descriptions in each response returned from the APIs:

"X-Rate-Limit-Limit Max allowed requests"

"X-Rate-Limit-Remaining Remaining requests in the current window"

"X-Rate-Limit-Reset Time until current window expires"

Note: Rate limits are applied to all API endpoints regardless of which API you use.

Exceeding the Rate Limit

On a Corporate Network or Shared WiFi

If you are using a corporate network connection or shared WiFi, you may trigger the rate limit more often. This happens because it is not possible to distinguish each device on the network externally, so all treated as if they were coming from one device.

To avoid this, we increase rate limits for specific networks.

You can do this by adding IP Address to the IP Safe List in Reward Manager:

1. Log into Reward Manager

2. Select Security

3. Enter the Scheme ID

4. Choose Basic Settings

5. Add an IP Address to the IP Safe List.

Note: To have access to this, you will need a specific role Security Administrator on Reward Manager. If you do not have access to do this, please request it from your Client Success Manager.

Not on a Corporate Network or Shared WiFi

If you are not on a corporate network connection or using shared WiFi, you should not see this message unless you have tried repeatedly to perform the same action in quick succession.

In this case, please raise a ticket to our Client Support Team with:

• Summary of the action you tried to perform
• Your IP address at the time you tried to complete the action

How Do I Find My IP Address?

You can find this by Googling ‘what is my IP address?’