Enforces rate limits on your API endpoints to prevent excessive inbound REST API requests

[dipak_thakor]

When designing a integration solution in ServiceNow, that involves inbound REST API request, one of the lesser know architectural principles is the application of rate limits as part of the solution design. Enforcing rate limits on your API endpoints prevents excessive or abusive inbound REST API requests.

Rate limiting is a technique used to control the rate at which requests are made in this case to the resource (REST API EndPoint). It is used to prevent excessive or abusive use of a resource and to ensure that the resource is available to all. Rate limiting  can also be used to limit the number of requests made  to ensure that a resource is not monopolized.

So what type of ServiceNow features, can we use to design our solution for rate limits. ServiceNow provides two features called Rate Limit Rules and Rate Limit Violations. Rate limiting in ServiceNow tracks and throttles requests by monitoring the rate at which requests are made.

Rate Limit Rules 

Rate Limit Rules in ServiceNow allow you to set rules that limit the number of inbound REST API requests processed per hour. You can create rules to limit requests for specific users, users with specific roles, or all users.

Note: As requests reach an instance, each node maintains a rate limit count per user. Every 30 seconds, the count is committed to the database. As a result, a rate limit rule may not take effect for up to 30 seconds.

If a request is denied because it exceeds the rate limit, the system returns a Retry After response header in addition to the response headers about rate limiting. The Retry After response header displays the number of seconds after which you can retry the request to avoid exceeding the rate limit.

When the rate limits are exceeded an error message http status code 429 error message (429 Too Many Requests)  is also returned for too many requests.

For more information see ServiceNow docs site for Inbound REST API rate limiting 

Rate Limit Violations

The Rate limit violations feature in ServiceNow, allows you to investigate rate limit violations to determine which rate limit rules are being exceeded and to identify which users are exceeding those rate limits.

For more information see ServiceNow docs site for Monitor inbound REST API rate limit counts and violations