GET /obp/v7.0.0/management/rate-limiter-config

Returns the live configuration of the three rate limiters on this instance, in the order they are checked:

self_service runs before routing and authentication, keyed by client IP address, on the endpoints anyone can call before the bank has granted them anything, and on the public documentation. A trip answers 429 OBP-10060. Each of its limits rows is a scope, with the endpoints it covers and its own mode: a scope can stay in shadow mode while the limiter's mode is enforce (the documentation scope does, unless its own mode is set).
authentication runs inside the credential check, keyed by IP address and account. A trip answers 429 OBP-10061.
consumer runs after authentication, keyed by Consumer, or by IP address for anonymous calls. A trip answers 429 OBP-10018.

mode is shadow (trips are logged and reported in the X-Rate-Limit-Warning header, the request is allowed) or enforce (429). In limits, -1 means unlimited and 0 blocks every call; windows a limiter does not have are absent. The consumer limiter's consumer_default row is what applies to a Consumer with no rate limit rows of its own.

See the Rate Limiting glossary entry.

User Authentication is Required. The User must be logged in. The Application must also be authenticated.

{ "rate_limiters": [ { "name": "self_service", "order": 1, "error_code": "OBP-10060", "enabled": true, "mode": "shadow", "keyed_by": "client IP address", "runs": "before routing and before authentication, on the self-service endpoints", "props_prefix": "self_service.rate_limit", "limits": [ { "scope": "documentation", "per_minute": 60, "per_hour": 1000, "per_day": 10000, "global_per_hour": -1, "mode": "shadow", "covers": "GET of the public documentation: resource-docs, message-docs, api/glossary, api/tags, api/versions, ..." }, { "scope": "signup", "per_minute": 3, "per_hour": 5, "per_day": 10, "global_per_hour": 500, "mode": "shadow", "covers": "POST /users, /users/email-validation, /banks/BANK_ID/user-invitations" } ] }, { "name": "authentication", "order": 2, "error_code": "OBP-10061", "enabled": false, "mode": "shadow", "keyed_by": "client IP address and account", "runs": "inside the credential check of Direct Login, DAuth, Gateway Login and SIWE", "props_prefix": "auth.rate_limit", "limits": [ { "scope": "ip", "per_minute": 10, "per_hour": 100 }, { "scope": "account", "per_minute": 6 } ] }, { "name": "consumer", "order": 3, "error_code": "OBP-10018", "enabled": true, "mode": "enforce", "keyed_by": "Consumer, or client IP address for anonymous calls", "runs": "after authentication, on every endpoint", "props_prefix": "rate_limiting_per_*", "limits": [ { "scope": "consumer_default", "per_second": -1, "per_minute": -1, "per_hour": -1, "per_day": -1, "per_week": -1, "per_month": -1 }, { "scope": "anonymous", "per_hour": 1000 } ] } ] }