Systems and methods of rate limiting for a representational state transfer (REST) application programming interface (API)

Patent metadata

Field	Value
Publication number	US-10542124-B2
Application number	US-201815906917-A
Country	US
Kind code	B2
Filing date	Feb 27, 2018
Priority date	Feb 27, 2018
Publication date	Jan 21, 2020
Grant date	Jan 21, 2020

Abstract

The present disclosure relates to systems and methods of implementing rate limiting in a representational state transfer (REST) application programming interface (API) system. A method of operating an instance of a REST API server, includes: receiving a REST API request that matches a rate limit rule associated with the instance of the REST API server; preparing a REST API response that includes rate limiting response headers. The method includes determining whether a rate limit violation exists that corresponds to the rate limit rule and, when it does, adding an error message to the REST API response. Otherwise, the REST API request is fulfilled and corresponding data is added to the REST API response. The method includes sending the REST API response including the rate limiting response headers and either the error message or the corresponding data.

First claim

The invention claimed is:

1. A representational state transfer (REST) application programming interface (API) system, comprising:
memory circuitry storing a rate limit rules table, a rate limit counts table, a rate limit violations table, and instructions, associated with an instance of a REST API server of the REST API system;
processing circuitry communicatively coupled to the memory circuitry and configured to execute the instructions stored in the memory circuitry to:
receive, at the instance of the REST API server, a REST API request that matches a rate limit rule stored in the rate limiting rules table;
prepare a REST API response having rate limiting response headers, wherein the rate limiting response headers include information related to the rate limit rule;
determine whether a rate limit violation stored in the rate violations table matches the rate limit rule;
when the rate limit violation matches the rate limit rule, add an error message to the REST API response, and otherwise, fulfill the REST API request and add corresponding data to the REST API response; and
send, from the instance of the REST API server, the REST API response including the rate limiting response headers and either the error message or the corresponding data.

2. The REST API system of claim 1 , comprising communication circuitry communicatively coupled to the processing circuitry and the memory circuitry, wherein the communication circuitry is configured to communicatively couple the instance of the REST API server to a client device to receive the REST API request from the client device and to send the REST API response to the client device via a network.

3. The REST API system of claim 1 , wherein, in response to fulfilling the REST API request, the processing circuitry is configured to provide information regarding the REST API request to a background process.

4. The REST API system of claim 3 , wherein the processing circuitry is configured to provide the information regarding the fulfilled REST API request to the background process without using a distributed cache.

5. The REST API system of claim 3 , wherein the background process comprises additional instructions that are stored in the memory circuitry and are executed by the processing circuitry to:
receive the information regarding the REST API request;
identify the rate limit rule from the rate limit rules table based on the received information;
determine a rate limit associated with the rate limit rule from the rate limit rules table;
determine a rate limit count associated with the rate limit rule from the rate limit counts table;
when the rate limit count associated with the rate limit rule is greater than or equal to the rate limit associated with the rate limit rule, insert a rate limit violation into the rate limit violations table for the rate limit rule based on the received information; and
increment a rate limit count in the rate limit counts table based on the information regarding the REST API request.

6. The REST API system of claim 5 , wherein to determine the rate limit count, the processing circuitry is configured to sum respective rate limit counts of a plurality of rate limit count records from the rate limit counts table, wherein each of the plurality of rate limit count records corresponds with the identified rate limit rule.

7. The REST API system of claim 1 , wherein the processing circuitry is configured to remove records from the rate limit counts table, the rate limit violations table, or a combination thereof, at a conclusion of each predefined rate limit time window.

8. The REST API system of claim 1 , wherein the rate limiting response headers include a rate limit field indicating a maximum number of REST API requests that can match the rate limit rule before the rate limit violation is added to the rate violations table.

9. The REST API system of claim 1 , wherein the rate limiting response headers include a reset time field indicating a time at which a current predefined rate limit time window ends.

10. The REST API system of claim 1 , wherein the error message includes a retry after field that indicates how long the client device should wait before submitting another REST API request that matches the rate limit rule.

11. The REST API system of claim 1 , wherein the processing circuitry is configured to:
determine that the REST API request corresponds to a plurality of rate limit rules stored in the rate limit rules table; and
select a highest priority rate limit rule from the plurality of rate limit rules as the rate limit rule that matches the REST API request.

12. The REST API system of claim 11 , wherein each of the plurality of rate limit rules comprises a respective type, and wherein the processing circuitry is configured to select the highest priority rate limit rule based on the respective type of each of the rate limiting rules.

13. The REST API system of claim 11 , wherein the processing circuitry is configured to prioritize a first type indicating REST API requests from a particular IP address or IP address range above a second type indicating REST API requests from a particular user, above a third type indicating REST API requests from a particular role, above a fourth type indicating all REST API requests.

14. A method of operating an instance of a representational state transfer (REST) application programming interface (API) server, comprising:
receiving, at the instance of the REST API server, a REST API request that matches a rate limit rule associated with the instance of the REST API server;
preparing a REST API response that includes rate limiting response headers, wherein the rate limiting response headers include information related to the rate limit rule;
determining whether a rate limit violation exists that matches the rate limit rule;
when the rate limit violation matches the rate limit rule, adding an error message to the REST API response, and otherwise, fulfilling the REST API request and adding corresponding data to the REST API response; and
sending, from the instance of the REST API server, the REST API response including the rate limiting response headers and either the error message or the corresponding data.

15. The method of claim 14 , wherein the REST API request is received from, and the REST API response is provided to, a client device communicatively coupled to the instance of the REST API server via a network.

16. The method of claim 14 , wherein the rate limiting rule is stored in a cached rate limiting rules table of a database associated with the instance of the REST API server.

17. The method of claim 14 , wherein the rate limit violation is stored in a cached rate limit violations table associated with the instance of the REST API server.

18. The method of claim 14 , wherein the rate limiting response headers include a rate limit field and a reset time field associated with the rate limiting rule.

19. The method of claim 14 , wherein the error message indicates how long the client device should wait before submitting another REST API request that matches the rate limit rule.

20. One or more non-transitory, computer-readable media at least collectively storing instructions executable by processing circuitry to provide an instance of a representational state transfer (REST) application programming interface (API) server, the instructions comprising:
instructions to receive, at the instance of the REST API server, a REST API request and to prepare a REST API response;
instructions to

Assignees

• Servicenow Inc

Inventors

• Puniani Pankaj
• Barnard Bryan Mather
• Smith Silas A
• Stoddart Matthew

Classifications

• G06F9/547

  Remote procedure calls [RPC]; Web services · CPC title

• H04L67/02 Primary

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• G06F9/54

  Interprogram communication · CPC title

• H04L67/42 Primary

  Electricity · mapped topic