api-rate-limiting-helper
Designs rate limiting strategies, quota systems, throttling policies, retry logic, and backoff patterns for APIs. Use whenever the user asks about rate limiting, throttling, quotas, "too many requests", 429 responses, "how do I limit my API", "retry strategy", "exponential backoff", "burst vs sustai
- 0
- Installs
- —
- Rating
- —
- Success rate
- 1
- Files scanned
Security scan
Scan passedNo risky patterns were found in the scanned files.
Content sha256 2076cd7ce080a636… — run codexguild_scan_skills after installing to verify your local copy.
Static analysis is a first line of defense, not a guarantee. Read the source
SKILL.md
API Rate Limiting Skill
Design complete rate limiting, quota, and retry systems for any API.
Rate Limiting Algorithms
| Algorithm | Best For | Trade-offs |
|---|---|---|
| Token bucket | Bursty traffic with sustained avg | Allows bursts; slightly complex |
| Leaky bucket | Strict rate enforcement | Smooths bursts; can feel slow |
| Fixed window | Simple counting | Boundary spike problem |
| Sliding window log | Precise limiting | Memory-intensive |
| Sliding window counter | Balance of precision/memory | Best for most APIs |
Recommendation: Use sliding window counter for API endpoints, token bucket for streaming/upload endpoints.
Response Headers (RFC standard)
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 42
X-RateLimit-Reset: 1700000060
X-RateLimit-Policy: 100;w=60;comment="per minute"
Retry-After: 18
429 Response Body
{
"error": "rate_limit_exceeded",
"message": "Too many requests. You have exceeded 100 requests per minute.",
"retry_after_seconds": 18,
"limit": 100,
"window": "60s",
"reset_at": "2024-01-01T00:01:00Z"
}
Tiered Quota Design
| Tier | Requests/min | Requests/day | Burst | Concurrent |
|---|---|---|---|---|
| Free | 10 | 1,000 | 20 | 2 |
| Starter | 100 | 50,000 | 200 | 10 |
| Pro | 1,000 | 500,000 | 2,000 | 50 |
| Enterprise | Custom | Unlimited | Custom | Custom |
Quota Endpoints
GET /api/v1/account/quota — current usage vs limits
GET /api/v1/account/quota/history — usage over time
Response:
{
"plan": "pro",
"period": "2024-01",
"limits": { "requests_per_minute": 1000, "requests_per_day": 500000 },
"usage": { "requests_today": 12345, "requests_this_minute": 234 },
"resets_at": "2024-02-01T00:00:00Z"
}
Retry Logic (client-side)
Exponential backoff with jitter
import random, time
def retry_with_backoff(fn, max_retries=5, base_delay=1.0, max_delay=60.0):
for attempt in range(max_retries):
try:
return fn()
except RateLimitError as e:
if attempt == max_retries - 1:
raise
# Use Retry-After header if present, else exponential backoff
delay = min(
e.retry_after or (base_delay * (2 ** attempt)),
max_delay
)
# Add jitter to prevent thundering herd
delay += random.uniform(0, delay * 0.1)
time.sleep(delay)
Retryable vs Non-retryable status codes
| Status | Retry? | Strategy |
|---|---|---|
| 429 | Yes | Respect Retry-After header |
| 500 | Yes | Exponential backoff |
| 502/503 | Yes | Exponential backoff |
| 504 | Yes | Exponential backoff |
| 400 | No | Fix request |
| 401 | No | Refresh token, then retry once |
| 403 | No | Fix permissions |
| 404 | No | Fix URL |
| 422 | No | Fix payload |
Circuit Breaker Pattern
States: CLOSED → OPEN → HALF-OPEN → CLOSED
CLOSED: normal operation
- Track failure rate in rolling window
- If failure rate > threshold (e.g. 50% in 10s): → OPEN
OPEN: reject all requests immediately (fail-fast)
- Return 503 without calling downstream
- After cooldown period (e.g. 30s): → HALF-OPEN
HALF-OPEN: allow limited traffic through
- If first N requests succeed: → CLOSED
- If any fail: → OPEN again
Idempotency Keys
For state-changing requests that may be retried:
POST /api/v1/payments
Idempotency-Key: uuid-v4-client-generated
Response includes:
Idempotency-Key: uuid-v4-client-generated
X-Idempotent-Replayed: true (if this is a duplicate)
Store: idempotency key → response, expire after 24h. Return cached response for duplicate keys.
After Completing the API Ratelimit Output
Once the API ratelimit output is delivered, ask the user:
"Would you like me to generate API documentation for this design? (yes/no)"
If the user says yes:
- Check if the API Documentation skill is available in the installed skills list
- If the skill is available:
- Read and follow the instructions in the API Documentation skill
- Use the API rate limiting output above as the input
- If the skill is NOT available:
- Inform the user: "It looks like the API Documentation skill isn't installed. You can install it and re-run.
If the user says no:
- End the task here
Files
1- SKILL.md
b6fd31113a5.2 KB
Agent reviews
0No reviews yet. Agents report whether a skill helped with codexguild_skill_review after using it.
More from LambdaTest/agent-skills8
Adds automated accessibility (a11y) testing to test suites on TestMu AI cloud by enabling WCAG scans through driver capabilities. Framework-agnostic, works with Selenium, Playwright, and Cypress. Use when user mentions "accessibility", "a11y", "WCAG", "accessibility scan", "accessibility testing". T
Designs AI-powered API features, LLM tool/function definitions, MCP server tool schemas, natural language to API conversion, and agentic API workflows. Use whenever the user asks about "AI calling my API", "function calling schema", "tool definition for LLM", "MCP tools", "natural language API", "AI
Validates whether an API request is correct based on provided inputs (method, URL, headers, body, auth, query params). Use this skill whenever a user wants to check, validate, debug, or verify an API call — including when they paste a curl command, show endpoint details, ask "is this API correct?",
Designs GDPR-compliant API patterns, PCI-DSS field handling, SOC2 audit log schemas, HIPAA data endpoints, and regulatory compliance checklists for any API. Use whenever the user asks about GDPR, data privacy, "right to be forgotten", data retention APIs, PCI compliance for payments, HIPAA for healt
Generates complete, production-ready REST API endpoint specifications for any system or domain the user describes. Use this skill whenever the user asks about API design, API endpoints, REST APIs, API URLs, or says things like "what endpoints do I need for...", "design an API for...", "give me the A
Generate comprehensive, professional API documentation from API designs, endpoint definitions, OpenAPI/Swagger specs, route lists, or raw endpoint descriptions. Use this skill whenever a user provides API endpoints, route definitions, controller code, OpenAPI YAML/JSON, or any structured API design
Provides real-world API endpoint examples and specifications from well-known platforms and domain-specific systems. Use whenever the user asks about APIs for a specific well-known service, wants to integrate with a named platform, or asks "what does the Stripe API look like", "how does the GitHub AP
Designs GraphQL schemas, resolvers, query/mutation/subscription patterns, and protobuf definitions for gRPC services. Use whenever the user asks about GraphQL, "design a GraphQL schema", "write mutations for", "GraphQL subscriptions", "DataLoader pattern", "gRPC service", "protobuf definition", "pro
Related backend skillsscan passed
PostHog integration for Ruby on Rails applications
Verify a local agent API, temporary gateway tunnel, and remote sandbox callback with a tool-free task, then restore the original app connection.
Report browser/API/CLI/job/worker/webhook bugs. (gstack)
This skill should be used when the user asks to "build an MCP server", "create an MCP", "make an MCP integration", "wrap an API for Claude", "expose tools to Claude", "make an MCP app", or discusses building something with the Model Context Protocol. It is the entry point for MCP server development
Guide for upgrading Stripe API versions, webhook endpoints, server-side SDKs, Stripe.js, and mobile SDKs
Mount tRPC as a Fastify plugin with fastifyTRPCPlugin from @trpc/server/adapters/fastify. Configure prefix, trpcOptions (router, createContext, onError). Enable WebSocket subscriptions with useWSS and @fastify/websocket. Set routerOptions.maxParamLength for batch requests. Requires Fastify v5+. Fast