BTP & Integrationadvanced

BTP API Management Part 5: Rate Limiting, Quotas, Spike Arrest and Threat Protection

Key takeaway

Protect back ends and fair usage: spike arrest for bursts, quotas per application or product tier, concurrent rate limits, payload threat protection (JSON/XML), regular expression protection, and sizing limits based on back-end capacity and business tiers.

Explanation

📌 KEY POINTS
✅ Spike arrest smooths bursts (e.g. per second); quotas cap volume per period per consumer.
✅ Quotas can differ by product tier (basic vs premium) using product/app attributes.
✅ Threat protection limits payload depth, size, array lengths; regex protection blocks injection patterns.
✅ Limits must be sized from back-end capacity, not guessed.
⚠️ A single global quota lets one heavy consumer starve all others.

━━━━━━━━━━━━━━━━━━━━
▶ WHERE WE ARE
Part 4 covered security. Now traffic and threats.

━━━━━━━━━━━━━━━━━━━━
▶ 1. SPIKE ARREST

Smooth bursts; per second/minute.

━━━━━━━━━━━━━━━━━━━━
▶ 2. QUOTAS

Per app/product; tiers.

━━━━━━━━━━━━━━━━━━━━
▶ 3. CONCURRENCY

Protect slow back ends.

━━━━━━━━━━━━━━━━━━━━
▶ 4. THREAT PROTECTION

JSON/XML limits; regex.

━━━━━━━━━━━━━━━━━━━━
▶ 5. SIZING

Back-end capacity; monitoring 429s.

━━━━━━━━━━━━━━━━━━━━
▶ STEP BY STEP

Measure back-end capacity.
Configure spike arrest and tiered quotas.
Add JSON threat protection and test.

✅ CHECKPOINT: morning traffic peak no longer overloads the back end.

Code example

ABAP Code

===== EXAMPLES =====SpikeArrest: rate 20ps (smooths bursts)Quota: identifier = app client ID; basic tier 5,000/day, premium 50,000/day (from product attributes)JSONThreatProtection: max container depth 5, max array elements 200, max string length 2,000Regex protection: block patterns like SQL keywords in query parameters ===== RESPONSE =====429 Too Many Requests + Retry-After header

Real project scenario

A mobile rollout created a morning traffic spike that overloaded S/4. Spike arrest and per-app quotas sized from measured capacity, plus caching of reference data, kept S/4 stable.

Common mistakes

Global quotas only.
Guessed limits.
No threat protection.
Unclear 429s.
No monitoring.

Best practices

Per-app/tier quotas.
Capacity-based limits.
Threat protection.
Retry-After headers.
Monitor rejections.

Interview angle

Questions: "Spike arrest vs quota?", "How do you size limits?", "What does threat protection do?"
Strong answer: traffic policies, tiers, protection, sizing, monitoring.

Practice this lesson

Quick check

1. What should a consumer receive when it exceeds its quota?

2. A mobile rollout created a morning traffic spike that overloaded S/4. What helps most?

3. What is the difference between spike arrest and quota?

Interview questions

1. A mobile launch overloads the back end through API Management. How do you design traffic protection?

Answer it in your own words first, then compare.

2. A production issue is reported in API Management. What would you check first, and how would you troubleshoot it systematically?