SAP Rate Limiting and Quotas
SAP systems have finite processing capacity. A single misbehaving API consumer — whether through a bug that causes infinite loops, a load test gone wrong, or a deliberate attack — can send thousands of requests per second and bring the SAP backend to a halt for all other users. Rate limiting caps how much traffic any one consumer can generate, ensuring fair access for everyone and protecting the backend from overload.
Quotas serve a different but related purpose. They enforce commercial limits — a Basic plan consumer gets 10,000 API calls per month, a Premium plan consumer gets 500,000. Quotas make API products commercially viable and manageable.
Rate Limiting vs Quota vs Spike Arrest
┌──────────────┬────────────────────────────┬──────────────────────────────┐ │ Control Type │ What It Limits │ Best Used For │ ├──────────────┼────────────────────────────┼──────────────────────────────┤ │ Spike Arrest │ Requests per second/minute │ Protecting against sudden │ │ │ (instantaneous rate) │ traffic spikes │ ├──────────────┼────────────────────────────┼──────────────────────────────┤ │ Rate Limit │ Requests per time window │ Enforcing steady call rates │ │ │ per consumer │ per consumer over time │ ├──────────────┼────────────────────────────┼──────────────────────────────┤ │ Quota │ Total requests per period │ Commercial plan enforcement │ │ │ (day/week/month) │ (1,000 calls/day per key) │ └──────────────┴────────────────────────────┴──────────────────────────────┘
Spike Arrest in Detail
Spike Arrest smooths traffic to a maximum rate. If you set 60 requests per minute, Spike Arrest allows one request every second, regardless of how many arrive simultaneously. It does not accumulate unused capacity — if no requests arrive for 30 seconds, the next second still allows only one request.
SPIKE ARREST: 60pm (60 per minute = 1 per second) SCENARIO: 100 requests arrive in 1 second ───────────────────────────────────────── Second 0: 1 request allowed immediately Second 1: 1 request allowed (99 queued or rejected) Second 2: 1 request allowed ... After 100 seconds: all 100 requests processed WITHOUT Spike Arrest: SAP receives 100 simultaneous requests, connection pool exhausted, 80 requests fail with timeout.
Quota Policy Deep Dive
The Quota policy counts API calls per consumer per time period and enforces an upper limit. When a consumer reaches the limit, subsequent calls receive HTTP 429 (Too Many Requests) until the quota period resets.
Quota Configuration Parameters
<Quota name="BasicPlanQuota"> <Allow count="1000"/> <!-- Maximum calls per period --> <Interval>1</Interval> <!-- Number of time units --> <TimeUnit>day</TimeUnit> <!-- day / week / month / hour --> <Identifier ref="request.header.X-API-Key"/> <!-- Per-consumer tracking --> <Distributed>true</Distributed> <!-- Share counter across all gateway nodes --> <Synchronous>true</Synchronous> <!-- Enforce immediately, not eventually --> </Quota>
Quota Reset Timing
Quotas reset either on a fixed calendar schedule (midnight every day) or relative to when the consumer first made a call (rolling window). Calendar resets create predictable behavior — all consumers get a fresh count at the same time. Rolling windows are fairer — a consumer who starts at 11 PM gets a full 24 hours regardless of when others' quotas reset.
Differentiated Quotas by API Product
The most powerful use of quotas is enforcing different limits for different subscription plans. An API developer portal offers three tiers:
BASIC PLAN: Quota: 1,000 calls/day Spike Arrest: 10/minute APIs included: Product catalog (read-only) STANDARD PLAN: Quota: 10,000 calls/day Spike Arrest: 60/minute APIs included: Product catalog + Order management (read/write) PREMIUM PLAN: Quota: Unlimited Spike Arrest: 600/minute APIs included: All APIs + priority support
API Management reads the plan from the API key's subscription and enforces the correct quota automatically. Upgrading from Basic to Standard requires only updating the subscription in the Developer Portal — no code changes anywhere.
Quota Response Headers
When a Quota policy runs, it adds informational headers to the response so API consumers can track their remaining quota:
Response Headers (added automatically by Quota policy):
X-RateLimit-Limit: 1000 ← Total allowed calls per period
X-RateLimit-Remaining: 756 ← Calls still available today
X-RateLimit-Reset: 1714694400 ← Unix timestamp when quota resets
Consumer application logic:
if (remaining < 100) {
// Slow down API calls to avoid hitting the limit
// Show warning in UI to user
}
Well-designed consumer applications read these headers and adapt their calling behavior. A consumer that ignores these headers and runs out of quota mid-day must wait until midnight — poor user experience that good API design prevents.
Handling Quota Exceeded Responses
When a consumer exceeds their quota, the default API Management response is HTTP 429 with a generic error body. Customize it with a Fault Rule for a better developer experience:
Custom 429 response body:
{
"error": {
"code": "QUOTA_EXCEEDED",
"message": "You have used all 1,000 calls for today.",
"quotaLimit": 1000,
"quotaUsed": 1000,
"resetAt": "2024-05-02T00:00:00Z",
"upgradeUrl": "https://developer.yourcompany.com/plans"
}
}
Include the reset timestamp and a link to upgrade options. A developer who knows exactly when they can try again — and how to get more quota — converts to a premium plan far more readily than one who receives a cryptic error code.
Rate Limiting for On-Premise SAP
On-premise SAP systems often have hard limits on concurrent RFC connections or database connections. Rate limiting API calls to SAP prevents these connection pools from exhausting:
SAP Connection Pool Limit: 20 concurrent connections Without rate limiting: 100 simultaneous API calls → 100 concurrent SAP connections → Pool exhausted → 80 calls fail with timeout error With Spike Arrest (20pm) + Concurrent connections limit: Spike Arrest ensures max 20 calls processed per minute → Pool stays within capacity → All calls process successfully, some with a small delay
Monitoring Quota Usage
API Management provides analytics dashboards showing quota usage by consumer, by API, and over time. Operations and product managers use these dashboards to identify:
- Which consumers approach their quota limit regularly (candidates for plan upgrades)
- Which APIs consume the most quota (indicating high business value or inefficient consumers)
- Usage trends over time (growing, stable, or declining API usage)