Plans
Plans control the limits of an application, and give applications permission to use a specific API deployment.
An application can have a number of API Keys, but each API Key references only one plan making it valid for one API deployment. This allows precise permission and limits on the API deployment.
Plans are only allowed with APIs that use an authentication provider. You must add an Authentication Source and select it on the API Deployments page before being able to add a plan.
After you assign a plan on the API Deployments page, you must subscribe it to the API on the Applications page in the Subscription column. If you do not create and attach a plan to an API deployment, the API throws an error and does not run because the system does not recognize it.
You can place the following limits on an API deployment through the Plan:
Maximum Message Size
Restricts the size of incoming API requests to the number of kilobytes (KB) specified. Leaving the field blank allows a request of any size.
Rate Limit
The rate limit protects the Gateway nodes. It applies per node, restricting the number of incoming requests for a specified time period per Gateway. It prevents a burst of requests on the same node from the same API Key. It does not limit the overall usage of an API by a certain client (Quota Limit serves that purpose better). It also does not determine which node a client will hit, so a client can sometimes execute more requests than the rate limit allows because the requests spread across more than one node. However, a client cannot exceed nodes * rate limit in the configured period of time. For example, if you have a two node gateway cluster and the rate limit is 5, then the actual rate limit for the gateway is 2 * 5, which is node * rate limit.
While creating a plan, you can set the rate limit - number of calls and the time period (second, minute, or hour). Leaving the field blank allows an unlimited number of calls up to the limit you configure on the Gateway. The rate limit applies based on the time of the first call. For example, if the rate limit allows five calls a minute, the minute starts at the first call, and does not allow the sixth call until one minute passes from the first call. The rate limit then allows five new calls. Setting a new rate limit does not reset current counters; instead, it applies the new limit going forward. For example, you set an initial rate limit plan of 10 calls per minute and consume 5 calls. If you then reset the plan to 5 calls per minute, you find that you have already reached the allotted call limit for that period. This is because, although you reset a plan with a new rate limit, the current consumption counter does not reset to 0 until the period passes.
To protect against Denial of Service-type attacks that generate a flood of sub-second or sustained high-volume requests, augment rate limits with Web Application Firewalls (WAF) or other specialized infrastructure mechanisms.
For deployed APIs attached to an environment that contains a multi-tenant cloud, the HTTP Request limit takes precedence over the Rate Limit value. HTTP Request Rate value is set on the Attachment Quotas tab of Cloud Management within Integration.
Quota Limit
Restricts the number of incoming requests for a specified time period per all runtimes within the Environment. Leaving the field blank allows an unlimited number of calls up to the limit set on the Environment when you configure it.
The quota limit begins at midnight (0:00) UTC. A weekly quota begins each Sunday. A monthly quota begins on the first day of each month.
For deployed APIs attached to an environment that contains a multi-tenant cloud, the HTTP Request Rate limit takes precedence over the Rate Limit value, followed by the Quota Limit value.
HTTP Request Rate value is set on the Attachment Quotas tab of Cloud Management within Integration.
You can disable, edit an existing plan, or delete a Plan on the Plans page. Disabled plans are appended with the word (Disabled) in their title, and their status is set to Disabled. Deleted plans are removed from the Plans page.
