How do I validate rate limits on an API?

To validate rate limits on an API, you want to confirm both the documented behavior and the actual enforcement under load.

What to validate

1) Limit threshold

Verify the API enforces the expected number of requests per time window, for example:

• 100 requests/minute
• 10 requests/second
• 1,000 requests/hour

2) Scope of the limit

Check whether rate limits are applied per:

• API key
• user/account
• IP address
• endpoint
• organization/tenant

3) Window type

Determine whether it’s:

• fixed window
• sliding window
• token bucket / leaky bucket

This affects how requests are counted near window boundaries.

4) Behavior when limit is exceeded

Validate:

• response status code: usually 429 Too Many Requests
• response headers, such as:
  • Retry-After
  • X-RateLimit-Limit
  • X-RateLimit-Remaining
  • X-RateLimit-Reset
• response body/message quality

5) Recovery after reset

Confirm requests are accepted again after the window resets.

---

How to test it

Basic manual test

1. Send requests slowly below the limit and confirm all succeed.
2. Send enough requests to reach the limit.
3. Send one more request and confirm you get 429.
4. Wait for the reset interval.
5. Send another request and confirm it succeeds.

Load/automation test

Use tools like:

• curl + shell loops
• Postman/Newman
• k6
• JMeter
• Locust
• Gatling

Example using curl in a loop:

for i in {1..105}; do
  curl -s -o /dev/null -w "%{http_code}\n" https://api.example.com/resource
done

If the limit is 100/minute, you should see success codes until the threshold, then 429.

---

Important edge cases

• Requests arriving exactly at the boundary of a time window
• Parallel requests from multiple clients using the same token
• Separate limits for different endpoints
• Whether failed requests count toward the limit
• Whether Retry-After is accurate
• Behavior under burst traffic
• Distributed systems where counters may lag or be inconsistent

---

Good validation checklist

• Correct limit enforced
• Correct status code returned on exceed
• Correct headers returned
• Limit resets as expected
• Scope is correct
• Burst and concurrency behavior is correct
• No unexpected throttling below the threshold

If you want, I can also give you:

• a test plan template
• a Postman/Newman example
• a k6/Locust script for rate limit validation