Absorb volumetric traffic before it reaches the gateway
An API gateway is an application-layer component. It should never be the first line of defence against volumetric floods, because it will exhaust connections long before its policy engine becomes relevant. Volumetric absorption belongs at the network edge, with anycast distribution and upstream scrubbing.
The architectural rule is simple: each layer should handle the attack class it is efficient at handling. The edge handles volume, the gateway handles identity and semantics, and the backend handles nothing it has not already been protected from.
Identity-aware rate limiting
Rate limits keyed only on source address are trivially defeated by distributed traffic and simultaneously punish legitimate consumers behind shared egress. Effective limits are keyed on authenticated identity — client credential, API key, or tenant — with a separate, tighter budget for unauthenticated endpoints.
Layer the limits: a burst limit measured in seconds, a sustained limit measured in minutes, and a quota measured in days. Attacks and runaway client retries have distinct signatures across those windows, and a single limit cannot catch both.
Application-layer attacks that look like traffic
The most damaging attacks against enterprise gateways are rarely the loudest. Expensive-query attacks — deeply nested graph queries, unbounded search filters, or large report generations — can exhaust a backend with modest request volume that no volumetric control will flag.
Defences are semantic: enforce query depth and complexity ceilings, require pagination, cap payload sizes, and set per-endpoint cost budgets so that expensive operations consume proportionally more of a client's allowance.
Degrade deliberately
Under sustained pressure the system will shed something. That decision should be made in advance, by the business, and encoded as policy: which endpoints are essential, which consumer tiers hold priority, and what a degraded response looks like.
Cached or stale responses, reduced result sets, and queued asynchronous acceptance are all preferable to timeouts. Rehearse the degraded mode in game days so that operators have executed it before the day it matters.