Files
Andras Bacsai 13298591d8 fix(api): throttle API clients that keep failing and notify the token's team
- Return 429 after 30 failed (401/403/404) requests per minute for one
  token or IP, also for unknown API routes (API_FAILED_REQUEST_RATE_LIMIT)
- Notify the team once a day when a token reaches the limit
- Deduplicate ability_denied and scope_denied audit events for 5 minutes
2026-11-05 23:38:37 +01:00

8 lines
257 B
PHP

<?php
return [
'rate_limit' => env('API_RATE_LIMIT', 200),
// Failed requests (401, 403, 404) per minute for one token or source IP before it gets 429. 0 turns it off.
'failed_request_rate_limit' => env('API_FAILED_REQUEST_RATE_LIMIT', 30),
];