Following a Style Guide: Explaining API Rate Limits Using an ATM Analogy
Read time: 2 minutes
This is a deliberately simple explanation of a technical idea, written to meet strict plain-language and style constraints. It is written following one of JPDocu School of Technical Writing style guides.
An API rate limit restricts how frequently requests can be made to an API. This guide explains rate limits using an ATM analogy to show how they work in practice.
APIs receive requests from many users and applications at the same time. Without limits, too many requests can slow the system or cause outages.
Sometimes, excessive requests are part of a cyberattack known as DDOS (Distributed Denial of Service). A DDOS attack overwhelms a service with excessive traffic, making it unavailable to legitimate users.
API rate limits help ensure that a service:
-
Remains available
-
Performs consistently
-
Is not prone to cyberattacks
-
Remains cost effective (by saving server costs)
To make this more tangible, we can compare API rate limits to something many people use every day: an ATM.
An API can be compared to an Automated Teller Machine (ATM). ATMs typically have daily withdrawal limits per individual.
For example, an ATM may only allow you to withdraw up to $10,000 per day and $1,000 in a single transaction.
This prevents the bank from being overwhelmed by too many withdrawal requests at once. It also ensures cash is available to more customers by preventing any one person from withdrawing too much, and it limits a customer's losses in the event that a thief is the one withdrawing money from their account.
Similarly, API rate limits can look something like this:
| Limit Type | Example |
|---|---|
| Requests per minute | 60 requests |
| Requests per hour | 1,000 requests |
| Requests per day | 10,000 requests |
NOTE: Different APIs may enforce their rate limits in slightly different ways, so the example above is just one common approach.
At an ATM:
- The machine declines your transaction
- A message explains why
With an API:
- The system rejects your request
- The system returns an error response. The common response is HTTP 429 – Too Many Requests. However, different platforms have different ways of indicating this error.
Below is an error message from ChatGPT after hitting the free plan limit for GPT-5:
Finally, ATM limits reset after a set period. API limits reset in the same way.