Following a Style Guide: Explaining API Rate Limits Using an ATM Analogy
Read time: 2 minutes
This is a deliberately simple explanation of a technical idea, written to meet strict plain-language and style constraints. It is written following one of JPDocu School of Technical Writing style guides.
An API rate limit restricts how frequently requests can be made to an API. This guide explains rate limits using an ATM analogy to show how they work in practice.
APIs receive requests from many users and applications at the same time. Without limits, too many requests can slow the system or cause outages.
Sometimes, excessive requests are part of a deliberate cyberattack known as DDOS (Distributed Denial of Service). A DDOS attack overwhelms a service with excessive traffic, making it unavailable to legitimate users.
API rate limits help ensure that a service:
-
Remains available
-
Performs consistently
-
Is not prone to cyberattacks
-
Remains cost effective (by saving server costs)
To make this more tangible, we can compare API rate limits to something many people use every day: an ATM.
An API can be compared to an Automated Teller Machine (ATM). At an ATM, you can withdraw money, check your balance, transfer funds, etc. Each action takes system resources. API requests use resources similarly.
ATMs typically have daily withdrawal limits set by the bank to keep the system running smoothly.
For example, an ATM may only allow you to withdraw up to $10,000 per day and $1,000 in a single transaction.
This prevents the bank from being overwhelmed by too many withdrawal requests at once. It ensures cash is available to more customers by preventing any one person from withdrawing too much, and it limits a customer's losses in the event that a thief is the one withdrawing money from their account.
Similarly, API rate limits can look something like this:
| Limit Type | Example |
|---|---|
| Requests per minute | 60 requests |
| Requests per hour | 1,000 requests |
| Requests per day | 10,000 requests |
NOTE: Different APIs may enforce their rate limits in slightly different ways, so the example above is just one common approach.
At an ATM:
- Your transaction is declined
- A message explains why
With an API:
- Your request is rejected
- An error response is returned. The common response is HTTP 429 – Too Many Requests. However, different platforms have different ways of indicating this error response.
Below is an error message from ChatGPT after hitting the free plan limit for GPT-5:
Finally, ATM limits reset after a set period. API limits reset in the same way.