A client exceeds the rate limit. Which status and header are standard?
Options
- 503 Service Unavailable with a
Cache-Controlheader - 429 Too Many Requests with a
Retry-Afterheader (Correct option) - 403 Forbidden with a
WWW-Authenticateheader - 400 Bad Request with a custom
X-Errorheader
Answer
429 Too Many Requests with Retry-After
Why
429 Too Many Requests means 'you are sending requests too fast'.
The Retry-After header tells the client how many seconds to wait before trying again.
Good clients respect it and back off instead of hammering the server.
Remember
Rate limited → 429 + Retry-After.