Blocking IP Address by count.

[#1]

How can IP address be block if and only if that IP address exceeds 100 requests in an hour. I need to put some kind of policy in API Pre Flow which will block any dynamic IP Address if that IP Adress makes more than 100 calls per hour to our API in enterprise.apigee.coI As Access Control policy block a particular IP Address, but how can I block a dynamic IP Address based upon the count of API Calls made by that IP Address?

[apininja · Accepted solution]

@Madhumita Kumari, You can use the quota policy configured as follows:

<Quota name="MyQuota">
  <Identifier ref="client.ip"/> 
  <Interval>1</Interval>
  <TimeUnit>hour</TimeUnit>
  <Allow count="100"/>
</Quota>

[anilsr]

@Madhumita Kumari , If above issue is resolved, Don't forget to hit "Accept" below the answer that fully addressed your question. This gives well-deserved reputation points to the person who answered. It also ensures that the next user with the same question will have the best answer at their fingertips.

[hireshoban]

It surely works, but there is a small catch(I tested for minutes and should be same for other units)

The TimeUnit is not the actual time when the first call is made. TimeUnit references the clock (current server time).

If I have to restrict 2 calls per minute, when I make a 2 call at 2:31:30 (hours:Minutes:Seconds), I cannot make another call until 2:32:00, but can make call at 2:32:01.

So this will not work for the fist time which is not a big deal for my scenario. It is amazingly simple considering the solution that I developed through Mashery, LOL.