Skip to content © 2026 Jer Catallo. Reference material only, always confirm against the official source.
Unrestricted API Resource Consumption incident response playbook · Cybersecurity Atlas
Home Playbook Unrestricted API Resource Consumption
Unrestricted API Resource Consumption API Security API4:2023 – Unrestricted Resource Consumption
An API lacks enforceable limits on requests or downstream work, allowing attackers to exhaust CPU, memory, storage, bandwidth, paid services, or operational budgets.
1 Apply emergency per-identity and per-endpoint limits at the gateway. 2 Disable abusive query features and cap payload, upload, and response sizes. 3 Set spending and concurrency guards on costly downstream integrations. Enforce timeouts, pagination, bounded batch sizes, and query complexity budgets.
2 Use quotas based on authenticated consumers instead of IP address alone.
3 Add backpressure and circuit breakers around constrained dependencies. 1 Model resource and financial abuse cases during API design. 2 Load-test worst-case inputs and verify limits fail closed. 3 Monitor unit economics and resource consumption per endpoint and consumer. Oversized uploads, deeply nested payloads, or expensive query parameters High-concurrency requests that trigger costly database or compute operations Repeated calls to endpoints backed by paid email, SMS, AI, or third-party services GraphQL queries with excessive depth, aliases, batching, or result cardinality Latency, memory, queue depth, or cloud cost spikes tied to one endpoint Large deviations in request size, query complexity, or response cardinality Rapid depletion of third-party quotas or messaging credits Repeated timeouts and worker exhaustion without a matching traffic increase k6 Grafana OpenTelemetry GraphQL Armor
