diff --git a/docs/en-US/api-calls.xml b/docs/en-US/api-calls.xml index 3b97893d81d..af4073ac60b 100644 --- a/docs/en-US/api-calls.xml +++ b/docs/en-US/api-calls.xml @@ -25,8 +25,9 @@ Calling the &PRODUCT; API - + + diff --git a/docs/en-US/api-throttling.xml b/docs/en-US/api-throttling.xml new file mode 100644 index 00000000000..908e22389a8 --- /dev/null +++ b/docs/en-US/api-throttling.xml @@ -0,0 +1,67 @@ + + +%BOOK_ENTITIES; +]> + + + +
+ Limiting the Rate of API Requests + You can limit the rate at which API requests can be placed for each + account. This is useful to avoid malicious attacks on the Management Server, prevent + performance degradation, and provide fairness to all accounts. + If the number of API calls exceeds the threshold, an error message is returned for any additional API calls. + The caller will have to retry these API calls at another time. +
+ Configuring the API Request Rate + To control the API request rate, use the following global configuration + settings: + + api.throttling.enabled - Enable/Disable API throttling. By default, this setting is false, so + API throttling is not enabled. + api.throttling.interval (in seconds) - Time interval during which the number of API requests is to be counted. + When the interval has passed, the API count is reset to 0. + api.throttling.max - Maximum number of APIs that can be placed within the api.throttling.interval period. + api.throttling.cachesize - Cache size for storing API counters. + Use a value higher than the total number of accounts managed by the cloud. + One cache entry is needed for each account, to store the running API total for that account. + + +
+
+ Limitations on API Throttling + The following limitations exist in the current implementation of this feature. + Even with these limitations, &PRODUCT; is still able to effectively use API throttling to + avoid malicious attacks causing denial of service. + + + In a deployment with multiple Management Servers, + the cache is not synchronized across them. + In this case, &PRODUCT; might not be able to + ensure that only the exact desired number of API requests are allowed. + In the worst case, the number of API calls that might be allowed is + (number of Management Servers) * (api.throttling.max). + + The API commands resetApiLimit and getApiLimit are limited to the + Management Server where the API is invoked. + + +
+
\ No newline at end of file diff --git a/docs/en-US/sys-reliability-and-ha.xml b/docs/en-US/sys-reliability-and-ha.xml index 94385ff683d..3d6ebe1fcd6 100644 --- a/docs/en-US/sys-reliability-and-ha.xml +++ b/docs/en-US/sys-reliability-and-ha.xml @@ -28,5 +28,6 @@ - + +