Rate Limiting
Request Size Limits
Error Responses
Connection timeout protection
All API services enforce HTTP server timeouts that protect against slowloris-style denial-of-service attacks. These timeouts automatically close connections that send data too slowly, preventing a single attacker from exhausting server resources with many slow, open connections. This protection applies to every service behind the API gateway and requires no configuration on your part. If you are running long-polling or streaming requests, ensure your client sends data within the standard HTTP timeout window. Standard API requests are not affected.Algorithm Enforcement
Compliance Mapping
B2C
- Per-IP limits protect consumer endpoints * Privacy-first: only hashes logged * Rate limits explained as consumer protection
B2B
- Per-tenant quotas for SLA isolation * Audit retention for enterprise audits * Correlation IDs for SOC2/ISO27001
B2G
- Stricter governance route limits * Retention supports regulatory recordkeeping * Error taxonomy for legal defensibility
B2B2C
- Dual-layer limits (IP + tenant) * Offline bundle verification * Cross-org portability
Configuration
# Gateway (nginx.conf)