IntegrationAdvancedrate-limitingexperience-cloudapi
Architect API rate limiting for Experience Cloud public APIs
Real World Scenario
Public guest API abused by scrapers hitting Salesforce API limits affecting paying members.
Expected Answer
• API gateway rate limit per API key and IP
• Captcha on guest registration and sensitive endpoints
• Separate connected app for guest vs member lower guest quota
• WAF bot detection Cloudflare Akamai
• Monitor 429 responses alerting security team
• Graceful degradation message to legitimate users during attack
• Legal ToS prohibiting scraping enforceable
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Stay within limits by: API gateway rate limit per API key and IP. Bulkify everything — never query or DML in loops. Separate connected app for guest vs member lower guest quota. Public APIs need defense in depth—Salesforce limits alone insufficient against determined scrapers. Optimize for scale and operational observability.
Architect Perspective
Public APIs need defense in depth—Salesforce limits alone insufficient against determined scrapers.