DEV Community

realNameHidden
realNameHidden

Posted on

What Happens If Spike Arrest Is Set to 10pm but Traffic Spikes to 100 Requests at Once?

#apigee #apigeex #interview #spike

Introduction

Imagine this: You’re running a flash sale. Suddenly—BOOM!—100 users hit your API at the exact same second. Your backend is sweating, your server is screaming, and you’re praying nothing crashes.

This is exactly why API traffic management exists—and why Apigee X is such a powerful API management platform. Whether you’re building microservices, mobile apps, or enterprise APIs, tools like spike arrest, API proxies, and rate limiting are essential for protecting your systems.

In this blog, you’ll learn what spike arrest is, what happens when traffic exceeds the configured limit, and how Apigee X handles sudden request bursts. We’ll walk through examples, explain the behavior in simple terms, and give you best practices to keep your APIs safe and stable.

Core Concepts: Understanding Spike Arrest in Apigee X

What Is Spike Arrest?

Spike Arrest in Apigee X is a traffic-shaping policy that prevents sudden bursts of API traffic from overwhelming your backend services.

Primary keyword focus: API Proxies in Apigee X

You configure spike arrest inside your API proxy, and Apigee ensures your backend receives calls at a safe, controlled pace.

❗ Key Rule

If spike arrest = 10 pm → Apigee allows 10 calls per minute, NOT all at once.

It smooths the bursts so traffic looks like a steady flow, not a fire hose.

Simple Real-World Analogy

Imagine you’re at a movie theater where only 10 people are allowed to enter every minute.

If 100 people arrive at the same time, the usher does this:

  • Lets in 10 people
  • Makes the other 90 wait
  • If they try again too early, they’re told: “Too many requests. Try again later.”

Spike Arrest behaves exactly like that usher.

So What Happens When 100 Requests Arrive at Once?

Let’s break it down step by step.

Spike arrest = 10pm
Incoming traffic = 100 requests at once

Apigee processes them like this:

   Incoming Burst (100 requests)
           ↓
[Spike Arrest Policy (10 per minute)]
           ↓
Allowed:           10 requests
Rejected/Delayed:  90 requests
Enter fullscreen mode Exit fullscreen mode

Apigee's Behavior:

  • First 10 requests → allowed (but paced evenly within the minute)
  • Remaining 90 requests → get 429 Too Many Requests

Why does Apigee reject them?

Because spike arrest is not a queue.
It is not a rate limiter either.
It simply controls bursts.

If the traffic is too sudden, excess requests are blocked immediately to protect your systems.

Step-by-Step Example: Implementing Spike Arrest in Apigee X

Here’s a simple, error-free spike arrest policy:

<SpikeArrest name="SA-PreventBursts">
    <Rate>10pm</Rate>     <!-- 10 requests per minute -->
    <Identifier>request.header.apikey</Identifier>
</SpikeArrest>
Enter fullscreen mode Exit fullscreen mode

Breakdown:

  • <Rate>10pm</Rate> → sets the limit
  • Apigee spreads out calls so backend never sees sudden bursts
  • If clients exceed the burst threshold, Apigee returns: 
{
  "fault": {
    "faultstring": "Spike arrest violation. Allowed rate is 10pm",
    "detail": "Exceeded allowed rate"
  }
}
Enter fullscreen mode Exit fullscreen mode

Diagram: How Apigee Handles Burst Traffic 

           100 Requests Arrive at the Same Second
                           |
                           v
             +-------------------------------+
             |   Spike Arrest (10 per min)   |
             +-------------------------------+
                 |               |
       Allowed (10)        Blocked (90)
                 |               |
       Sent to Backend      429 Responses
Enter fullscreen mode Exit fullscreen mode

Best Practices for Using Spike Arrest in Apigee X

✅ 1. Don’t use spike arrest as a rate limiter

It is NOT designed to enforce long-term quotas.
Use Quota or Rate Limit policies for sustained control.

✅ 2. Set realistic limits based on backend capacity

If your backend handles 100 requests/minute, don’t set spike arrest to 10pm.

✅ 3. Use identifiers for client fairness

Prevent one client from hogging the entire limit:

<Identifier>request.header.apikey</Identifier>
Enter fullscreen mode Exit fullscreen mode

✅ 4. Monitor traffic patterns in Apigee Analytics

Look for:

  • Repeated 429 responses
  • High spike arrest violations
  • Uneven API usage

❌ Common Mistakes to Avoid

  • Setting spike arrest too low → causes user frustration
  • Using spike arrest to enforce API monetization
  • Forgetting that spike arrest rejects (doesn't queue) extra requests
  • Not informing clients of expected rate behavior

Conclusion

Spike Arrest in Apigee X is a powerful feature for API traffic management, ensuring sudden bursts don't bring your backend to its knees. When set to 10pm, only 10 requests per minute can pass, and if 100 requests hit your API at once, Apigee will allow just 10 and reject the remaining 90 with a 429 error.

By understanding how spike arrest works—and combining it with other features like quotas, API proxies, and analytics—you can design highly scalable, secure, and reliable APIs.

Try it in your Apigee X environment and watch how gracefully it handles bursts!

Top comments (0)