Traffic Source Rate Limiting

What Rate Limiting Does

Rate limiting is a separate system from caps. It prevents
burst traffic from overwhelming the system by limiting
requests per time window on inbound webhooks. Caps limit
cumulative volume; rate limiting prevents spikes.

Two-Phase Architecture

Rate limit checking evaluates two phases in order. If the
first phase is exceeded, the second is skipped entirely:

1. Global webhook limits (checked first): set on the inbound webhook via rate limit per minute, per hour, and per day fields. These cap total request volume regardless of traffic source. If any global limit is exceeded, the request is rejected immediately.
2. Per-traffic-source limits (checked second): if a rate limiter group is linked to the webhook, the system looks for a matching rate limit entry for the specific traffic source. If one exists, that entry's limits are used. Otherwise, the webhook's blanket per-traffic-source limits apply as a fallback.

Configuration

Rate limiter groups are linked to inbound webhooks. Each
group contains per-source rate limit entries with
individual overrides. A traffic source can only have one
entry per limiter group to prevent conflicts.