Create Rate Limit Rule
Create a per-endpoint rate-limit rule. Each rule has 0..N conditions joined by AND/OR — same vocabulary as firewall policies (source_ip, country, asn, browser, user_agent, endpoint, path, method, header, cookie, protocol, port). A request is counted only when its conditions resolve to true; the counter is then keyed by client IP. Once the counter exceeds requests_per_window within window_size_seconds, the configured action applies until the window rolls over.
Counters live in the platform's hot-path Redis. A new rule is pushed to the edges when you save it and takes effect within seconds. Each edge's cached copy of the endpoint's rules also expires on its own after about a minute, which only matters if a change notice is lost.
A rule with no conditions matches every request to its endpoint (legacy behaviour).
Request body
uuid from /endpoints.{condition_type, operator, condition_value, logical_operator} with the same vocabulary as firewall policies — see firewall policies for the full type/operator matrix and per-type value rules (ISO country codes, uppercase HTTP methods, IP/CIDR, etc.). The logical_operator on a condition is the OUTGOING connector to the next condition. Empty / omitted = "match every request to this endpoint".source_ip set and an empty conditions array, the api-server auto-promotes it into a single {type:"source_ip", operator:"equals", value:<ip>} condition. New code should use conditions directly.0 (or omitted) defaults to 100.≤ 0 (or omitted) defaults to 3600. Common values: 60 (per minute), 3600 (per hour), 86400 (per day).block (default — return 429) or throttle (delay subsequent requests instead of dropping them). Any other value is coerced to block.active (default), inactive, or disabled. Only active rules are evaluated.0 when omitted (no server-side default or clamp).Deprecated: the old name endpoint_id (it carries the same endpoint uuid string) is still accepted. Send endpoint_uuid.
Response (200 OK)
The newly-created rule with its uuid, endpoint_uuid, user_uuid, account_uuid, created_at / updated_at, hit_count (0) and its conditions array (each condition carries uuid and rule_uuid; omitted when the rule has none). description and the legacy source_ip are omitted when you didn't send them.
Deprecated: until the sunset this response also carries the legacy integer id and *_id fields. Don't use them; read uuid and the *_uuid fields.
Errors
name, malformed source_ip, negative requests_per_window, an invalid conditions entry (bad type/operator/value), or an unknown JSON field. Unknown fields are rejected — there is no key, scope, limit, or window_seconds on this endpoint; use the names documented above.custom_rate_limits.Endpoint not found).