We expose several APIs that allow users to perform expensive operations - parsing uncached pages, performing complex database queries, transforming media files, etc. These APIs pose a thread of denial-of-service scenarious, intentional or unintentional (compare T64615, T387478, T405335). To mitigate this risk, we should have a mechanism that achieves at least one of the two following improvements:

• limit the number of concurrent requests per user, across all domains and APIs.
• apply cost-based rate limiting per user, across all domains and APIs.

Note that this is different from per-IP rate limits imposed at the edge (requestctrl) and from per-service concurrency limits imposed in the service mesh (e.g. T398002, T350294). It is also distinct from from rate limits imposed by MediaWiki internally.

A solution to this need is being investigated as T399291: Epic: API Rate Limiting Architecture. The purpose of this ticket is to provide an explicit problem statement and act as a focus point for all efforts designed to address this issue.