API4:2023 — Unrestricted Resource Consumption

Slide 4 · API4 vs. a DDoS

This isn't a flood from outside. It's the API doing it to itself.

The attack is legitimate usage — just too much of it.

Traditional DDoS

Thousands of compromised machines sending junk traffic

Goal: saturate the network layer

Requests are often malformed or repeated identically

Blocked at the network edge (firewall, CDN)

Detected by traffic volume anomalies

Unrestricted Resource Consumption

Often one client making legitimate API calls

Goal: drain compute, storage, or third-party cost

Requests are valid — the API was designed to handle them

Passes through the network layer undetected

Indistinguishable from a very enthusiastic legitimate user

The key difference

In a classic DDoS, the attacker sends garbage. In an API resource consumption attack, the attacker sends exactly what the API was built to process — just more of it than the server can sustainably handle. The API's own functionality is the weapon.

This is why network-layer DDoS mitigations don't solve API4. The requests look legitimate to every filter — because they are legitimate. The defense must live at the application layer: rate limits, quotas, and size caps built into the API itself.

← Back Why does this keep happening? →