Enough requests overwhelm the server — CPU maxes out, memory is exhausted, database connections are held open, or the connection pool fills. Legitimate users get timeouts and errors. The service goes down for everyone while the attacker was just "using the API."

Without rate limits, an attacker can enumerate the entire dataset in a matter of hours. Users, products, prices, transactions — anything the API returns can be extracted wholesale. Venmo (207M transactions), Twitter (5.4M account-phone pairs), and Peloton are all examples of this damage pattern.

If the API triggers paid third-party operations — SMS sends, AI inference, email delivery, video transcoding, payment processor calls — an attacker can run up enormous bills. A $0.01-per-SMS endpoint called 1,000,000 times costs $10,000. Without limits, the API owner pays.

Without rate limiting on authentication endpoints, credential stuffing and password brute force attacks become trivial. This is the bridge between API4 and API2 — rate limiting is one of the core defenses against authentication attacks.