You finished API4 — Unrestricted Resource Consumption. Here's what you now understand:
✓What the risk is — APIs with no limits on frequency, size, or cost can be consumed without bound
✓Three damage modes: bulk data scraping, denial of service, and cloud cost amplification
✓How it differs from DDoS — valid requests, one client, no network-layer filter helps
✓Real incidents — Venmo 207M transactions (no rate limit) and Twitter 5.4M account-phone pairs (no lookup rate limit)
✓OWASP scenarios — unbounded pagination DoS, AI cost amplification, SMS OTP flooding
✓Seven mitigations: rate limiting, max page size, payload limits, timeouts, GraphQL complexity, cost quotas, and anomaly monitoring