Hit a real rate limit
Hammer a demo endpoint and watch the fixed-window limiter fire a 429.
- 1
Send requests to the demo endpoint.
Each response carries X-RateLimit-Limit and X-RateLimit-Remaining — the standard headers an API gateway returns so clients can back off.
- 2
Send an 11th within the same minute.
A fixed-window counter (10/min per user) returns 429 rate_limited with Retry-After — the front-door defense against abuse and brute force.
Do it
The limiter allows 10 requests/minute per user. Fire 11 and watch the headers count down to the 429. The window is a fixed clock minute, so a burst that straddles a boundary can split into two allowed halves — if no 429 appears, press it again.
Learn the theory
🩻 X-ray — what actually happened
Your own insert-only audit trail — the real server events, sanitized (never a secret), each linked to the lesson that explains it.