RFC 6585OWASP API4:2023SOC2 CC6.6Deep Prototype

APIQuotaTracker — Per-Customer Quota Burn + Soft/Hard Limits

22 customers × per-tier quota usage (rps + monthly request count + concurrency). Soft-limit (90% warning), hard-limit (100% throttle). Surfaces 4 customers exceeding soft cap + 2 customers paying enterprise rates but using free-tier quotas (sales misalignment) + 1 burst-pattern customer needing different rate-limit shape.

APIQuotaTracker — Per-Customer Quota Burn + Soft/Hard Limits preview
Open live →

What it is

The companion to APIRateLimit (per-endpoint limits) — APIQuotaTracker is per-customer. Surfaces sales misalignment + upgrade conversations.

What’s in it

  • 22 customers spanning enterprise / growth / team / free tiers
  • 3-axis quota burn: rps, monthly request count, concurrency
  • Per customer: tier, current burn vs cap, throttled status, sales misalignment flags
  • Worst-offender findings: Initech throttled at 116% rps; Massive Dynamic burning enterprise volume on team-tier (sales misalignment); HighThruput Co with 8.4% 429-rate on enterprise (burst-pattern needs different shape)

Why this shape

RFC 6585 (429 Too Many Requests) + OWASP API4:2023 (Unrestricted Resource Consumption) + SOC2 CC6.6 demand per-customer quota visibility. The hardest sales-engineering finding: a customer paying for enterprise-tier but using free-tier quotas.

How it ships

Single HTML file, ~13KB. Zero dependencies. 22 customers × 3-axis burn classifier in 130 lines of vanilla JavaScript.

Open the tool →