what is Main difference between Quota policy and spike arrest policy?

[#1]

when referring the Quota and Spike arrest policy they are almost similar to one another,So please give me the difference between them,

[#2]

The easiest way to differentiate the two is that a quota will collect the number of requests like in a bucket until the configured rate is achieved once achieved it will start rejecting requests. A spike arrest is more like a circut breaker that will trigger the rate is achieved. Key word is rate for instance if the defined rate is 100 requests a min, a quota will only trigger on the 101 request in a particular minute. A spike arrest can trigger on the 3 request if the traffic comes in fast then the defined rate.

[nmallesh]

Hi @PavanKumar,

Here is a good overview on the differences betweek Quota Policy, Spike Arrest Policy and Concurrent rate Policy.

Briefly stating,

Quota Policy helps you limit the number of requests per time interval. For instance, setting quota policy rate to 10 per minute, it is possible to hit all 10 requests in the first few seconds of a minute.

Spike Arrest Policy, on the other hand helps you limit the sudden increase in the number of requests at any point in time. For instance, setting spike arrest policy rate to 10 per minute, it does the following calculations to limit the sudden spike/increase in the number of requests -

10 per minute = 10 per 60 seconds = 1 per 6 seconds 

It will not allow more than 1 request every 6 seconds. In this way, we can ensure that all 10 requests are not made within the initial seconds of a minute.

Spike Arrest Policy helps in reducing the risk of automated request generation through malicious code.

The examples are well explain in the Apigee Documentation -

• Quota Policy
• Spike Arrest Policy

Hope this helps, keep us posted.

Thank You!

[#4]

The two policies are different, yet similar enough to confuse people. Here is my take on the two :

01. Quota Policy : It defines a time window ( for example 1 hour or 1 minute ) and within that time a fixed number of request are honored. For example, in 1 hour 10 requested are allowed and the user is free to make all the 10 request in 1 second or 1 hour. The basic idea is that only 10 request are allowed in an hour and make sure a user can make a fixed number of request

02. Spike Arrest. This policy specifies the total number of request and divides between the time interval that is defined. If the number of request is more then that calculated amount that the policy will block access. The idea behind is to make sure the traffic that is coming to the server or handled by target system is smooth and sudden burst of request does not impact.performance.

[#5]

Hi @Pavan Kumar

All mentioned answers explain a lot about Quota and Spike arrest policy.

Here is my take on these two policies:

1. Quota Policy: This policy is used to meet up the business requirements where business decides the no. of calls allowed for a product/developer/developer app etc and also they can decide pricing for different products based on no. of calls allowed. This ensures business that no developer/app can make calls more than the allowed limit.

2. Spike Arrest: This policy is used to avoid spikes in traffic and protect your backend systems against spikes so I will take it as a measure to protect/secure your API.

Hope it helps!!

[gandhilipi3196]

The only 2 lines that I keep in mind to differentiate them are:

1) Quota Policy: It is use to specify total no. of request that can pass in the given time interval.

eg An API can recieve only 20 request per hour. But there is no restriction on how this 20 request are passed. They can be passed in few seconds or minutes, Quota policy is not concerned with that.

2) SpikeArrest Policy: It is used to specify how many request in given time interval. The catch is it is not concerned with total no. of request but it says that for a given time period eg(10 second there should be only 1 request) So you cannot pass more than 1 request in 10 seconds.