League Account API endpoint has incorrect rate limiting

"

moowiz wrote:

Hi,

I’ve noticed what looks like a bug with the developer API League Account (https://www.pathofexile.com/developer/docs/reference#leagueaccounts) endpoint. It appears that the endpoint is rate limiting per IP, instead of per account.

I’ve written a small python script which shows this issue. The script iterates through a list of 40 access tokens, and fetches the list of their characters, and their atlas passives. It also prints out the rate limiting headers set in the response. The script can be accessed at https://gist.github.com/moowiz/ef6ff870f4d37b221962e51ae0748faf

The responses to both API calls both include ‘X-Rate-Limit-Policy: Account’, which I would imagine means that these API calls are rate limited per account. It appears that the atlas passive API calls are instead rate limited per IP. You can see this in the sample script output included as a comment in the script. The X-Rate-Limit-Account-State values increment only by one for each API call to list characters, but they increment across calls to fetch league account information for different characters.

"

HanSoloDK wrote:

"

moowiz wrote:

Hi,

I’ve noticed what looks like a bug with the developer API League Account (https://www.pathofexile.com/developer/docs/reference#leagueaccounts) endpoint. It appears that the endpoint is rate limiting per IP, instead of per account.

I’ve written a small python script which shows this issue. The script iterates through a list of 40 access tokens, and fetches the list of their characters, and their atlas passives. It also prints out the rate limiting headers set in the response. The script can be accessed at https://gist.github.com/moowiz/ef6ff870f4d37b221962e51ae0748faf

The responses to both API calls both include ‘X-Rate-Limit-Policy: Account’, which I would imagine means that these API calls are rate limited per account. It appears that the atlas passive API calls are instead rate limited per IP. You can see this in the sample script output included as a comment in the script. The X-Rate-Limit-Account-State values increment only by one for each API call to list characters, but they increment across calls to fetch league account information for different characters.

that is per design of GGG so not a bug.

"

moowiz wrote:

How do you know this is by design?

"

HanSoloDK wrote:

"

moowiz wrote:

How do you know this is by design?

because ALL their systems is using rate limiting by IP.