Users might observe a problem where the Rate Limits are returning an invalid 429 response code, when the rate limits defined in the plan are not exceeded.
Users of API Connect version 5 after fix pack 5.0.8.10 and the version 5 compatibility gateway on API Connect v2018 and v10 are impacted by this issue.
API Connect 5.0.8.10 introduced a change to the max records across intervals field for each of the statements in the SLM policies within the API Connect domain.
The change to the max records across intervals field had some unintended consequences. It introduced the possibility of overflowing the mapping of our rate limits and cause the nonresetting 429's when there are too many unique API's/Applications/Plans. The number of api's the rate in which they are hit, the combination and timing of the intervals can all factor in to overflowing the limit.
Check the analytics and ensure that the rate limit isn't being exceeded.
Please Note, although APAR -
IT43264 is fixed in DataPower, in order to make it work, please make sure you also upgrade the API Connect to v2018 or v10 accordingly.
Users running API Connect version 5 are encouraged to upgrade to API Connect version 10. A workaround can be implemented to apply similar changes to the API Connect V5 Framework if you are running API Connect version 5 or the version 5 compatibility gateway on a DataPower firmware version before the APAR.
As a workaround you can change the Maximum records across intervals to 1000 for each of the statements in the SLM policies within the API Connect generated domain by using a Gateway extension.
To apply this workaround:
'
1. From the API Connect generated domain, navigate to the SLM Policy screen. This screen can be found by searching SLM Policy or expanding Objects>Monitoring>SLM Policy.
2. For each SLM Policy, navigate to the statements tab and for each statement change the Maximum Records Across Intervals from 5000 to 1000.
For example, the SLM Policy webapi-api-burst has 4 statements. We want to update each statement in this policy as well as the other policies.
3. Save changes
4. Test and verify that the change mitigates the 429s.
5. After verifying that the change is working, take a configuration export of the modified SLM Policy objects. The configuration export is used in a Gateway extension, so the changes persist when the API Connect generated domain is re-created in events where you need to remove and readd the Gateway to the cluster. For example, when the Gateway goes out of sync after an upgrade.
Creating the Extension
For simplicity, in this example we assume you do not already have a Gateway extension configured on your DataPower and show how to implement it on API Connect version 5. If you already have an extension, the procedure is similar, but you need to update the existing extension to include this additional config.
1. Take a configuration export of all of the SLM Policy objects within your API Connect domain.
a. From the control Panel
Export Configuration > Export configuration and files from the current domain 
b. Under the objects select SLM Policy from the drop down > Select All SLM Policy Objects and click the > to add the selected object to the config export. After selecting the required objects click Next.
c. Download the resulting config export
2. Upload the resulting configuration export to your DataPower service/ Gateway cluster
Note: In order to upload the extension your DataPower service needs to have the servers removed.
[{"Type":"MASTER","Line of Business":{"code":"LOB67","label":"IT Automation \u0026 App Modernization"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSMNED","label":"IBM API Connect"},"ARM Category":[{"code":"a8m50000000CeCPAA0","label":"API Connect-\u003EDeveloper (DV)-\u003ERate Limiting \/ Plans"}],"ARM Case Number":"TS014151354","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"10.0.1;10.0.5;2018.4.1.0;5.0.8"}]
