API Abuse Calculator

requests = ceil(records ÷ page size); elapsed = requests ÷ (rate limit × identities); attacker cost = identities × cost per identity. Rate limits do not stop a scrape, they price it: the elapsed time is the request count divided by the aggregate rate the attacker can buy, and the cost is the price of the identities needed. Comparing that cost with the resale value of the dataset shows whether your controls have made the attack uneconomic or merely slow.

Business-logic abuse does not appear in a vulnerability scan — the endpoint works exactly as designed — so the only way to justify pagination limits and anomaly detection is to show what the dataset costs to take.

This calculator takes 7 inputs: Records reachable through the endpoint, Records returned per response, Rate limit per key or address, Keys or proxies the attacker rotates, Cost per identity, Detection probability per request, Resale or abuse value per record. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Removing the enumerable pattern first: unguessable identifiers, no sequential IDs, and object-level authorisation on every read. After that, cap total records per credential per day rather than requests per second, and alert on breadth of access — an account that has touched ten thousand distinct records is abnormal however slowly it did so.