# Spike Arrest The Spike Arrest policy limits the number of requests forwarded from the point in the processing flow where the policy is attached as a processing step. You can attach a Spike Arrest policy at the proxy endpoint or at the target endpoint. At the Proxy Endpoint, this policy limits the inbound requests. When you attach this policy at the Target Endpoint, it limits the requests forwarded to the backend service. Unlike Quotas, spike arrests are not implemented as counts. Rather, they are implemented as a rate limit which is based on the time the last matching message was processed. For example, if you specify 6 messages per minute, it means that the requests can only be submitted at the rate of one per 10 second interval. The second request within the 10 seconds on the same API Management server will be rejected. Even with a larger number of requests \(200 per second\), if two requests come in nearly simultaneously to the same API Management server, one will be rejected. Each successful request will update the spike arrest's last processed count. No counter is maintained for spike arrests, only the time that the last message was successfully passed through the Spike Arrest policy is maintained. On a given API Management server, if a request is received now, all subsequent requests will fail until the duration of 10 seconds has elapsed. Since Spike Arrest policy is not distributed, you might see some discrepancy between the actual behavior of the system and your expected results. In general, you should use Spike Arrest policy to set a limit that throttles traffic to what your backend services can handle. Do not use Spike Arrest policy to limit traffic from individual clients. You can attach the policy in the following locations:  An example payload for the policy is as follows: > ### Code Syntax: > > ### Sample Code: > > ``` > >  > > > > > > > > > > > > 30pm > > > > ``` **`` element**

Element	Default	Type	Description
`Identifier` \(Optional\)	N/A	String	Flow variable used for identifying the application or client. > ### Sample Code: > ``` > > > > ```

**`ref` attribute of the `` element**

Attribute	Default	Type	Description
`ref` \(Required\)	N/A	N/A	Identifies the flow variable by which Spike Arrest groups incoming requests.

**`` element**

Element	Default	Type	Description
`MessageWeight` \(Optional\)	N/A	Integer	Specifies the weight defined for each message. Message weight modifies the impact of a single request on the calculation of the SpikeArrest limit. Message weight can be set by variables based on HTTP headers, query parameters, or message body content. For example, if the SpikeArrest Rate is 10 per minute, and an application submits requests with weight 5, then only 2 messages are permitted per minute from that application. > ### Sample Code: > ``` > > > > ```

**`ref` attribute of the `` element**

Attribute	Default	Type	Description
`ref` \(Required\)	N/A	N/A	Identifies the flow variable that contains the message weight for the specific client. This can be any flow variable, such as an HTTP query param, header, or message body content.

**`` element**

Element	Default	Type	Description
`Rate` \(Required\)	N/A	Interger	Specifies the rate at which to limit the traffic spike \(or burst\). Valid value: integer per or or > ### Sample Code: > ``` > > 30pm > > ```

**`` element**

Element	Default	Type	Description
`UseEffectiveCount` \(Optional\)	N/A	Boolean	Distributes your Spike Arrest count across Message Processors \(MPs\) when using auto-scaling groups. > ### Sample Code: > ``` > > true > > ```

When a Spike Arrest policy executes, the following Flow variable is populated: **Flow Variable**

Variable	Type	Permission	Description
ratelimit.\{policy\_name\}.failed	Boolean	Read-Only	Indicates whether or not the policy failed \(true or false\).

During the policy execution, the following errors can occur: **Error Code**

Error Name	HTTP Status	Cause
SpikeArrestViolation	500	The rate limit is exceeded.
InvalidMessageWeight	500	The message weight value must be an integer.
FailedToResolveSpikeArrestRate	500	The referenced variable used to specify the rate can't be resolved.
InvalidAllowedRate	500	If the spike arrest rate specified in the `` element of the Spike Arrest Policy is not an integer or if the rate does not have ps or pm as a suffix, then the deployment of the API proxy fails.

The folFlowing fault variables are set when the policy triggers an error at runtime: **Fault Variables**

Variable Set	Where	Example
\[prefix\].\[policy\_name\].failed	The fault variable \[prefix\] is rate limit. The \[policy\_name\] is the name of the policy that threw the error.	ratelimit.SA-SpikeArrestPolicy.failed = true
fault.\[error\_name\]	\[error\_name\] = The specific error name to check for as listed in the table above.	fault.name Matches "SpikeArrestViolation"

**Related Information** [Quota](quota-1f742c1.md "The Quota policy defines the number of request messages an application can submit to an API over a given period of time.") [Concurrent Rate Limit](concurrent-rate-limit-8f22baa.md "The Concurrent Rate Limit policy is being decommissioned. The support for the Concurrent Rate Limit policy has come to an end. You can no longer create or update an API proxy with Concurrent Rate Limit policy. If you’re still using the policy and wondering which policy to use to best meet your rate-limiting needs, see Replace Concurrent Rate Limit Policy with Alternative Policies.")