Summary
Only POST /payments can return 429 (with Retry-After: 1); other endpoints never rate-limit, and the fixed Retry-After: 1 ignores the actual quota window.
Location
Details & impact
Clients get inconsistent throttling behavior and a misleading retry hint.
Suggested fix
Uniform limiting (see related issue) and a Retry-After derived from the limiter state.
Acceptance criteria
- 429 behavior and
Retry-After are consistent and accurate.
Summary
Only
POST /paymentscan return 429 (withRetry-After: 1); other endpoints never rate-limit, and the fixedRetry-After: 1ignores the actual quota window.Location
src/api/mod.rs:180-190Details & impact
Clients get inconsistent throttling behavior and a misleading retry hint.
Suggested fix
Uniform limiting (see related issue) and a
Retry-Afterderived from the limiter state.Acceptance criteria
Retry-Afterare consistent and accurate.