Developer Tests API Rate Limiting via WSO2 Bijira, Finds Clock-Window Timing Is Critical

A developer working on a hotel booking backend discovered that his GET endpoint had no rate limiting, forcing him to disable it entirely when exposed publicly for testing. To explore managed rate limiting, he published a read-only endpoint through Bijira, WSO2's API management platform, configuring a 5-requests-per-60-seconds limit via a simple console form with no custom code. Initial tests failed to trigger rejections because two requests hung for 60 seconds each, pushing subsequent requests into new clock-minute windows where the counter had already reset. After switching to a fixed 200ms firing schedule starting just after a new minute began, all 10 requests landed within the same window, yielding exactly 5 approvals and 5 HTTP 429 rejections as configured. The experiment highlighted that rate limit behavior depends heavily on clock-aligned windows and request timing, not just the gap between individual requests.