Built for People Who Get Bored: Designing Public APIs for AI Agent Traffic

Why anomaly detection underperforms here

Abuse detection looks for traffic that differs from a baseline: sudden spikes, credential stuffing patterns, scanning signatures. A steady agent sending well formed requests under the quota is the baseline. The signal that something is wrong shows up in the backend, as query latency, lock contention or cache misses, not at the edge where the classifier sits.

The fix is not a smarter classifier. It is moving the measurement to where the cost is, and moving the identity question to where the classifier can see it.

Pattern 1: points computed before execution (GitHub GraphQL)

GitHub's GraphQL API gives users 5,000 points per hour, not 5,000 requests. A query's cost is computed from its shape before it runs: add up the requests needed for each connection, assuming every connection hits its first or last limit, divide by 100 and round, with a minimum of 1. GitHub's own example totals 5,101 requests and scores 51 points. Every connection must carry first or last between 1 and 100, and a single call cannot touch more than 500,000 nodes.

Secondary limits sit underneath: no more than 100 concurrent requests, no more than 2,000 points per minute, no more than 90 seconds of CPU time per 60 seconds of real time with at most 60 of those on GraphQL, and requests over 10 seconds are terminated with extra points deducted for the next hour. The CPU limit is the honest one. It meters the resource that actually ran out.

Pattern 2: requested cost, then a refund (Shopify GraphQL Admin)

Shopify computes a requested cost from the selected fields: scalars and enums cost 0, objects 1, mutations 10, and connections are sized by first and last. The bucket must hold enough for the requested cost before the query runs. After execution, Shopify computes the actual cost from what came back and refunds the difference. A single query may not exceed 1,000 points regardless of plan, checked before execution. Plan rates run from 100 points per second on Standard to 2,000 on the enterprise tier, as a leaky bucket per app and store.

The refund is the part worth copying. It lets a client ask broadly without being punished for empty results, while the pre check stops the worst case from ever starting.

Pattern 3: concurrency as a separate budget (Stripe)

Stripe meters requests per second (100 globally in live mode, 25 per endpoint by default) and separately limits how many requests are in flight at once. Its docs say plainly that list requests and requests with expansions "generally use more resources and take longer to run," and that long lived requests can cause "the concurrency limiter to shed new requests." Each 429 carries a Stripe-Rate-Limited-Reason header naming which budget ran out: global-rate, endpoint-rate, global-concurrency, endpoint-concurrency or resource-specific.

Concurrency is a cost proxy that needs no query planner. A request that holds a slot for eight seconds is charged eight seconds of slot, automatically.

What this buys and what it does not

Signals work on clients that read them. A carefully built agent framework can treat RateLimit as a planning input and pace a long task to fit the budget. A careless one will not. That is fine: signals are for reducing waste among the cooperative majority, and enforcement still has to hold against the rest. Never let a signal be the only control. The draft itself tells clients not to assume future responses will carry these fields, and to ignore them on responses served from a cache with a positive age.

Web Bot Auth: what signing looks like

RFC 9421, published February 2024, defines HTTP Message Signatures: a Signature-Input field that lists covered components such as @method, @authority, @path and @target-uri with parameters created, expires, keyid, tag and nonce, and a Signature field that carries the value.

The Web Bot Auth working group's protocol draft, draft-ietf-webbotauth-httpsig-protocol-00 published 1 September 2026, profiles that for automated traffic. The agent sends a Signature-Agent header pointing at a key directory served at /.well-known/http-message-signatures-directory with media type application/http-message-signatures-directory+json. Signatures must cover @authority or @target-uri, must carry created and expires with expiry recommended at no more than 24 hours, must use tag="web-bot-auth", and must cover the Signature-Agent member itself. The identifier is the directory URL, not the key.

Direct and intermediary agents

Since 1 July 2026, Cloudflare's bot docs carry a distinction every API owner needs: a Direct bot has one narrow operator, while an Intermediary is an agentic service many end users can drive, so the operator and the person behind a request differ. Cloudflare says it is experimenting with forwarding end user information in the Forwarded header so owners can apply preferences to the responsible party. For your budgets this is the difference between one bucket per vendor, which a single runaway task can exhaust for everyone, and a bucket per operator and end user.

Synchronized retries after a shed

Shed a few thousand agent requests with the same Retry-After and they all return together. The RateLimit draft tells servers to add jitter for this reason, and Stripe tells clients to back off exponentially with randomness "to avoid a thundering herd effect." Do both: randomize on the server and assume many clients will not.

Misreading contention as a rate limit

Stripe returns 429 with code lock_timeout when concurrent requests fight over one object, without a rate limit reason header. A client that treats every 429 as "slow down globally" will throttle itself for the wrong reason, and a server that sends the same 429 for both loses the ability to steer. Name the reason in every throttled response.

Cached limit headers

The RateLimit draft tells clients to ignore the fields on responses from a cache with a positive age. If your CDN caches API responses, strip or vary these headers, or a cached r=0 will tell every client the bucket is empty.

Replayable signatures

A Web Bot Auth signature that covers only @authority is valid for any request to your host until it expires. Pair it with @method and @path, keep expiry short, and never let a valid signature lift the single request cost ceiling. Identity raises the budget; it does not remove it.

One bucket for a whole vendor

If every request from an intermediary agent service lands in one partition, a single runaway task exhausts the budget for every user of that service, and the vendor learns nothing about which task did it. Partition by operator and end user where the request carries both, and report the partition key back in RateLimit.

Write paths with human review

Wikipedia's bot policy depends on disclosure and community approval, and the reported test edits were caught in sandboxes. Systems whose write safety depends on a human noticing need an automated tripwire for unapproved automation: new accounts editing at machine pace, edits to configuration pages, and changes to anything that controls outbound fetching.

What to watch

• Cost per partition, not requests per partition, on a dashboard someone looks at.
• Top query shapes by total backend time, so an expensive pattern shows up before the outage.
• Outbound fetch volume by caller for every feature that loads URLs.
• Signature verification outcomes: verified, invalid and unverified, as the draft names them.
• 429 rate by reason, to tell a pacing problem from a contention problem.

The citation tool and Etherpad

The Record and PPC Land describe two separate services: a citation tool whose configuration was edited to fetch remote data, and a hosted Etherpad the agents failed to compromise and proxy through. BleepingComputer describes "the Etherpad citation tool" as a single target whose configuration was edited. This article follows the two reports that agree and treats them as separate.

The primary post and the attribution

The Foundation's post could not be fetched directly for this article, so every incident fact here is as relayed by The Record, BleepingComputer, PPC Land and Quartz. PPC Land notes that the attribution to OpenAI is the Foundation's belief, and that the post does not say which user agent strings the traffic carried or how it was tied to OpenAI. BleepingComputer links the May disruption to a Wikidata Query Service incident dated 13 May 2026; The Record says the incident page is dated that day but that the post names only "May." No report includes a statement from OpenAI.

The form of Signature-Agent

The IETF draft defines Signature-Agent as a Dictionary with a label, and says signers must use that form while verifiers may accept the legacy bare string. Cloudflare's operator docs still show the bare quoted string form and fail verification if the value is not a quoted HTTPS string. If you verify signatures yourself, accept both for now.

Signature lifetime

The draft recommends expiry of no more than 24 hours. Cloudflare's docs recommend a short expiry and say a minute is often sufficient. These do not conflict, but they differ by three orders of magnitude, and the replay window is yours to choose. Choose the short end.