API Rate Limiter Design Under Constraints

You're a software engineer on a growing B2B SaaS platform. Last week, a single client's automated sync job consumed 40% of your API capacity for three hours, causing elevated latency and timeout errors for other clients. The engineering team has been asked to fix this before it happens again.

Build a rate-limiting middleware layer that sits between incoming requests and API handlers, enforcing configurable limits before requests reach application logic. This is a proof-of-concept — focus on engineering judgment and trade-offs, not production polish. You have 30 minutes for the build phase.

Requirements:

• Per-client rate limiting — configurable per-org thresholds (e.g. 100 req/min standard, 500 premium)
• Per-endpoint rate limiting — stricter limits on write endpoints (POST, PUT, DELETE) than reads (GET)
• Meaningful error responses — 429 status, which limit was hit, and a Retry-After header
• Configurable limits — defined in a config object or file; adjustable without code changes

Constraints:

• In-memory only — no Redis, no external cache, no database. Address what breaks under this constraint and what changes when infrastructure becomes available.
• Any language or framework — language choice is not scored; engineering judgment is.
• Must work as middleware — implement as a middleware layer or decorator/interceptor pattern, not a modification to every individual route.
• Async-first communication — your README is how the team understands your work. Write it for someone reading at 11pm who can't ask follow-up questions.
• Demonstrate known failure modes — articulate what breaks (process restarts, horizontal scaling, memory growth); don't pretend limitations don't exist.

AI usage guidance:

• We expect you to use AI tools. We evaluate how you use them — not whether you use them.
• Evidence of iteration, redirection, and critical evaluation scores higher than polished output with no process documentation.
• The single highest-signal indicator: your video answer to the mandatory AI question. If you cannot name a specific moment where you redirected AI output, evaluators will assume you did not.
• Mandatory AI question for your video: Walk me through one moment where you disagreed with, pushed back on, or redirected what the AI gave you — and what you did instead. Name the specific moment. Explain what the AI produced that didn't meet the bar, what you did differently, and why.
• Speak naturally. Communication is assessed on clarity of technical ideas and logical structure — not verbal polish, accent, or filler words. We suggest that you do not read a transcript created by AI!