Okta Certified Administrator · Part I

API Functions

6% of the exam — the smallest domain, but a real one.

API Functions

Module 2: API Extended Functions

1 sub-topic · this deck covers the whole module — the last one in this section

The Exam Bullet

"Demonstrate knowledge of the importance of API rate limiting"

An API with no ceiling on requests is a liability, not a feature. This sub-topic is about why Okta caps API traffic, and what happens when a client hits that cap.

The Mechanism — Why It Matters

Rate limits "maintain both service continuity and effective security control" — they prevent excessive traffic, protect against DDoS-style abuse, and ensure fair access for every client.

How It Works

Okta uses a bucket-based system: endpoints share defined quotas within a time window. Requests are matched by exact endpoint first, then by longest URL prefix if no exact match exists. Counters typically reset every 60 seconds — but not synchronized to the wall clock.

The Four Scope Types

Org-wide — all clients share one quota
Specific clients — nested under broader buckets, with lower limits
Authenticated users — independent buckets, not nested under others
Non-authenticated users — nested under existing buckets

The Gotcha — What Happens at the Limit

Exceeding a quota returns an HTTP 429 Too Many Requests response until the quota resets. Warnings are generated as counters approach capacity.

This overview source didn't provide specific numeric thresholds per endpoint — those live on dedicated per-endpoint reference pages that weren't fetched here. No specific numbers are invented; only the mechanism is taught.

The Exemptions

Three public metadata endpoints bypass rate limiting entirely:

/oauth2/v1/keys
/.well-known/openid-configuration
/.well-known/oauth-authorization-server

The Exam Angle

Watch for scenario questions built around this trap:

→ "A client's requests are failing with HTTP 429." = they've exceeded their rate limit bucket; must wait for the ~60-second reset.

One Line To Remember

Rate limits exist for service continuity + anti-abuse. Bucket-based, ~60-second resets, matched by exact endpoint then longest URL prefix. Four scopes: org-wide, specific clients, authenticated users, non-authenticated users. Exceeding a bucket returns HTTP 429. Three metadata endpoints (/oauth2/v1/keys, /.well-known/openid-configuration, /.well-known/oauth-authorization-server) are fully exempt.

Sources: developer.okta.com — docs/reference/rate-limits/

✓ Module 2: API Extended Functions — complete (1 of 1 sub-topic) · API Functions section complete