5 signs your API is being abused (and how to catch each one)

Most API abuse doesn't look like a DDoS. It looks like a forgotten integration test polling every 500ms, a scraper working through your catalog endpoint overnight, or a partner's retry loop firing on every 4xx instead of backing off. None of that trips a WAF. All of it shows up in your request log — if you're looking at the right signals. Here are five patterns worth watching, and the exact thresholds WhoHitsMyAPI uses to flag them automatically on the Pro plan.

1. Error rate spikes

A sudden jump in 4xx/5xx responses usually means one of two things: a client is hammering an endpoint with bad input (brute-forcing an API key, guessing IDs), or you shipped a bug. Either way, you want to know within the hour, not when a customer emails you.

WhoHitsMyAPI's alert engine looks at the last hour of traffic (once you've got at least 10 requests to judge from) and flags it when 20% or more come back with a status code ≥ 400 — escalating to critical at 50%.

2. Request volume spikes

Volume alone isn't abuse — a product launch or a Hacker News mention can 10x your traffic legitimately. What matters is the shape: a sudden multiple of your own baseline, not an absolute number that means nothing without context.

The request-spike check compares your last hour of traffic against the average of the six hours before it. Cross 3x that average (with at least 5 requests in the window, to avoid noise on low-traffic APIs) and it fires as a warning; 10x and it's critical.

3. Single-IP floods

This is the classic signature of a misconfigured client or a scraper: one IP address making far more requests than any real human session would. It's the easiest abuse pattern to catch because it doesn't require historical baselines — just a raw count.

WhoHitsMyAPI flags any single caller IP that crosses 50 requests in an hour, and marks it critical past 200. In practice this is usually the fastest alert to fire, and the one most worth acting on immediately — block the IP or rate-limit the offending key while you investigate.

4. Traffic with no caller identity

If a meaningful share of your requests carry no callerId — no API key, no authenticated session, just a bare IP — that's either an onboarding gap (real users bypassing auth on a public endpoint) or someone probing for endpoints that shouldn't be reachable unauthenticated at all. Break down traffic by caller in your dashboard and check what fraction is anonymous before you assume every request came from a known integration.

5. Traffic concentrated in one geography that shouldn't be there

If your product only serves customers in one region but your request log shows sustained traffic from data-center IP ranges halfway across the world, that's worth a look — it's a common signature of scraping infrastructure and credential-stuffing bots rather than real users. WhoHitsMyAPI resolves country and city for every request automatically, so this shows up as a filter, not a research project.

Checking programmatically

All five checks above are exposed as a single authenticated endpoint, so you can pull them into your own alerting instead of only checking the dashboard:

curl -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \
  https://whohitsmyapi.veridux.ai/api/analytics/alerts

# {
#   "alerts": [
#     {
#       "type": "ip_flood",
#       "severity": "warning",
#       "message": "IP 203.0.113.42 made 63 requests in the last hour...",
#       "value": 63,
#       "threshold": 50
#     }
#   ],
#   "checkedAt": "2026-07-18T09:00:00.000Z"
# }

Anomaly alerts, the full request log, and CSV/JSON export are Pro features — see the pricing page for details. If you haven't wired up tracking yet, start with the middleware guide — the alerts above only work once requests are flowing in.