Design and implementation of a request limiter

The API gateway accepts POST and GET requests, including components such as load balancer (LB), authorization module (Auth), TLS, and request limiter (RL).

It is necessary to design and implement a request limiting mechanism (Rate Limiter):

• Determine where to place the limiter — directly in the API gateway, before each microservice, or as a global service.
• Support various types of limits: by IP address, by user (created_by), by specific endpoint.
• Choose suitable limiting algorithms: Token Bucket, Leaky Bucket, fixed/sliding window.
• Decide where to store the limiter state — in RAM, Redis, or a distributed storage.
• Describe behavior when the limit is exceeded: return HTTP status code 429, log the event, possibly block the client.