# API Resource Consumption

Unrestricted resource consumption testing (OWASP API4), rate limit bypass via...

- Repository: https://github.com/xalgorix/xalgorix (1285 stars)
- Category: Testing
- License: Apache-2.0
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add xalgorix/xalgorix --skill api-resource-consumption -g -a claude-code -y`
Codex: `npx skills add xalgorix/xalgorix --skill api-resource-consumption -g -a codex -y`
Cursor: `npx skills add xalgorix/xalgorix --skill api-resource-consumption -g -a cursor -y`
Gemini CLI: `npx skills add xalgorix/xalgorix --skill api-resource-consumption -g -a gemini-cli -y`

## Description

Unrestricted resource consumption testing (OWASP API4), rate limit bypass via header/key drift, races, method and identity rotation, plus expensive-query, oversized payload, batch, export, and streaming abuse with threshold-based evidence

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# API Resource Consumption (OWASP API4)

## Purpose
Test whether the target's consumption controls (rate limits, size caps, complexity limits, quotas) can be exceeded so that requests keep being processed beyond the established control, enabling brute force, enumeration, and computational-cost abuse.

## Preconditions
- Measured baselines: what limits exist and where they trigger
- For concurrency races: parallel request capability (Python asyncio or xargs -P)
- High-volume authorization: the runtime policy governs volume; here we test whether the CONTROL works

## Attack Surface Signals
- Rate-limiting headers (429 responses, Retry-After, X-RateLimit-*)
- Endpoints without any visible throttling on expensive operations
- Pagination, search/filter, sort, export/report, batch/bulk, file upload/processing
- Async jobs, streams, subscriptions, WebSocket channels
- Auth endpoints (OTP send, password reset) and availability-check endpoints

## Methodology

### Step 1: Measure the Baseline
```bash
# Find the exact threshold: count requests until 429 (or until behavior changes)
for i in $(seq 1 30); do
  code=$(curl -sk -o /dev/null -w "%{http_code}" -H "Authorization: Bearer TOKEN" \
    "https://TARGET/api/search?q=x")
  echo "$i: $code"
done
```
Record: threshold N, window, which limit (per-IP, per-account, per-token, per-endpoint), and the absence/presence of headers. Absence of headers proves nothing by itself, measure actual behavior.

The rest: https://github.com/xalgorix/xalgorix/blob/HEAD/internal/tools/skills/data/api-security/api-resource-consumption/SKILL.md