I’m using Tyk cloud and I would like to set up a policy that allows us making the following limitations for our API :
1- Allow all users to request our URL (REST) for example max 10 times per seconde
2- Allow a user (identified by IP address) to call same URL for example 5 times per hour
1- You can achieve this with Policies and Quotas, for more information see our documentation: Policies Guide. Quotas Documentation.
2- You cannot do this with Cloud , you will need to use our Hybrid or On-Premise solution as they will give you more flexibility. To be more precise you would need to create a middleware, you can check the following link for more information: Creating an IP-based rate-limiter with Tyk and JavaScript middleware blog post