Define proper rate limiting to avoid attackers overloading the API. There are many ways to implement rate-limiting, but most of them involve using HTTP headers. All 2XX and 4XX responses should define rate limiting headers.
OWASP API4 2023 Rate Limit
Message: All 2XX and 4XX responses should define rate limiting headers.