Define proper rate limiting to avoid attackers overloading the API. Part of that involves setting a Retry-After header so well-meaning consumers are not polling and potentially exacerbating problems.
OWASP API4 2023 Rate Limit Retry After
Message: A 429 response should define a Retry-After header.