{% extends "docs/base.html" %}

{% block docs_content %}
  <div class="mb-4">
    <h1 class="h3 mb-1">Rate limits</h1>
    <p class="text-muted mb-0">Manage stored rate-limit rules. All endpoints require staff access.</p>
  </div>

  <div class="card shadow-sm mb-4">
    <div class="card-body">
      <h2 class="h6 text-uppercase text-muted">Endpoints</h2>
      <div class="table-responsive">
        <table class="table table-sm mb-0">
          <thead><tr><th>Method</th><th>Path</th><th>Result</th></tr></thead>
          <tbody>
            <tr><td><code>GET</code></td><td><code>/api/v1/rate-limits</code></td><td>Paginated rules</td></tr>
            <tr><td><code>POST</code></td><td><code>/api/v1/rate-limits</code></td><td>Create a rule</td></tr>
            <tr><td><code>GET</code></td><td><code>/api/v1/rate-limits/{uuid}</code></td><td>One rule</td></tr>
            <tr><td><code>PUT</code></td><td><code>/api/v1/rate-limits/{uuid}</code></td><td>Update a rule</td></tr>
            <tr><td><code>DELETE</code></td><td><code>/api/v1/rate-limits/{uuid}</code></td><td>Delete a rule</td></tr>
          </tbody>
        </table>
      </div>
      <div class="mt-3">
        <span class="badge text-bg-secondary">Authenticated</span>
        <span class="badge text-bg-warning">Staff only</span>
      </div>
    </div>
  </div>

  <div class="card shadow-sm mb-4">
    <div class="card-body">
      <h2 class="h6 text-uppercase text-muted">Create a rule</h2>
      <p>Scopes identify instrumented operations such as <code>api:ping-user</code>. Scope names must be unique, and request and window values must be positive integers.</p>
      <div class="bg-light border rounded p-3">
        <pre class="mb-0"><code>curl --request POST \
  --header "Authorization: Bearer $PEARING_API_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"scope":"api:ping-user","max_requests":10,"window_seconds":60,"is_enabled":true}' \
  "$PEARING_API_URL/v1/rate-limits"</code></pre>
      </div>
      <p class="mt-3 mb-0"><code>201 Created</code> returns the stored rule with its <code>uuid</code>, timestamps, and configured values.</p>
    </div>
  </div>

  <div class="card shadow-sm mb-4">
    <div class="card-body">
      <h2 class="h6 text-uppercase text-muted">Update or delete a rule</h2>
      <p>Updates are partial. Omitted fields keep their current values.</p>
      <div class="bg-light border rounded p-3 mb-3">
        <pre class="mb-0"><code>curl --request PUT \
  --header "Authorization: Bearer $PEARING_API_TOKEN" \
  --header "Content-Type: application/json" \
  --data '{"max_requests":20,"window_seconds":120}' \
  "$PEARING_API_URL/v1/rate-limits/$RATE_LIMIT_UUID"</code></pre>
      </div>
      <p class="mb-0"><code>DELETE</code> returns <code>204 No Content</code>.</p>
    </div>
  </div>

  <div class="card shadow-sm">
    <div class="card-body">
      <h2 class="h6 text-uppercase text-muted">Enforcement</h2>
      <p class="mb-0">A rule is enforced only when both the rule and the site-wide <code>rate_limits_enabled</code> setting are enabled. Exceeded API limits return <code>429 Too Many Requests</code> with retry information.</p>
    </div>
  </div>
{% endblock %}