We support these headers, but unfortunately there’s a mess of different implementations out there. The names aren’t consistent. The number/date formats aren’t consistent. We occasionally discover new edge cases. The standard is very late to the party. Of course, better late than never. I just hope it can actually gain traction given the inertia of some incompatible implementations.
If you are designing an API, I strongly recommend using `Retry-After` for as long as you can get away with it and only implementing the rate limit headers when it really becomes necessary. Good clients will add jitter and exponential backoff to prevent the thundering herd problem.
As you said, 429 + Retry-After is plenty good already.
> Servers MAY choose to return partition keys that distinguish between quota allocated to different consumers or different resources. There are a wide range of strategies for partitioning server capacity, including per user, per application, per HTTP method, per resource, or some combination of those values. The server SHOULD document how the partition key is generated so that clients can predict the key value for a future request and determine if there is sufficient quota remaining to execute the request.
If external documentation is required, why send the header? It seems as though having it in the documentation is generally preferable, rather than something to avoid.
The partitioning strategy, and partition chosen using it, would never — should never — be relevant to any automated logic inside the client. (The only way in which it could be would be if you were trying to make a client that aims to defeat the server's rate-limiting logic by using multiple accounts or IP addresses to jump between partitions, and that's... not okay.)
The point of sending the partitioning info to the client, is that it enables a human developing a client, or operating a tool that embeds a client, to debug why rate-limiting is happening when by their understanding it shouldn't be — especially when they have multiple clients across multiple threads / machines each making multiple concurrent requests to the API. These HTTP-429-response heisenbugs get much easier to reason about when the server is sending the client enough information for the developer to be able to see which of the requests they sent got rate-limiting-bucketed together, and which didn't.
It's true that if an API requires the devs of its consumers to have consulted documentation in order to respect the RateLimit header, they can just as easily include custom API logic for traffic control, but this does provide a nice standardized way to do so nevertheless.
And since the word is "MAY", APIs may also use standard responses that don't require an custom handling. As an example a CLI-builder library which parses OpenAPI spec can adopt changes to handle the RateLimit header automatically, in the situations where consulting docs is not required.
[1] https://www.iana.org/assignments/http-fields/http-fields.xht...