Explanation

When APIs lack hard limits on requests, payload size, concurrency, and backend cost, attackers can trigger denial-of-service and resource exhaustion. Abuse may target CPU-heavy search routes, file uploads, expensive third-party calls, or high-cardinality filters. Even non-malicious traffic spikes can degrade availability when quota policies are missing.