Also, after some more thought, it occurs to me that my Expected Behaviour section above is too simple. There are really two similar-but-different error conditions here:
- more than the maximum number of addresses were sent in the json blob (e.g. the list is 21 addresses)
- more than the maximum number of addresses per hour are trying to be sent (e.g. 10 have already been sent this hour, and now a request is received with 11 addresses)
Probably both should be a 413 Entity Too Large response code, but the first would not have a retry-after header and the second would. I’d suggest there should also be different text in the message field of the response json.