You're viewing **Apigee Edge** documentation.  
[Go to the
**Apigee X** documentation](http://cloud.google.com/apigee/docs/api-platform/develop/comparing-quota-and-spike-arrest-policies). info

Quota and SpikeArrest policies --- wondering which one to use to
best meet your rate limiting needs? See the comparison chart below.

|   | Quota | SpikeArrest |
|---|---|---|
| Use it to: | Limit the number of connections apps can make to your API proxy's target backend over a specific period of time. | Protect your API proxy's target backend against severe traffic spikes and denial of service attacks. |
| Don't use it to: | Don't use it to protect your API proxy's target backend against traffic spikes. For that, use the SpikeArrest policy. | Don't use it to count and limit the number of connections apps can make to your API proxy's target backend over a specific period of time. For that, use the Quota policy. |
| Stores a count? | Yes | No |
| Best practices for attaching the policy: | Attach it to the **ProxyEndpoint Request PreFlow**, generally after the authentication of the user. This enables the policy to check the quota counter at the entry point of your API proxy. | Attach it to the **ProxyEndpoint Request PreFlow**, generally at the very beginning of the flow. This provides spike protection at the entry point of your API proxy. |
| HTTP status code when limit has been reached: | `500` (Internal Server Error) \* | `500` (Internal Server Error) \* |
| Good to know: | - Quota counter is stored in Cassandra. - Configure the policy to synchronize the counter asynchronously to save resources. - Asynchronous counter synchronization may cause a delay in the rate limiting response, which may allow calls slightly in excess of the limit you've set. | - Performs throttling based on the time at which the last traffic was received. This time is stored per message processor. - If you specify a rate limit of 100 calls per second, only 1 call every 1/100 second (10 ms) will be allowed on the message processor. A second call within 10 ms will be rejected. - Even with a high rate limit per second, nearly simultaneous requests may result in rejections. |
| Get more details: | [Quota policy](https://docs.apigee.com/api-platform/reference/policies/quota-policy) | [SpikeArrest policy](https://docs.apigee.com/api-platform/reference/policies/spike-arrest-policy) |

\* For the [Quota policy](https://docs.apigee.com/api-platform/reference/policies/quota-policy) and [SpikeArrest policy](https://docs.apigee.com/api-platform/reference/policies/spike-arrest-policy),
the default HTTP status code for exceeding the rate limit is a generic
`500 Internal Server Error`.
You can change the status code for those policies to
`429 Too Many Requests` by adding an
organization-level property (`features.isHTTPStatusTooManyRequestEnabled`).
If you're a Cloud customer, contact [Apigee Edge Support](https://docs.apigee.com/api-platform/troubleshoot/support) to have the property enabled.

> [!NOTE]
> **Private Cloud:** If you're an Edge for Private Cloud customer, set this property with the following API call:
>
> **Note**: When updating properties, you must pass all existing properties to the API,
> even if they are not being changed. If you omit properties in the payload, the properties are
> removed.
>
> ```
> curl -u email:password -X POST -H "Content-type:application/xml" http://host:8080/v1/o/myorg -d \
> "<Organization type="trial" name="MyOrganization">
>     <DisplayName>MyOrganization</DisplayName>
>     <Environments/>
>     <Properties>
>         <Property name="features.isHTTPStatusTooManyRequestEnabled">true</Property>
>     </Properties>
> </Organization>"
> ```