The public-write endpoints, and how they stay standing.
Updated
Only a handful of endpoints accept unauthenticated-visitor input, all on the site surface and all explicitly marked public-write: lead submits and form submits. Everything else on /api/site/* is read-only for public keys, and the platform surface accepts no public writes at all.
Lead and form submissions accept a honeypot value — the site renders a hidden field, and a filled hidden field is a bot. The API reports success and writes nothing: the bot learns nothing from the response, retries nothing smarter, and the inbox stays clean.
Public-write endpoints run a cheap per-IP damper — a small budget of submissions per window, bucketed per endpoint and per site key, backed by the cache. It is deliberately not a rate-limit product: its job is to blunt scripted floods, and the honest error is explicit:
{ "error": "rate_limited", "message": "Too many submissions; slow down" }