403 Request rate higher than configured

Question

When I'm adding members to Google Groups I'm receiving a 403 Request rate higher than configured error. This is happening for all applications, including the API Explorer on the Google developer website.

Even if I make only a single request in 12+ hours I still receive the error. I've confirmed the Admin API has plenty of quota remaining on the project.

It is happening only for a single Apps for Education domain.

Request:

POST https://www.googleapis.com/admin/directory/v1/groups/[redacted]%40ryan.catholic.edu.au/members?key={YOUR_API_KEY}
{
 "email": "<redacted>",
 "role": "MEMBER"
}

Response:

{
 "error": {
  "errors": [
   {
    "domain": "usageLimits",
    "reason": "quotaExceeded",
    "message": "Request rate higher than configured."
   }
  ],
  "code": 403,
  "message": "Request rate higher than configured."
 }
}

Answer 1

We have a partial resolution to this.

Issue Summary:

• API returns '403 Request rate higher than configured' on certain requests, even after no requests are made for a long period of time (12+hrs) to a single domain.
• Attempting to use a different Client ID or and user return the same error code. It also impacts the API Explorer.

Cause:

• Certain operations can trigger a "black-listing" of a domain (not an application) for abuse. There may be undocumented limits on specific operations within a time period.

Resolution:

• Support receive a notification of this blacklisting and can remove the flag.

---

In our case we were likely adding too many members to too many groups in a 24 hour period and triggered an undocumented limit (support couldn't tell me what the limit was). We're still waiting for the black-listing to be removed from our domain.

This problem does raise additional questions however:

• The API limit documentation https://developers.google.com/admin-sdk/directory/v1/limits does not appear to be complete. There appears to be additional limits that can trigger a "domain" black-list. What are these limits?
• Why does a Google Apps Domain become black-listed rather than the application making the requests?
• Why aren't the Domain Administrator's notified of a black-listing of their domain?