Skip to content

Conversation

@shahzadhaider1
Copy link
Contributor

Summary

Adds a new Prometheus gauge metric postman_api_monthly_requests_limit to capture the total monthly API request limit from Postman's RateLimit-Limit-Month response header.

Background

Postman's monthly API rate limit is shared between TruffleHog scanner usage and the customer's own direct API usage. Our existing alert tracks scanner usage (postman_api_requests) and remaining requests (postman_api_monthly_requests_remaining), but we couldn't distinguish between scanner and customer consumption when alerts fired.

Changes

  • Added postman_api_monthly_requests_limit gauge metric to metrics.go
  • Record the metric value in handleRateLimits from the RateLimit-Limit-Month header

This enables more actionable alerting--we can now identify whether high consumption is from our scanner (suggest increasing scan interval) or from the customer's own usage (advise them to reduce direct API calls).

Checklist:

  • Tests passing (make test-community)?
  • Lint passing (make lint this requires golangci-lint)?

@shahzadhaider1 shahzadhaider1 requested a review from a team January 14, 2026 13:35
@shahzadhaider1 shahzadhaider1 requested a review from a team as a code owner January 14, 2026 13:35
Copy link
Contributor

@mustansir14 mustansir14 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm concerned about the fact that apiMonthlyRequestsLimit is something that won't change in every request, but we're still setting the metric in every request. However, I don't see any way around this and since this is a very cheap call, I guess we're okay?

@shahzadhaider1
Copy link
Contributor Author

I'm concerned about the fact that apiMonthlyRequestsLimit is something that won't change in every request, but we're still setting the metric in every request. However, I don't see any way around this and since this is a very cheap call, I guess we're okay?

Good point, and yes, you answered it yourself--the limit is unlikely to change within a billing cycle. That said, setting a gauge is essentially a float64 assignment, so the overhead is negligible. I'd lean toward keeping it simple and consistent with how we handle apiMonthlyRequestsRemaining (which is also set on every request). Adding conditional logic to skip redundant sets would add complexity without meaningful performance benefit.

@shahzadhaider1 shahzadhaider1 merged commit b924c0b into trufflesecurity:main Jan 15, 2026
13 checks passed
@shahzadhaider1 shahzadhaider1 deleted the INS-203-add-more-metrics-to-postman-api-request-usage-alert branch January 15, 2026 18:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants