This approach is not very realistic. 1. API design and auth takes engineering time and potentially brings more traffic you need to pay for. 2. You don't have an email address to send "back off" to. Even if you had, no enforcement means no change. 3. Blocking / throttling takes much less time and money than creating a new endpoint.