AshwiniM.34323 (Customer) asked a question.
Why are we getting rate limiting warning of the /sage/api/v1 API for?
We have received 2 warnings for rate limiting warning of the /sage/api/v1 API.
As we understand from https://support.okta.com/help/s/article/What-is-the-rate-limiting-warning-of-the-sage-api-v1-API-for?language=en_US and https://support.okta.com/help/s/question/0D51Y00006ckAa0SAE/systemorgratelimitwarning?language=en_US that this is caused when 60% or more calls are made to system log okta API either via system log UI or directly via hitting the endpoint.
But, based on the data provided in the limit warning of Actor etc, the user hasn't performed any such action. Can you let us know what else could cause these warning? That will help us debug this better.
You should open a case with Okta support. That endpoint should only be hit when someone runs multiple searches from the system log very quickly. If you don't believe the user identified is doing that then something odd is definitely happening. Does it continue to happen, or did it just happen twice?