Freight Rates Partner API

A freight company is opening its shipping-rates service to about three hundred partner companies. Each partner's software calls the API server-to-server, so partners must authenticate as machines using OAuth client credentials rather than as people. Every partner gets a daily quota and a request-rate limit according to its contract, and one misbehaving partner must never be able to overwhelm the service for the others. The security team insists that common web attacks such as SQL injection are blocked before requests reach the application. Rates are computed from a table of lanes and prices looked up by origin and destination, and traffic is spiky enough that nothing should need capacity planning.