Hold meeting to discuss "code yellow" options for throttling API traffic

[lbeaufort]

User story: As an API user, I would like to retain my access to the API, so that I can continue to do my job.

See original "code red"/nuclear option #4301

For "code yellow" AKA allow power users access during emergency access restriction?

Pros

• Fewer things to worry about in outage: not hearing from power users while trying to diagnose the problem
• User-friendly: treats API users with same access privelige as front-end users

Cons

• Maintenance: Introduces human error, somewhat tedious to maintain (can only add key ID’s, list is long, just a big string in env var). How will we keep it up to date?
• Diagnostics: Make diagnostics a little harder - what if power user is causing issues? Less predictable (what if a media outlet for example has multiple keys and we only allowed one?)
  (edited for formatting)

Completion criteria:

• Hold a meeting to discuss this option, document discussion (Must attend: Amy, Paul, Pat, Wei)
• Determine whether this is appropriate for our needs

[lbeaufort]

We could implement this with Roles so it's less cumbersome https://api-umbrella.readthedocs.io/en/latest/admin/api-backends/role-restrictions.html
https://github.com/18F/api.data.gov/wiki/User-Manual:-Agencies#defining-custom-settings-for-specific-urls-or-specific-types-of-requests
https://github.com/18F/api.data.gov/wiki/User-Manual:-Agencies#embedding-the-api-key-signup-form-on-your-own-documentation-site

[patphongs]

We've decided to no longer pursue this strategy. Closing this ticket.