Host execution turns an interactive request into browser → API host → target API traffic. Treat that as real CPU, memory, socket, DNS/TLS, bandwidth and target-service load.
FlexDoc's transport safety policy is not a per-user abuse policy. Production deployments should apply caller-aware rate limiting, bound concurrent execute requests, reject overload before unbounded queueing, and monitor execute traffic separately from ordinary documentation requests.
const admission = createHostExecutionAdmission({ maxInFlight: 16 });
app.use('/docs', requireDocumentationUser);
app.use('/docs/__flexdoc/execute', requireSameOriginOrCsrfToken);
app.use(
'/docs/__flexdoc/execute',
createHostExecutionAdmissionMiddleware(admission, { retryAfterSeconds: 1 }),
);
The Spring starter similarly exports FlexDocHostExecutionAdmissionFilter; 16 concurrent execute requests per process is the shipped reference starting point, with HTTP 429 and Retry-After: 1 on saturation.
The shared JVM executor has fixed last-resort ceilings of 64 transport workers, 256 queued executions, 256 total Apache connections and 256 connections per route. Those are resource-safety ceilings, not recommended application concurrency.
For multi-replica deployments, user/session quotas belong in a shared gateway or distributed limiter. Useful signals include accepted/rejected requests, in-flight count, p95/p99 duration, timeout/DNS/policy/upstream errors, body sizes, outbound connections/egress, CPU and RSS/PSS.
