The suggestion to Yii2 core team is to design RateLimiter filter good enough not only for API calls, but to make it more reusable in simple controllers.

[gauravpatel1110]

Here is the use case:

Limit number of API calls globally - 5 requests/second
Limit number of API calls for action1 - 30 requests/minute
Limit number of API calls for action2 - 60 requests/minute

Limit number of successfull user registrations (action /register) - 1/hour
Limit number of failed user logins (action /login) - 5 requests/15 minutes
Add possibility to have 1 shared limit for several actions

Make This With FileCache.

[tyler-ham]

I just published an advanced rate limiter that I've been working on and using for a while:
https://github.com/thamtech/yii2-ratelimiter-advanced

I believe it would meet the requirements of the use case you describe.

[samdark]

Rate limiter should be implemented as middleware.

[kamarton]

I would recommend separate the actual counting unit and using it anywhere in the code, eg sending SMS limit.

[samdark]

This one is now done.