I am trying to set rate limits for an endpoint which is accessed via an API token as a HTTP header. In order to protect the stability of the service, I want to set two distinct API rate limits: I want to reject the request if either a user is making more than 60 requests per minute, or if the total number of request across all users exceeds 60 requests per minute.

This is what I’ve come up with for the Envoy config:

- actions:
  - request_headers:
      header_name: "x-api-token"
      descriptor_key: "x-api-token"
  - request_headers:
      header_name: ":path"
      descriptor_key: "path"

domain: my_app
descriptors:
  - key: path
    value: /my/endpoint
    descriptors:
      - key: x-api-token
        rate_limit:
          unit: minute
          request_per_unit: 60
  - key: path
    value: /my/endpoint
    rate_limit:
      unit: minute
      requests_per_unit: 600

However, my understanding is that this would not work since Envoy would not apply both rules. Instead, it will just apply the first rule that matches. In this case, that means that only the first rate limit (the per-user one) would get applied, thus nullifying the second one. Is that correct? In that case, how could I achieve a situation where both rate limit rules are applied and the request is only allowed through if it can make it through both rules?