hCaptcha risk scores: API endpoint rate limiting
Closed, ResolvedPublic0.5 Estimated Story Points
Actions

Assigned To

Authored By

	• hector.arroyo
	May 12 2026, 2:22 PM

Project Tags

Referenced Files

None

Subscribers

Aklapper

• hector.arroyo

Description

Summary

Add rate limiting to the action=hcaptchariskscore API endpoint to prevent abuse.

Technical notes

We could use the pattern used in CheckUser's UserInfoHandler as a reference.

Acceptance Criteria

The endpoint is rate-limited via MW ApiBase rate limiting

Details

Related Changes in Gerrit:

	Subject	Repo	Branch	Lines +/-
	hCaptcha: Endpoint for collecting risk scores	mediawiki/extensions/ConfirmEdit	master	+1 K -25

Customize query in gerrit

Related Objects
Search...

		Status	Subtype	Assigned	Task
		In Progress		• hector.arroyo	T424629 [epic] WE4.10.5 hCaptcha risk scores for blocked edit notices
		Resolved		• hector.arroyo	T426072 hCaptcha risk scores: API endpoint rate limiting

Event Timeline

• hector.arroyo created this task.May 12 2026, 2:22 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMay 12 2026, 2:22 PM

• hector.arroyo updated the task description. (Show Details)May 12 2026, 2:23 PM

• hector.arroyo set the point value for this task to 0.5.

• hector.arroyo added a parent task: T424629: [epic] WE4.10.5 hCaptcha risk scores for blocked edit notices.

• hector.arroyo moved this task from Backlog to Ready on the Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)) board.Wed, May 20, 9:00 PM

• hector.arroyo changed the task status from Open to In Progress.Thu, May 21, 2:47 PM

• hector.arroyo claimed this task.

• hector.arroyo moved this task from Ready to In progress on the Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)) board.

• hector.arroyo added a project: ConfirmEdit (CAPTCHA extension).

Change #1290031 had a related patch set uploaded (by Harroyo-wmf; author: Harroyo-wmf):

[mediawiki/extensions/ConfirmEdit@master] hCaptcha: Endpoint for collecting risk scores

https://gerrit.wikimedia.org/r/1290031

gerritbot added a project: Patch-For-Review.Thu, May 21, 3:19 PM

Done as part of T426068: hCaptcha risk scores: New API endpoint for collecting risk scores per reviewer's request: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ConfirmEdit/+/1290031

• hector.arroyo moved this task from Backlog to In progress on the Bot detection and mitigation (WE4.10 hCaptcha) board.Thu, May 21, 3:20 PM

• hector.arroyo moved this task from Backlog to Awaiting Code Review on the ConfirmEdit (CAPTCHA extension) board.

• hector.arroyo moved this task from In progress to Needs review on the Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)) board.

• hector.arroyo added a project: hCaptcha.Thu, May 21, 5:03 PM

OKryva-WMF edited projects, added: Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)); removed: Product Safety and Integrity (Sprint lily-of-the-valley (May 4 - May 22)).Mon, May 25, 12:40 PM

OKryva-WMF moved this task from Backlog to Needs review on the Product Safety and Integrity (Sprint Iris (May 25 - Jun 12)) board.Mon, May 25, 12:41 PM

Change #1290031 merged by jenkins-bot: