We are doing some work to block excessive bots. We are throttling requests based on IP. In the past, using IIS, we have returned a 503 error to the client. Someone suggested that a 429 is more appropriate. I am trying to figure out which one I should use and why. When I searched this site for 429, I found nothing.
I found these definitions of HTTP Status Codes on Wikipedia:
429 Too Many Requests The user has sent too many requests in a given amount of time. Intended for use with rate limiting schemes.
503 Service Unavailable The server is currently unavailable (because it is overloaded or down for maintenance). Generally, this is a temporary state.
It seems that the 429 is more appropriate to serve to an offending bot. Is this correct?