Failure Rate Limiting for OAuth Token endpoint call

Products

• CA API Gateway

Issue/Introduction

We use OTK Version 4.6.0-6588.  

Looking for a rate limit on failure scenarios

Is there a way to block client_id's when they make multiple requests inside a predetermined period of time in which they get auto blocked?”

Environment

Gateway 11.x OTK 4.6

Resolution

We do not have out-of-box way to handle rate limit failure assertion.  Possible to create your own custom policy to handle the scenario 

Basically this is what PKCE was designed to avoid