What is a common mistake with rate limiting and resilience in Web API?

Applying one global limit without considering user, endpoint, or workload characteristics can block legitimate traffic or fail to protect hotspots.