What is rate Limiting api bug?

This vulnerability type is made possible because endpoints that serve data can be called upon many times per second by users/attackers. If the user/attack requests so data so many times the system can no longer keep up and starts consuming all of its resources this can even lead to a DoS (Denial Of Service) attack but the consequences might be even greater than that on certain authentication endpoints which might open the API up to forgotten password reset token brute forcing.Request forgot password Gmail otp to mail & Intercept the request of endpoint and send to intruder then do attack maybe 26–30 time and get 200 ok then its bug & get 429&404 then it’s not bug. Also see video:-https://youtu.be/UhyZNLIU4X4Some bug report :- 1-https://hackerone.com/reports/1331268 2-https://hackerone.com/reports/751604 3-https://hackerone.com/reports/297359 4-https://hackerone.com/reports/1067533