If your API receives 1 spam request a day its no biggie.

If it receives a few million (eg. via LOIC or whatever), its disabling.