feat(ipa0114): Add rate limiting guidelines to errors IPA

ipa/general/0114.md

@@ -59,6 +59,26 @@ are treated as `404 Not Found` rather than `400 Bad Request`.
 
 :::
 
+### Rate Limiting
+
+- APIs **must** document the `429 Too Many Requests` status code for endpoints
+  that implement rate limiting.
+- APIs **must** return `429 Too Many Requests` when a client exceeds the allowed
+  request rate.
+- APIs **should** include the `Retry-After` HTTP response header when returning
+  `429 Too Many Requests` to indicate how long the client should wait before
+  retrying the request.
+  - The `Retry-After` header value **must** be expressed as time in seconds
+    until the next request can be made.
+- APIs **should** include rate limit information in response headers to help
+  clients manage their request rates proactively:
+  - `RateLimit-Limit`: The maximum number of requests allowed in the current
+    rate limit window
+  - `RateLimit-Remaining`: The number of requests remaining in the current rate
+    limit window
+
+:::
+
 ### API Error Format
 
 ```json