How to protect against API Abuse?

Thanks @thameera,

Is there a possibility that a user could send GET or PATCH requests to the User Management API using cURL and trigger the rate limit that way? If so, how could one protect against that scenario?