Sliding-Window Rate Limiter
Reported by candidates from Amazon's online assessment. Pattern, common pitfall, and the honest play if you blank under the timer.
The Amazon OA reported in September 2026 hinges on one data structure: a per-user queue of accepted timestamps. That's the whole problem. Requests arrive sorted, each user gets a 60-second window, and 100 accepted requests is the cap. It's a sliding-window rate limiter, and the boundary is where people lose points. If you blank on the eviction rule during the assessment, StealthCoder runs invisibly on your desktop and gives you a working solution in real time. Know the shape first, though, because it's short.
The problem
You receive requests in nondecreasing timestamp order. Each request has a user ID and an integer timestamp in seconds. A request is accepted when that user has fewer than 100 previously accepted requests in the interval (timestamp - 60, timestamp]. Otherwise it is rejected. Rejected requests do not consume capacity. Requests with the same timestamp are processed in input order. Return one boolean per input request, where true means accepted and false means rejected. Function applySlidingWindowRateLimit(userIds: String[], timestamps: int[]) → boolean[] Examples Example 1 userIds = ["amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy","amy"] timestamps = [10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10,10] return = [true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,true,false] The first 100 requests for amy fill the window. The 101st request has the same timestamp and is rejected. Example 2 userIds = ["a","b","a","a"] timestamps = [0,0,59,60] return = [true,true,true,true] Users have independent windows. At timestamp 60, the accepted request for a at timestamp 0 lies on the excluded lower boundary and has expired. Constraints 0 <= userIds.length <= 5000. userIds.length == timestamps.length. User IDs contain 1 to 50 lowercase English letters or digits. 0 <= timestamps[i] <= 10^9. Timestamps are nondecreasing.
Reported by candidates. Source: FastPrep
Pattern and pitfall
Keep a hash map from user ID to a deque of accepted timestamps. For each request, pop from the front while the front is less than or equal to timestamp - 60. The interval is (timestamp - 60, timestamp], so a request at exactly t-60 has expired. Example 2 tests this with a at 0 and 60. After eviction, if the deque size is under 100, push the timestamp and return true. Otherwise return false and push nothing. The classic pitfall is recording rejected requests, which burns capacity the statement says they don't use. The second is using < instead of <= on eviction. Timestamps are nondecreasing, so a plain queue works with no sorting and no binary search. Total work is O(n) amortized. If you freeze on the boundary logic live, StealthCoder is your hedge, but this one is easy to write cold.
Drill it cold or hedge it with StealthCoder. Either way, don't walk into the OA hoping you remember the trick.
You can drill Sliding-Window Rate Limiter cold, or you can hedge it. StealthCoder runs invisibly during screen share and surfaces a working solution in under 2 seconds. The proctor sees the IDE. They don't see what's behind it. Made for the candidate who got the OA invite this morning and has 72 hours, not six months.
Get StealthCoderRelated leaked OAs
You've seen the question.
Make sure you actually pass Amazon's OA.
Amazon reuses patterns across OAs. Made for the candidate who got the OA invite this morning and has 72 hours, not six months. Works on HackerRank, CodeSignal, CoderPad, and Karat.
Sliding-Window Rate Limiter FAQ
What's the trick in the Amazon sliding-window rate limiter problem?+
Use a hash map of user ID to a queue of accepted timestamps. Evict from the front while the timestamp is at most current minus 60, then check if the size is under 100. Only accepted requests get pushed. That's the full solution.
How hard is this OA question really?+
Easy to medium. There's no clever algorithm, just a queue and careful boundary handling. Most failures come from the off-by-one on the window edge or from counting rejected requests. With n up to 5000, even a naive scan passes, but the queue is cleaner.
Is the window inclusive or exclusive at 60 seconds?+
The window is (timestamp - 60, timestamp], so the lower edge is excluded. A request at time 0 is expired by time 60. Example 2 shows this: user a at 0 and again at 60 are both accepted because the first has aged out.
Do rejected requests count toward the limit?+
No. Rejected requests don't consume capacity, so never add them to the queue. If you push every request, you'll reject valid ones later in the stream. Only append the timestamp when you return true.
How do I prepare for this in 48 hours?+
Write the deque-per-key version from scratch twice. Then test the edges: 100 requests at the same timestamp, the 101st rejected, a request exactly 60 seconds later, and multiple users interleaved. Empty input should return an empty array. That covers what this problem checks.