Put a public echo service behind your gateway, require client credentials issued through Exchange, and cap traffic with a rate limit. Watch the 401 and 429 responses happen.