We are using the Companies House API to do nightly jobs for checking our customer portfolio for material changes in their structure / filing history etc.
As part of this we make a few thousand requests in a fairly short window, and have noticed we get 403 errors coming back from the API as opposed to the expected 429 for rate limit violations.
Having read the forums, it sounds like there may be some DDOS protection going on in front of the rate limiting logic on your side? And it is recognising our IP address as a threat and denying it before it even gets to the application layer.
Also noted on the forums is the ability to provide our IP address and have this added to an allow list to circumvent these issues. Is this something you could do for us?