REST_Controller - limits & levels?

Levels are basically permissions. So you would check that the API Key/User has permission (correct level) to perform that particular method (or even in the entire class).
The default level is 1 (or 0, I'd have to look at the code again) but if you're not actively setting levels, the library assumes you're not using permissions and sets it to something low.

Limits are the number of calls which can be called on a method in an hour.

Enliven Applications - Open Blog is now Pubvana - CI4 Tutorials