To find the maximum number of REST transactions:
Go to the stats.do page of the instance. You can use the API_INT semaphore set, and find the value for queue_depth_limit*available_semaphores.
In case you are worried of the max number of simultaneous requests without provoking an attack alert, you can counter this risk by setting up a Rate Limit Rule. You can define the max number of REST queries that are expected from that user. More information here: