Issue Summary

The REST APIs for creating, deleting and updating a rate limiting exemption work with the system service user.

Steps to Reproduce

1. Create a rate limiting exemption for the system service user via the REST API (using a user with ADMIN permission to authenticate the request).
2. Optionally also observe behaviour retrieving and deleting the created exemption.

Expected Results

Attempting to create, delete or get a rate limiting exemption for any service user (including the system service user) returns a 404 Not Found.

Actual Results

A rate limiting exemption is created for the system service user. This causes some minor UI bugs when attempting to interact with it (updating the exemption in the UI uses the bulk update REST endpoint which already correctly filters out the system service user), and doesn't make sense conceptually since a service user can not authenticate with the application.

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available