Rest Controller and API Rate Limits or how to set CSRF token invalid

Question

Problem: I have a JSON endpoint and like to limit access to it. I.e. to prevent double submits on contact forms or brute force attempts.

One solution that came to my mind was rate-limiting the requests, but I did not find a Craft way to archive this with my controllers.

Another idea was to set the CSRF token to invalid after X requests. Any help would be highly appreciated.