If you're trying to put people off abusing it, wouldn't randomly failing make the situation worse? People will just code apps to try the request again until it doesn't. It'd be like inviting people to DDoS your API. So long as the display bit is asynchronous then the user will just see a spinner until it's worked and the results are sent across.