BUG | Rate Limit by IP

I have this simple configuration as my rate limiting rule. Somehow that rule is not blocking by IP, the whole /api endpoint, and even people who didn't make any call to the API, the response they receive is a 429.

Can someone explain me what is happening?