[kiettv]

Do you have reversed proxy in front of your API like HA Proxy or Nginx, most of bots will hit you by IP only, so filter and reject request without domain will be eliminate most of them.

[marginalia_nu]

This was a directed attack, not some random drive-by.