I've searched Google and the Twitter documentation for a very straightforward answer for how the following scenario would play out. Specifically, I'm wanting to understand how Twitter's rate limiting works on a "per user" and "per app" basis. Can someone take a look at the example below and explain to me what would happen. And please don't just refer me to a Twitter documentation URL! Thanks in advance.
Example:
The "GET friends/list" API call is currently limited to 15/user and 30/app within the 15 minute window (See https://developer.twitter.com/en/docs/accounts-and-users/follow-search-get-users/api-reference/get-friends-list).
If I have 4 users who all make the "GET friends/list" API call 10 times each within a 15 minute window (i.e. 40 calls made) does that mean I violate the 30/app limit? I'd still be within my limits for each of my 4 users, but do their individual calls eat away at the app limit too? Or is the app limit entirely separate and related solely to my app's token/secret?
The number of users (aka user tokens for your app that you've saved in your app store/config) give you that many times the specified per user limit (different for different APIs) for your app.
In your example, you're well within your limit if you make 10 calls per 15 minutes per user to the 'GET friends/list' API call since you have 60 (4 X 15) calls you can make per 15 minutes.
App limit applies if you don't have user tokens via user authZ/consent and are calling in application context only.
You should try your scenario with a 15 minute sleep after iterating over the 4 users and making 10 (upto 15) calls each in the user context (on the user's behalf) and you'll see that all works fine.