Yes, and keep it off the shared middleware so the rest of the API is untouched. A fixed window per workspace is enough here because the abuse is one tenant looping, not a thundering herd:

const WINDOW_MS = 60_000const LIMIT = 5
export async function POST(request: Request) {  const workspace = await requireWorkspace(request)  const { count, resetAt } = await bucket.hit(workspace.id, WINDOW_MS)
  if (count > LIMIT) {    return Response.json(      { error: "export_rate_limited", resetAt },      { status: 429, headers: { "retry-after": String(Math.ceil((resetAt - Date.now()) / 1000)) } },    )  }
  return startExport(workspace)}

retry-after matters more than the status here: the tenant's script backs off on it, and without it they retry immediately and you have the same load with extra 429s.

Five exports a minute is far above any human pace, so a legitimate hit means they are scripting it. The 429 body names the reset, so the fix is one sleep in their loop. Worth a line in the API docs rather than a support macro.