Is there a way to specify dynamic "weight" for a throttle?

[severin]

I'm trying to rate-limit our login by IP address. Login is possible via traditional REST endpoint but also via GraphQL mutation. I have no trouble to set up a throttle that works with requests to the REST endpoint and GraphQL queries that contain a single login mutation.

However, with GraphQL you can include multiple mutations in a single http request. So if I want to throttle login attempts to 5 per IP per minute someone could submit a single GraphQL request that contains 6 login mutations. Is it possible that I can somehow count this single http request as 6 attempts?