OTP Flood Attack mitigation

use the Microservice feature under bot profile.

https://support.f5.com/csp/article/K42323285#sect3

either use the predefined Treat protection like login Protection,Search Protection etc or

use Custom Microservice Protection

set a proper threshold under automate threat detection and mitigation action .

other way create custom signature or bot signature which matches the attacker user agent (if it is something fissy)