Are the "Concurrent API Request Limits" per org or per user?
A production org allows, at the time of writing, 25 concurrent API requests.
How do those limits get counted, organization wide or per user?
If more requests are made while the 10 long-running requests are still running, they’re denied.
Salesforce allows you to have a limit of 10 long running requests per ORG, where long running requests are defined as processes taking over 5 seconds. Once you have reached the limit of 10, Salesforce will block any other Apex request until one or more of the 10 long running requests finishes. There are no queues, as soon as the limit is reached, Salesforce throws the error (ConcurrentPerOrgApex Limit Exceeded) until the customer is below the limit.
You could have 9 Apex requests running for 10 minutes. The 10th comes in and runs for 30 seconds. 5 seconds into the 10th’s run, Salesforce will block any other long (over 5 seconds) Apex requests. As soon as one of the 10 long running requests frees up (in this example 25 seconds later) you can then start to process other long (over 5 seconds) Apex request.
Let’s suppose you have a large ORG with thousands of users and they are all using Apex code, and they all use the system throughout the day, you have times when there are thousands of Apex requests going on every second. But, if there is an admin in your company doing something that you are not aware of and they are using 3 long running Apex requests, and in your other running jobs, you have 7 that take just over 5 seconds and the rest take 0.1 seconds, you would not see the error.
Note: You can execute as many Apex request as you want without hitting the error, as long as none of those requests take over 5 seconds.
Concurrent Apex and Concurrent API limits are different.
Concurrent API limit : for production and sandbox it is 25 for 20 or more than 20 seconds, for example : (describe in 3 scenarios)
If you are receiving 25 separate API requests to create accounts at 10:30:10 PM (hh:MM:ss) and those requests will process till 10:30:50 PM, means it is running for 40 Seconds, in this scenario you will not get an error.
If you received 26th API at 10:30:20 PM (after 10 seconds of 25 API requests) and that will process till 10:30:35, which means 26th API takes 15 seconds only & those old 25 APIs are still on and already took 25 seconds (which is more than 20 seconds), in this scenario as well you will not get an error because only 25 API request are active for more than 20 seconds that 26th Request took only 15 seconds and 25 are allowed.
If you received 26th API at 10:30:20 PM (after 10 seconds of 25 API requests) and not completed at 10:30:39, so it will threw an error at 10:30:40 with Concurrent API limit error (I am not sure about exact error message).
Concurrent APEX limit : As Shanu suggested above, but still you can differentiate with below example
Now take an example of above 25 API requests, out of 25 API request 10 requests are using apex component for more than 5 seconds then 11th request cannot process over 5 seconds, 11th request will get an error after 5 seconds.