Appearance
Rate limiting
Available from v10.0.0
Rate limiting protects the API against too many calls and against guessing credentials. The limits are set in the rate limiting settings and are counted per minute.
| Name | Description |
|---|---|
| Requests per minute per member | The maximum number of calls per minute of a webservice member. A member can have its own limit on the member page. Default: 0 (no limit) |
| Requests per minute per IP without credentials | The maximum number of calls per minute of an IP address on public endpoints, without a member. Default: 0 (no limit) |
| Failed authentications per minute per IP | After this number of failed authentications in a minute, every call with credentials from that IP address, including a login on the Auth API, gets a 429 until the minute is over. Every 401 with credentials counts as a failed authentication, also an expired session, and a wrong reset code as well. This protects the shortkeys, secrets and passwords against guessing. Default: 10 |
Per member
On the edit page of a member, Requests per minute overrides the default of the settings for that member. Leave it empty to use the default, 0 is no limit.
A member is counted by its webservice member, so all its shortkeys, its key/secret and its sessions share one limit. A Super Admin that is not added in the module is counted with the default limit. All members of a role share the one limit of that role.
The endpoints of the Auth API and a public endpoint called without credentials are counted per IP address, with Requests per minute per IP without credentials.
Response
A call over the limit gets the HTTP status 429 and is not run:
json
{"success":false,"message":"Too many requests, try again later"}After too many failed authentications the message is Too many failed authentication attempts, try again later.
Every call with a limit has these headers:
| Header | Description |
|---|---|
X-RateLimit-Limit | The calls per minute |
X-RateLimit-Remaining | The calls left in this minute |
X-RateLimit-Reset | The Unix timestamp when the next minute starts |
Retry-After | Only on a 429: the seconds until the next minute starts |
The 429 calls are in the API logs and count as an error in the endpoint statistics.
TIP
The minute is a fixed window: the counter starts again at the start of every minute. A client that sends all its calls at the end of one minute and the start of the next can make up to twice the limit in a short time.