Authentication API: Rate limits for the Authentication API and API endpoints in the Private Cloud Performance 500 RPS (5x) subscription type.
Authentication API: Rate limits for the Authentication API and API endpoints in the Private Cloud Performance 500 RPS (5x) subscription type.
| Endpoint | Method | Burst Limit | Sustained Limit | Limit Type |
|---|---|---|---|---|
| Authentication API | — | 100 | 100/second | Global |
| User Info | GET, POST | 10 | 5/minute | Per User |
| Change Password / Reset Password | POST | 10 | 1/minute | Per IP + Email |
| Get Passwordless Code or Link | GET, POST | 50 | 50/hour | Per IP |
| Native Social Login (Apple / Facebook) | POST | 50 | 500/minute | Global |
| Dynamic Application Registration | POST | 5 | 5/second | Global |
| Universal Logout | POST | 35 | 35/second | Global |
| Pushed Authorization Requests (PAR) | POST | 100 | 100/second | Global |
| Back-Channel Authorize (CIBA) | POST | 500 | 500/minute | Global |
| Device Code Activation (no prompt) | POST | 30 | 6/second | Global |
| Device Code Authorization | POST | 5 | 5/second | Global |
| MFA OOB Token Exchange | POST | 12 | 12/minute | Global |
| Custom Token Exchange | POST | 15 | 15/second | Global |
| Write Token Exchange Profiles | POST, PATCH, DELETE | 5 | 100/second | Global |
| Read Token Exchange Profiles | GET | 20 | 200/second | Global |
| Delegation | POST | 10 | 1/minute | Global |
Management API: Rate limits for the Management API, API endpoints, and API endpoint groups in the Private Cloud Performance 500 RPS (5x) subscription type.
Management API: Rate limits for the Management API, API endpoints, and API endpoint groups in the Private Cloud Performance 500 RPS (5x) subscription type.
| Endpoint | Method | Burst Limit (RPS) | Sustained Limit (RPM) |
|---|---|---|---|
| MGMT API Prod | — | 250 | 15,000/minute |
| Organizations Read | GET | 50 | 500/minute |
| User Organizations Read | GET | 200 | 2,500/minute |
| Organizations by Name Read | GET | 100 | 1,000/minute |
| Organizations Write | POST | 25 | 750/minute |
| Org Members Read | GET | 200 | 2,500/minute |
| Org Members Write | POST | 100 | 1,000/minute |
| Org Invitation Read | GET | 100 | 1,000/minute |
| Org Member Roles Read | GET | 100 | 1,000/minute |
| Org Member Roles Write | POST | 100 | 1,000/minute |
| Org Connections Read | GET | 50 | 500/minute |
| Org Connections Write | POST | 25 | 750/minute |
| Org Client Grants Read | POST | 50 | 500/minute |
| Org Client Grants Write | POST | 25 | 750/minute |
| Clients Read Q Query | GET | 25 | 750/minute |
| Extensions Read | GET | 25 | 750/minute |
| Token Exchange Profiles Read | POST | 100 | 1,000/minute |
| Token Exchange Profiles Write | POST | 15 | 300/minute |
| Users Search | GET | 150 | — |
| Users Write | POST | 100 | 5,000/minute |
| Effective Roles Read | GET | 50 | 500/minute |
| Effective Permissions Read | GET | 50 | 500/minute |
SCIM API: Rate limits for the inbound SCIM API endpoints in the Private Cloud Performance 500 RPS (5x) subscription type.
SCIM API: Rate limits for the inbound SCIM API endpoints in the Private Cloud Performance 500 RPS (5x) subscription type.
| Endpoint Path | Operation | Limit | |
|---|---|---|---|
| Single SCIM connection endpoint | /scim/v2/connections/{connection-id} | Any request | 25 requests per second |
| Global tenant limit for all SCIM connections | /scim/v2/connections/* | Any request | 250 requests per second |
Universal Login Flow Endpoints: Rate limits for the endpoints utilized for the Universal Login Authentication Flow for all subscription types.
Universal Login Flow Endpoints: Rate limits for the endpoints utilized for the Universal Login Authentication Flow for all subscription types.
| Endpoint | Method | Burst Request Limit | Sustained Request Limit |
|---|---|---|---|
| Universal login prompts (global) | GET, POST | 500 | 500/minute |
| Universal login prompts (per prompt) | GET | 20 | 10/minute |
| Universal login prompts (per prompt) | POST | 10 | 5/minute |
| Password reset prompt | GET | 500 | 500/minute |
| MFA push enrollment prompt | GET, POST | 500 | 500/minute |
| MFA push challenge prompt | GET, POST | 500 | 500/minute |
| MFA SMS enrollment prompt | GET | 20 | 10/minute |
| MFA SMS enrollment prompt | POST | 10 | 5/minute |
| MFA SMS enrollment verify prompt | GET | 20 | 10/minute |
| MFA SMS enrollment verify prompt | POST | 10 | 5/minute |
| Passwordless SMS challenge prompt | GET, POST | 5 | 5/minute |
| Passwordless email challenge prompt | GET, POST | 5 | 5/minute |
| Phone verification enrollment prompt | GET, POST | 5 | 5/minute |
| Phone verification challenge prompt | GET, POST | 5 | 5/minute |
| Device code prompt | GET, POST | 5 | 5/second |
Additional MFA rate limits: Additional MFA rate limits.
Additional MFA rate limits: Additional MFA rate limits.
| Endpoint | Method | Burst Limit (RPS) | Sustained Limit (RPM) |
|---|---|---|---|
| Global Guardian by Tenant | — | 250 | — |
My Organization API
My Organization API
| Endpoint | Method | Burst Limit (RPS) | Sustained Limit (RPM) |
|---|---|---|---|
| Global Limit | — | 20 | — |
Server API
Server API
| Endpoint | Method | Burst Limit (RPS) | Sustained Limit (RPM) |
|---|---|---|---|
| Global Protection by Tenant | — | 500 | — |
| Global by Prod Tenant | — | 500 | — |
| Authorize (Prod) | — | 500 | — |
| Authorize (Dev) | — | 250 | — |
| Token Revocation (Prod) | POST | 125 | — |
| OAuth Custom Token Exchange | POST | 75 | — |
| ROPG (Prod) | POST | 180 | — |
| Token Vault Global | — | 240 | — |
DX Flows API
DX Flows API
| Endpoint | Method | Burst Limit (RPS) | Sustained Limit (RPM) |
|---|---|---|---|
| Global Limit | — | 250 | — |
VC API Verifier
VC API Verifier
| Endpoint | Method | Burst Limit (RPS) | Sustained Limit (RPM) |
|---|---|---|---|
| Outer Create | POST | 10 | — |
| Outer Get | GET | 120 | — |
| Inner All | — | 30 | — |
| Conf All | — | 20 | — |