Understand API rate limiting
Automation orchestrator provides per-user rate limiting for inbound REST API requests.
Inbound API rate limiting
You can configure rate limits for inbound REST API requests. Rate limits protect your deployment from excessive traffic by individual users.
By default, rate limiting is not enabled. When you configure a rate limit, it applies per user. Service account requests authenticated with bearer tokens are rate-limited by client IP address, not by service account identity.
Administrator users are exempt from rate limiting.
Rate limit response headers
When rate limiting is configured, every API response includes the following headers:
| Header | Description |
|---|---|
X-RateLimit-Limit |
The maximum number of requests permitted in the current time window. |
X-RateLimit-Remaining |
The number of requests remaining in the current time window. |
X-RateLimit-Reset |
The time, in seconds, until the rate limit window resets. |
Rate limit exceeded responses
When a user exceeds their rate limit, the API returns a 429 Too Many Requests response. The response includes a Retry-After header indicating the number of seconds to wait before retrying. The response body uses the RFC 9457 (Problem Details for HTTP APIs) format.
Per-organization and per-endpoint rate limits are not available in this release.
Upstream rate limit error handling
When an external tool provider returns an HTTP 429 response during workflow execution, automation orchestrator classifies it as a rate limit error. The retryable field is set to true, and the built-in retry logic applies exponential backoff. You do not need to implement retry logic in your workflow definitions for upstream rate limit handling.