Rate limits on webhook operations

Tier: Free, Premium, Ultimate
Offering: GitLab Self-Managed, GitLab Dedicated

Rate limit for webhook testing introduced in GitLab 17.0 with a flag named web_hook_test_api_endpoint_rate_limit. Enabled by default.
Rate limit for webhook event resends introduced in GitLab 17.1 with a flag named web_hook_event_resend_api_endpoint_rate_limit. Enabled by default.
Customizable rate limits introduced in GitLab 19.3. Feature flags web_hook_test_api_endpoint_rate_limit and web_hook_event_resend_api_endpoint_rate_limit removed.

Configure the per-minute rate limit for requests that:

Limit	Default
Webhook test requests	5 each minute
Webhook event resend requests	5 each minute

Each rate limit applies per user, for a given project or group, and covers both the UI and the API. All webhooks in the same project or group share the limit.

These limits are separate from the webhook delivery rate limit, which limits how often webhooks can be triggered. Configuring webhook delivery rate limits depends on the type of instance:

On GitLab Self-Managed, administrators configure it with the Plan limits API.
On GitLab.com, the delivery limit depends on your plan and cannot be changed.

For example, if you set the webhook test rate limit to 5 and try to test a webhook six times in a minute, the final request is blocked. After a minute, you can test the webhook again.

Change the rate limit

Prerequisites:

Administrator access.

To change the rate limit:

In the upper-right corner, select Admin.
In the left sidebar, select Settings > Network.
Expand Webhook rate limits.
Set values for the available rate limits. Enter 0 to disable a rate limit.
Select Save changes.

Requests that exceed the rate limit are logged to the auth.log file.