正式なドキュメントは英語版であり、この日本語訳はAI支援翻訳により作成された参考用のものです。日本語訳の一部の内容は人間によるレビューがまだ行われていないため、翻訳のタイミングにより英語版との間に差異が生じることがあります。最新かつ正確な情報については、英語版をご参照ください。
ドキュメントに関する現在のご利用体験についてお聞かせください。アンケートにご協力ください。

Rate limits

  • Tier: Free, Premium, Ultimate
  • Offering: GitLab Self-Managed, GitLab Dedicated

For GitLab.com, see GitLab.com-specific rate limits.

For GitLab Dedicated, see Authenticated user rate limits.

Rate limiting is a common technique used to improve the security and durability of a web application.

For example, a simple script can make thousands of web requests per second. The requests could be:

  • Malicious.
  • Apathetic.
  • Just a bug.

Your application and infrastructure may not be able to cope with the load. For more details, see Denial-of-service attack. Most cases can be mitigated by limiting the rate of requests from a single IP address.

Most brute-force attacks are similarly mitigated by a rate limit.

The rate limits for API requests do not affect requests made by the frontend, because these requests are always counted as web traffic.

Configuration options

You can set most rate limits in the Admin area. Some are available only through the API or the Rails console, and you set the GitLab Pages rate limits in a configuration file.

Admin area

You can set these rate limits in the Admin area of your instance:

API and Rails console

You can set these rate limits with the application settings API:

  • Autocomplete users rate limit
  • AI action (ai_action_api_rate_limit): 160 calls per 8 hours per authenticated user. Applies to the GraphQL aiAction mutation.
  • Create tag rate limit (tags_create_limit): 100 requests per 30 minutes per project. Applies to the REST API endpoint for creating a tag, the GraphQL tagCreate mutation, tag creation in the UI, and the /tag quick action.

You can set this rate limit with the plan limits API or the Rails console:

Configuration file

You can set these rate limits only in the configuration file for your installation, for example /etc/gitlab/gitlab.rb in a Linux package installation:

Non-configurable limits

Some rate limits cannot be configured. For a list of these limits, see non-configurable rate limits.

Bans and blocks

Some protections block a client for a period of time instead of slowing requests down. For more information, see abuse and failed authentication bans.