Rate limits

  • Tier: Free, Premium, Ultimate
  • Offering: GitLab Self-Managed, GitLab Dedicated

For GitLab.com, see GitLab.com-specific rate limits.

For GitLab Dedicated, see Authenticated user rate limits.

Rate limiting is a common technique used to improve the security and durability of a web application.

For example, a simple script can make thousands of web requests every second. The requests could be:

  • Malicious.
  • Apathetic.
  • Just a bug.

Your application and infrastructure may not be able to cope with the load. For more details, see Denial-of-service attack. Most cases can be mitigated by limiting the rate of requests from a single IP address.

Most brute-force attacks are similarly mitigated by a rate limit.

The rate limits for API requests do not affect requests made by the frontend, because these requests are always counted as web traffic.

Configuration options

You can set most rate limits in the Admin area. Some are available only through the API or the Rails console, and you set the GitLab Pages rate limits in a configuration file.

Admin area

You can set these rate limits in the Admin area of your instance:

API and Rails console

You can set these rate limits with the application settings API:

  • Autocomplete users rate limit
  • AI action (ai_action_api_rate_limit): 160 calls every 8 hours for each authenticated user. Applies to the GraphQL aiAction mutation.
  • Create tag rate limit (tags_create_limit): 100 requests every 30 minutes for each project. Applies to the REST API endpoint for creating a tag, the GraphQL tagCreate mutation, tag creation in the UI, and the /tag quick action.
  • CSV import rate limit (issuable_csv_import_limit): 20 imports every hour for each authenticated user. Applies to importing issues, work items, and requirements from CSV, in the UI and through the workItemsCsvImport GraphQL mutation. The limit is shared between them. Introduced in GitLab 19.6 with a flag named issuable_csv_import_rate_limit. Disabled by default. This setting is in beta and might be changed or removed without notice.
  • Add child items rate limit (work_item_hierarchy_add_children_limit): 300 child items every minute for each authenticated user. Applies to adding child items from the parent work item or epic: the workItemHierarchyAddChildrenItems GraphQL mutation, childrenIds in the workItemUpdate GraphQL mutation, the /add_child quick action, and the REST API endpoints for assigning an issue to an epic and assigning a child epic. The limit is shared between them. Each child item in a request counts toward the limit, and if a request would exceed the limit, no child items are added. Does not apply when you set a parent from the child work item. Introduced in GitLab 19.6 with a feature flag named work_item_hierarchy_add_children_limits. Disabled by default. This setting is in beta and might be changed or removed without notice.
  • Delete label rate limit (label_delete_limit): 120 requests every minute for each authenticated user. Applies to deleting project and group labels in the UI and to the REST API endpoints for deleting a project label and deleting a group label. The limit is shared between them. Introduced in GitLab 19.6 with a feature flag named label_delete_rate_limit. Disabled by default. This setting is in beta and might be changed or removed without notice.
  • Retrieve file blame rate limit (project_repositories_blame_limit, project_repositories_blame_unauthenticated_limit): 400 requests every minute for each user and project. Unauthenticated requests are limited to 400 requests every minute for each IP address. Applies to the REST API endpoint for file blame and to the GraphQL blame field on RepositoryBlob, which the blame view in the UI uses.
  • List to-do items rate limit (todos_list_api_limit): 300 requests every minute for each authenticated user. Applies to the REST API endpoint for listing to-do items. Introduced in GitLab 19.6 with a feature flag named todos_list_api_rate_limit. Disabled by default. This setting is in beta and might be changed or removed without notice.
  • Read wiki pages rate limit (wiki_read_request_limit_unauthenticated): 500 requests every minute for each project or group wiki, shared by all unauthenticated users. Applies to wiki pages in the UI and to the REST API endpoints that list and retrieve project and group wiki pages. Introduced in GitLab 19.6 with a feature flag named wiki_read_unauthenticated_rate_limit. Disabled by default. This setting is in beta and might be changed or removed without notice.

You can set this rate limit with the plan limits API or the Rails console:

Configuration file

You can set these rate limits only in the configuration file for your installation, for example /etc/gitlab/gitlab.rb in a Linux package installation:

Non-configurable limits

Some rate limits cannot be configured. For a list of these limits, see non-configurable rate limits.

Bans and blocks

Some protections block a client for a period of time instead of slowing requests down. For more information, see abuse and failed authentication bans.