Non-configurable rate limits

  • Tier: Free, Premium, Ultimate
  • Offering: GitLab Self-Managed, GitLab Dedicated

GitLab enforces the following rate limits in the application.

LimitRate limitDetails
AI Catalog bulk enable10 requests each minute for each authenticated userApplies to the aiCatalogItemConsumerBulkCreate GraphQL mutation, which enables an agent or flow in multiple projects at once. Introduced in GitLab 19.6.
AI Catalog disable30 requests each minute for each authenticated userApplies to the aiCatalogItemConsumerDelete GraphQL mutation, which disables an agent or flow in a project or top-level group. Introduced in GitLab 19.6.
AI Catalog enable30 requests each minute for each authenticated userApplies to the aiCatalogItemConsumerCreate GraphQL mutation, which enables an agent or flow in a project or top-level group. Introduced in GitLab 19.6.
AI Catalog save30 requests each minute for each authenticated userApplies to the aiCatalogAgentCreate, aiCatalogAgentUpdate, aiCatalogFlowCreate, aiCatalogFlowUpdate, aiFlowTriggerCreate, aiFlowTriggerUpdate, aiCatalogThirdPartyFlowUpdate, and aiCatalogItemVersionRestore GraphQL mutations. These mutations save agents, flows, and automations, or restore an earlier version of an item. The limit is shared between them. Introduced in GitLab 19.6.
AI governance sessions120 requests per minute per authenticated user per top-level groupApplies to the aiGovernanceSessions GraphQL field on groups and projects, which lists AI sessions for the AI Governance dashboard and the Audit events tab. Introduced in GitLab 19.6 with a flag named ai_governance_rate_limits. Disabled by default.
AI model selection update30 requests per minute per authenticated userApplies to the aiModelSelectionNamespaceUpdate GraphQL mutation, which selects the models that GitLab Duo features use in a top-level group on GitLab.com. Introduced in GitLab 19.6.
AI session artifact download10 requests per minute per authenticated userApplies to downloading an AI session’s audit events as a JSON file from the session drawer of the AI Governance Audit events tab. Introduced in GitLab 19.6 with a flag named ai_governance_rate_limits. Disabled by default.
AI tool rules bulk update10 requests per minute per authenticated userApplies to the bulkUpdateAiToolRules GraphQL mutation, which updates the permissions of several AI tool rules in a top-level group, or in one of its projects, at once. Introduced in GitLab 19.6 with a flag named ai_tool_rules_bulk_update_rate_limit. Disabled by default.
Auto-remediation scheduler1 run and 1 reschedule run per project every 5 minutesApplies to dependency scanning auto-remediation scheduler runs. GitLab skips a run over the limit and does not retry it. The next pipeline after the period starts a new run. Reschedule runs, which fill a slot freed by a dismissed update, have their own limit. Introduced in GitLab 19.6 with a flag named dependency_management_scheduler_rate_limit. Disabled by default.
Changelog generation5 calls per minute per user per projectApplies to the :id/repository/changelog endpoint. The limit is shared between GET and POST actions.
Commit diff files6 requests per minuteApplies to expanded commit diff files (/[group]/[project]/-/commit/[:sha]/diff_files?expanded=1). The limit applies per user for authenticated requests, and per IP address for unauthenticated requests.
CSV export20 requests per hour per authenticated userApplies to exporting issues, work items, merge requests and requirements as CSV, in the UI and through the workItemsCsvExport, mergeRequestsCsvExport and exportRequirements GraphQL mutations. The limit is shared between them. Introduced in GitLab 19.6 with a flag named issuable_csv_export_rate_limit. Disabled by default.
Custom dashboard writes30 requests each minute for each authenticated userApplies to the createCustomDashboard GraphQL mutation, and to the updateCustomDashboard GraphQL mutation when the request includes a dashboard configuration, whether or not the configuration changes. Requests that update only the name or description are not counted. The limit is shared between the two mutations. Introduced in GitLab 19.6 with a flag named custom_dashboard_write_limits. Disabled by default.
DAST configuration page10 requests per minute per authenticated userApplies to viewing the DAST configuration page (/[group]/[project]/-/security/configuration/dast). Introduced in GitLab 19.6 with a feature flag named dast_configuration_rate_limit. Disabled by default.
Delete all merged branches60 requests per minute per authenticated userApplies to deleting all merged branches with DELETE /projects/:id/repository/merged_branches and to deleting merged branches in the UI. The limit is shared between them. Introduced in GitLab 19.6 with a flag named delete_merged_branches_rate_limit. Disabled by default.
Delete a deployment500 requests per minute per authenticated userApplies to deleting a deployment with DELETE /projects/:id/deployments/:deployment_id. Reduces the infrastructure impact of mass deployment deletions. Introduced in GitLab 19.2.
FogBugz import1 triggered import per minute per userApplies to triggering project imports from FogBugz. Introduced in GitLab 17.6.
Fork synchronization10 requests every 30 minutes for each user and projectApplies to updating a fork in the UI and to the projectSyncFork GraphQL mutation. Requests over the limit return the error This service has been called too many times. in the mutation’s errors field. In the UI, an alert shows the error. Requests are not counted when the branch is not behind the upstream default branch, or when a previous synchronization attempt found merge conflicts.
Group deletion60 requests per minute per authenticated userApplies to scheduling a group for deletion with DELETE /groups/:id. Requests that use permanently_remove are limited separately to 10 requests per minute, because they start the deletion immediately. Introduced in GitLab 19.6 with a feature flag named group_and_project_delete_rate_limit. Disabled by default.
GitLab for Slack app events60 requests per minute per Slack workspaceApplies to events Slack sends to POST /integrations/slack/events, such as mentions and direct messages to GitLab Duo. Requests over the limit are acknowledged and dropped. Introduced in GitLab 19.6 with a feature flag named slack_app_workspace_rate_limit. Disabled by default.
GitLab for Slack app interactions300 requests per minute per Slack workspaceApplies to POST /integrations/slack/interactions and POST /integrations/slack/options. Requests over the limit are acknowledged and dropped. Introduced in GitLab 19.6 with a feature flag named slack_app_workspace_rate_limit. Disabled by default.
GitLab for Slack app slash commands60 requests per minute per Slack workspaceApplies to POST /slack/trigger. Slash commands over the limit are not run and receive an error message. Introduced in GitLab 19.6 with a feature flag named slack_app_workspace_rate_limit. Disabled by default.
Merge request context commits10 requests per minute per authenticated userApplies to the API endpoints that create and delete merge request context commits. The UI uses the same endpoints. The two endpoints share the limit. Introduced in GitLab 19.6 with a flag named rate_limit_context_commits_write. Disabled by default.
Metric definitions export30 requests per minute per IP addressApplies to exporting metric definitions with GET /usage_data/metric_definitions. Authenticated requests are also counted per IP address. Introduced in GitLab 19.6 with a flag named rate_limit_metric_definitions. Disabled by default. While the flag is disabled, requests over the limit are logged but not blocked.
New user accounts20 calls per minute per IP addressApplies to the /users/sign_up endpoint. Mitigates attempts to mass discover usernames or email addresses in use.
Note edits300 requests per minute per authenticated userApplies to editing comments in the UI, through the REST API, and through the updateNote, updateImageDiffNote, and repositionImageDiffNote GraphQL mutations. Users excluded from the note creation rate limit are also excluded from this limit. Introduced in GitLab 19.6 with a flag named notes_update_rate_limit. Disabled by default.
Notification emails1,000 notifications per 24 hours per project or group per userApplies to notification emails related to a project or group. Generally available in GitLab 17.2.
Offline transfer exports and imports6 requests per minute per userApplies to offline transfer exports and imports, which are limited separately. Introduced in GitLab 19.3.
Project deletion60 requests per minute per authenticated userApplies to deleting a project with DELETE /projects/:id. Requests that use permanently_remove are limited separately to 10 requests per minute, because they start the deletion immediately. Introduced in GitLab 19.6 with a feature flag named group_and_project_delete_rate_limit. Disabled by default.
Refresh billable users1 request per 10 minutes per authenticated userApplies to triggering a recalculation of billable users with PUT /license/:id/refresh_billable_users. Each request starts a full count of billable users. Introduced in GitLab 19.6 with a flag named throttle_refresh_billable_users. Disabled by default.
Repository archives5 requests per minute per userApplies to downloading repository archives through the UI or the API. The limit applies to the project and to the user who starts the download.
Repository blob and file access5 calls per minute per object per projectApplies to files larger than 10 MB on the repository blob and repository file endpoints. Introduced in GitLab 18.1.
Scanned resources CSV download5 requests per minute per authenticated userApplies to downloading the scanned resources CSV for a pipeline’s DAST reports. Introduced in GitLab 19.6 with a feature flag named scanned_resources_csv_limits. Disabled by default.
Scanned resources GraphQL fields60 pipelines per minute per authenticated userApplies to the scannedResources and scannedResourcesCount GraphQL fields for DAST and API fuzzing reports. Each pipeline whose scanned resources are requested counts once. Introduced in GitLab 19.6 with a feature flag named scanned_resources_graphql_limits. Disabled by default.
Secrets manager enablement30 requests per minute per top-level groupApplies to the projectSecretsManagerInitialize and groupSecretsManagerInitialize GraphQL mutations, which enable GitLab Secrets Manager for a project or group. Projects and groups in the same top-level group count toward the same limit. Requests for a project or group that already has a secrets manager are not counted. Introduced in GitLab 19.6 with a flag named secrets_manager_initialize_rate_limit. Disabled by default. While the flag is disabled, requests over the limit are logged but not blocked.
Snippet creation300 requests per hour per authenticated userApplies to creating a snippet with POST /snippets, creating a project snippet with POST /projects/:id/snippets, and the createSnippet GraphQL mutation used by the GitLab UI. The limit is shared between all three. Introduced in GitLab 19.4.
SSH certificate authentication300 failed authentication attempts per minute per IPv4 address or IPv6 /64 subnetApplies to SSH certificate resolution by gitlab-sshd for certificates whose certificate authority is not in the gitlab-sshd config.yml. Only failed resolutions count toward the limit. When an address or subnet is over the limit, all certificate resolution requests from that address or subnet are rejected until the one-minute window expires. If GitLab Shell does not send a valid client IP address, the limit uses the GitLab Shell node address. IP addresses in the failed authentication ban allowlist are exempt. An allowlisted IPv6 address does not exempt the rest of its /64 subnet. If the fallback GitLab Shell node address is in the allowlist, the limit does not apply. Introduced in GitLab 19.6 with a flag named ssh_certificate_authentication_rate_limit. Disabled by default.
Tasks by type20 requests per minute per authenticated user per groupApplies to the requests that load the Tasks by type chart data and its top labels. The limit is shared between them. Introduced in GitLab 19.6 with a flag named tasks_by_type_rate_limit. Disabled by default.
Update username10 calls per minute per authenticated userLimits how frequently a username can be changed. Mitigates attempts to mass discover which usernames are in use.
Username exists20 calls per minute per IP addressApplies to the internal /users/:username/exists endpoint, which checks whether a chosen username is taken.
Work item bulk update30 requests per minute per authenticated userApplies to bulk editing issues and epics in the UI, and to the workItemBulkUpdate GraphQL mutation. The limit is shared between them. Introduced in GitLab 19.6 with a flag named work_item_bulk_update_rate_limit. Enabled by default.
Work item deletion300 requests per minute per authenticated userApplies to the workItemDelete GraphQL mutation. Introduced in GitLab 19.4. Generally available in GitLab 19.5.
Work item hierarchy reorder120 requests per minute per authenticated userApplies to reordering child items in the UI, and to the workItemsHierarchyReorder and epicTreeReorder GraphQL mutations. The limit is shared between them. Introduced in GitLab 19.6 with a flag named work_item_hierarchy_reorder_rate_limit. Enabled by default.