Glossary Updates6 new terms added to the glossaries · October 11, 2026, 13:38 CEST
AI TechDocKnowledge

Glossary · 2 · Developer SDKs and APIs

Rate limiting

Also known as: Throttling, API rate limit, Request quota

In API operations, rate limiting is a server-side control that caps the number of requests a client, credential or tenant may make within a time window and rejects or delays requests beyond that limit; in HTTP the rejection is signaled with status code 429 Too Many Requests, optionally with a Retry-After header.

  • Developer SDKs
  • Security

In one sentence

Rate limiting caps requests per client and time window; HTTP signals it with status 429 Too Many Requests and optionally a Retry-After header.

Example

An API allows 5,000 requests per hour per access token; when the limit is reached, it answers with 429 and the SDK waits until the time given in Retry-After before sending again.

How it applies

  • Developer SDKs: Client libraries handle rate limits in one of three ways: they surface the 429 response as an error, they wait and retry automatically (respecting Retry-After), or they throttle themselves before sending. Documentation must say which behavior is the default and how to change it, because an automatic wait can look like a hang.
  • Limit information: Many APIs return the remaining quota in response headers. GitHub's REST API, for example, sends x-ratelimit-limit, x-ratelimit-remaining, x-ratelimit-used and x-ratelimit-reset. Standardized RateLimit header fields are being worked on in the IETF HTTPAPI working group as an Internet-Draft (as of October 11, 2026), not yet an RFC.
  • Gateways: Limits are often enforced in an API gateway rather than in each service, and counted per credential, per tenant or per IP address.
  • Platform and hardware SDKs: Platforms limit calls from extensions, and device clouds limit how often devices may report or be commanded; batching and backoff in the SDK keep fleets within those limits.
  • Purpose: Rate limiting protects capacity and fairness and reduces the impact of abuse. It is one control among several and does not by itself make an API secure.

Rate limiting vs. quota

A rate limit caps requests per short time window (per second, minute or hour). A quota caps total usage over a longer billing or contract period (per day or month). Both may apply to the same credential, and SDK documentation should explain which error belongs to which.

External references