Rate limits
- Tier: Free, Premium, Ultimate
- Offering: GitLab Self-Managed, GitLab Dedicated
For GitLab.com, see GitLab.com-specific rate limits.
For GitLab Dedicated, see Authenticated user rate limits.
Rate limiting is a common technique used to improve the security and durability of a web application.
For example, a simple script can make thousands of web requests per second. The requests could be:
- Malicious.
- Apathetic.
- Just a bug.
Your application and infrastructure may not be able to cope with the load. For more details, see Denial-of-service attack. Most cases can be mitigated by limiting the rate of requests from a single IP address.
Most brute-force attacks are similarly mitigated by a rate limit.
The rate limits for API requests do not affect requests made by the frontend, because these requests are always counted as web traffic.
Configuration options
You can set most rate limits in the Admin area, and a few only through the API or the Rails console.
Admin area
You can set these rate limits in the Admin area of your instance:
- Import/Export rate limits
- Issue rate limits
- Note rate limits
- Protected paths
- Raw endpoints rate limits
- User and IP rate limits
- Package registry rate limits
- Git LFS rate limits
- Rate limits on Git SSH operations
- Files API rate limits
- Deprecated API rate limits
- GitLab Pages rate limits
- Pipeline rate limits
- Incident management rate limits
- Projects API rate limits
- Groups API rate limits
- Users API rate limits
- Organizations API rate limits
- Webhook operations rate limits
API and Rails console
You can set these rate limits with the application settings API:
- Autocomplete users rate limit
- AI action (
ai_action_api_rate_limit): 160 calls per 8 hours per authenticated user. Applies to the GraphQLaiActionmutation.
You can set this rate limit with the plan limits API or the Rails console:
Non-configurable limits
Some rate limits cannot be configured. For a list of these limits, see non-configurable rate limits.
Bans and blocks
Some protections block a client for a period of time instead of slowing requests down. For more information, see abuse and failed authentication bans.