PUBLISHED PROVIDER LIMITS
Limits keep their provider-specific dimensions.
GitHub maintains separate rate-limit resources and additional secondary abuse-prevention limits.
Authentication: Unauthenticated public requests, Personal access token, OAuth access token, GitHub App installation or user token, GITHUB_TOKEN
Primary scope: Credential, User, App, Installation, Repository, Or IP Depending On Authentication
Measured dimensions: Requests, Concurrent Requests, Endpoint Points, CPU Time, Content Generating Requests
Profile coverage: GitHub REST primary limits, Git LFS buckets, published REST secondary controls, response headers, and exceeded-limit behavior. GraphQL primary limits and endpoint-specific search limits are outside this profile.
Primary limits
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| Unauthenticated REST requests | 60 requests | Per hour | Source Ip | Public resources only No authentication |
| Authenticated REST requests | 5,000 requests | Per hour | User | Personal access token, OAuth token, or GitHub App user token |
| Enterprise Cloud authenticated user requests | 15,000 requests | Per hour | User | Qualifying GitHub Enterprise Cloud organization context |
| GitHub App installation minimum | 5,000 requests | Per hour | Installation | Installation access token Non-Enterprise Cloud installation Can scale with repository and organization user counts, up to 12,500 requests per hour. |
| GITHUB_TOKEN | 1,000 requests | Per hour | Repository | Per repository 15,000 requests per hour per repository for qualifying Enterprise Cloud resources. |
Resource-specific limits
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| Git LFS unauthenticated API requests | 300 requests | Per minute | Source Ip | Published provider limit. |
| Git LFS authenticated API requests | 3,000 requests | Per minute | Credential | Published provider limit. |
Secondary controls
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| Secondary concurrent request limit | 100 concurrent requests | At one time | Shared Rest And Graphql | Published provider limit. |
| Secondary REST endpoint points | 900 points | Per minute | Credential | Most GET, HEAD, and OPTIONS requests cost 1 point; most POST, PATCH, PUT, and DELETE requests cost 5 points. Some costs are not public. |
| Content-generating requests | 80 requests | Per minute | User Or Integration | General ceiling; some endpoints are lower and limits may change without notice. |
| Secondary request CPU time | 90 CPU seconds | Per 60 second | Shared Rest And Graphql | No more than 60 seconds of this CPU time may be used by GraphQL requests. GitHub says total response time is only a rough estimate. |
| Content-generating requests | 500 requests | Per hour | User Or Integration | General ceiling; some endpoints are lower and limits may change without notice. |
| OAuth access token requests | 2,000 requests | Per hour | Github App Or OAuth App | Published provider limit. |
RESPONSE METADATA
Headers expose the applicable limit state.
X-RateLimit-LimitFormat: Integer- Maximum requests allowed in the current primary window.
X-RateLimit-RemainingFormat: Integer- Requests remaining in the current primary window.
X-RateLimit-UsedFormat: Integer- Requests already used in the current primary window.
X-RateLimit-ResetFormat: Unix Epoch Seconds- Time at which the window resets.
X-RateLimit-ResourceFormat: String- The named rate-limit resource charged by the request.
Retry-AfterFormat: Seconds Or HTTP Date- Delay before retrying when provided.
WHEN A LIMIT IS EXCEEDED
Read the response before choosing a delay.
- Rate-limit responses can use HTTP 403 or HTTP 429.
- Primary exhaustion signal: X-RateLimit-Remaining equals 0.
RECOMMENDED HANDLING
Protect both the provider and your own queue.
- Do not retry primary-limit failures until X-RateLimit-Reset.
- Honor Retry-After when present.
- For secondary limits without Retry-After, wait at least one minute and use exponential backoff.
- Prefer response headers over repeatedly calling the rate-limit status endpoint.
VERIFICATION RECORD