PUBLISHED PROVIDER LIMITS
Limits keep their provider-specific dimensions.
GitLab documents endpoint-specific limits and administrator-configurable Self-Managed throttles. Defaults, enabled state, and scopes vary by deployment.
Authentication: Personal access token, OAuth access token, Project or group access token, CI job token where supported
Primary scope: User, IP, Project, Object, Or Endpoint
Measured dimensions: Requests, Endpoint Operations, Object Access
Profile coverage: Published endpoint-specific GitLab limits and configurable Self-Managed user and IP throttles, including response headers. GitLab.com and individual Self-Managed deployments can use different or additional settings.
Endpoint limits
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| Repository archive downloads | 5 requests | Per minute | User And Project | Published provider limit. |
| Webhook tests | 5 requests | Per minute | User | Published provider limit. |
| Project jobs endpoint default | 600 requests | Per minute | Authenticated User | A Self-Managed administrator can configure this value. |
| GraphQL aiAction mutation | 160 requests | Per 8 hour | Authenticated User | Published provider limit. |
| Member deletion endpoints | 60 deletions | Per minute | Authenticated User | Published provider limit. |
Resource-specific limits
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| Repository blob or file over 10 MB | 5 requests | Per minute | Object Per Project | Published provider limit. |
Deployment Configured
| Limit | Value | Period | Scope | Conditions and variability |
|---|---|---|---|---|
| General user and IP throttles | Provider-specific | Provider-defined | Authenticated User Or Source Ip | Self-Managed administrators can enable and configure general authenticated and unauthenticated request limits. These settings are disabled by default. |
RESPONSE METADATA
Headers expose the applicable limit state.
RateLimit-LimitFormat: Integer- Maximum requests allowed in the current configured window.
RateLimit-NameFormat: String- Name of the GitLab throttle that produced the response.
RateLimit-ObservedFormat: Integer- Requests observed in the current window.
RateLimit-RemainingFormat: Integer- Requests remaining in the current window.
RateLimit-ResetFormat: Unix Epoch Seconds- Unix time when the current limit resets.
RateLimit-ResetTimeFormat: HTTP Date- Reset time emitted with a throttled response.
Retry-AfterFormat: Integer Seconds- Seconds until another request should be attempted.
WHEN A LIMIT IS EXCEEDED
Read the response before choosing a delay.
- Rate-limit responses can use HTTP 429.
RECOMMENDED HANDLING
Protect both the provider and your own queue.
- Use the rate-limit headers returned by the deployment.
- Honor Retry-After after a 429 response.
- Do not assume Self-Managed defaults apply to GitLab.com or another deployment.
VERIFICATION RECORD