Auth0 Management API Calls Return Different Values in the x-ratelimit-limit Headers
Last Updated:
Overview
Auth0 Management Application Programming Interface (API) calls return two different values in the x-ratelimit-limit headers depending on the rate limit status. This behavior occurs because the API enforces both sustained (per minute) and burst (per second) rate limits, but only returns one set of headers per response. The headers display the sustained limit during normal operation and switch to the breached limit value when a threshold is exceeded.
Applies To
- Auth0
- Management API
- Rate Limits
Solution
Why do the x-ratelimit-limit headers return different values?
The Auth0 Management API features sustained and burst rate limits. The primary limit is measured per minute, while burst protection is measured per second. Because each response contains only one set of x-ratelimit* headers, Auth0 returns only one of these values per response.
Auth0 determines the returned header value based on the current API usage status.
- When API requests operate within the boundaries of the limits, Auth0 returns the per-minute rate limit value in the
x-ratelimit-limitheaders, such as 15000. - When API requests breach any limit, Auth0 returns the breached limit information in the
x-ratelimit-limitheaders, such as 200.
For example, if a script makes 300 requests in a single second against a sustained limit of 15000 per minute and a burst limit of 200 per second, Auth0 returns a value of 15000 for the first 200 requests. For the remaining 100 requests, Auth0 returns a value of 200 to indicate the breached burst limit.
Review the Rate Limit Configurations documentation to find the exact values for the Management API rate limits based on the specific plan and subscription.
