---
title: Rate Limit Information Returned by the Cloud Controller API
owner: CAPI
---

The Cloud Controller API includes rate limit information in the HTTP header. Each header includes the following:

```
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 56
X-RateLimit-Reset: 1372700873
```

Use this table to understand the rate limit header.

<table>
<th>Field Value</th>
<th>Description</th>
 <tr>
 	<td>X-RateLimit-Limit</td>
 	<td>The maximum number of attempts per <a href="../concepts/architecture/uaa.html">User Account and Authentication (UAA)</a> user, if a user is authenticated. The maximum number of attempts per IP address, if no user is authenticated.</td>
 </tr>
 <tr>
 	<td>X-RateLimit-Remaining</td>
 	<td>The number of attempts remaining.</td>
 </tr>
 <tr>
 	<td>X-RateLimit-Reset</td>
 	<td>The time when the rate limit counter resets, in UTC <a href="https://en.wikipedia.org/wiki/Unix_time">epoch seconds</a>.</td>
 </tr>
</table>

When requests exceed the rate limit value, the Cloud Controller API returns a `429: Too Many Requests` error code.

---
title: Rate Limit Information Returned by the Cloud Controller API
owner: CAPI
---

The Cloud Controller API includes rate limit information in the HTTP header. Each header includes the following:

```
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 56
X-RateLimit-Reset: 1372700873
```

Use this table to understand the rate limit header.

<table>
<th>Field Value</th>
<th>Description</th>
 <tr>
 	<td>X-RateLimit-Limit</td>
 	<td>The maximum number of attempts per <a href="../concepts/architecture/uaa.html">User Account and Authentication (UAA)</a> user, if a user is authenticated. The maximum number of attempts per IP address, if no user is authenticated.</td>
 </tr>
 <tr>
 	<td>X-RateLimit-Remaining</td>
	<td>The estimated number of attempts remaining.</td>
 </tr>
 <tr>
 	<td>X-RateLimit-Reset</td>
 	<td>The time when the rate limit counter resets, in UTC <a href="https://en.wikipedia.org/wiki/Unix_time">epoch seconds</a>.</td>
 </tr>
</table>

Requests are counted separately in each Cloud Controller instance and each produces an estimate for the total number of remaining requests.
The estimate is based off the fraction remaining on the Cloud Controller instance (rounded down to nearest 10%) multiplied by the global maximum number of attempts.
This may result in slightly inconsistent values for the `X-RateLimit-Remaining` header when running multiple instances of Cloud Controller API such as some requests still being allowed when the header value is `0`.

When requests exceed the maximum rate limit value, the Cloud Controller API returns a `429: Too Many Requests` error code.

Clarify how rate limiting works in CAPI 1.120.0
Clarify how rate limiting works in CAPI 1.120.0

Explain that the remaining header is an estimate and each CC API
instance counts separately so there may be some variation in responses
