specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: AWS API Gateway
providerId: aws-api-gateway
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - API Management
  - Serverless
  - Rate Limiting
  - Throttling
  - AWS
description: AWS API Gateway enforces a regional account-level throttle plus per-API stage / method /
  usage-plan throttles. Defaults are 10,000 RPS per account per Region with a 5,000-request burst
  bucket; some regions default to 2,500 RPS / 1,250 burst. Control-plane operations (CreateRestApi,
  CreateDeployment, etc.) have separate fixed quotas. Account-level throttles are increasable via
  Service Quotas; control-plane throttles are not.
sources:
  - https://docs.aws.amazon.com/apigateway/latest/developerguide/limits.html
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: Account-level throttle (default Regions)
    scope: account/region
    metric: requests_per_second
    limit: 10000
    timeFrame: second
    notes: Across HTTP APIs, REST APIs, WebSocket APIs, and WebSocket callback APIs. Burst 5,000
      via token-bucket. Increasable via Service Quotas (L-8A5B8E43).
  - name: Account-level throttle (low-default Regions)
    scope: account/region
    metric: requests_per_second
    limit: 2500
    timeFrame: second
    notes: 'Lower default in: Africa (Cape Town), Europe (Milan / Spain / Zurich), Asia Pacific
      (Jakarta / Hyderabad / Melbourne / Malaysia / Thailand), Middle East (UAE), Israel (Tel Aviv),
      Canada West (Calgary), Mexico (Central). Burst 1,250.'
  - name: Per-method throttle (REST API stage/method)
    scope: stage-method
    metric: requests_per_second
    limit: -1
    notes: Configured per method via stage settings or usage plan; defaults to inheriting the
      account-level throttle. Burst configurable.
  - name: Usage plan throttle
    scope: api-key
    metric: requests_per_second
    limit: -1
    notes: Enforced per API key bound to a usage plan; rate, burst, and monthly quota all configurable.
  - name: Portal throttle without access control
    scope: account/region/portal
    metric: requests_per_second
    limit: 250000
    timeFrame: second
    notes: Hard cap; not increasable.
  - name: Portal throttle with access control
    scope: account/region/portal
    metric: requests_per_second
    limit: 10000
    timeFrame: second
    notes: Hard cap; not increasable.
  - name: CreateApiKey
    scope: account
    metric: requests_per_second
    limit: 5
    timeFrame: second
    notes: Control-plane fixed quota.
  - name: CreateDeployment
    scope: account
    metric: requests_per_second
    limit: 0.2
    timeFrame: second
    notes: 1 request every 5 seconds. Fixed.
  - name: CreateRestApi (Regional / private)
    scope: account
    metric: requests_per_second
    limit: 0.333
    timeFrame: second
    notes: 1 request every 3 seconds. Fixed.
  - name: CreateRestApi (edge-optimized)
    scope: account
    metric: requests_per_second
    limit: 0.0333
    timeFrame: second
    notes: 1 request every 30 seconds. Fixed.
  - name: PutRestApi
    scope: account
    metric: requests_per_second
    limit: 1
    timeFrame: second
  - name: Other control-plane operations (aggregate)
    scope: account
    metric: requests_per_second
    limit: 10
    timeFrame: second
    notes: 10 RPS aggregate with 40 RPS burst across "other" operations. Not increasable.
policies:
  - name: Token Bucket Burst
    description: Account-level throttle uses a token-bucket algorithm; bursts above the steady-state
      RPS are tolerated up to the bucket capacity, then throttled. The burst quota is set by AWS,
      not customer-configurable.
  - name: Backoff Strategy
    description: AWS SDKs implement exponential backoff with jitter automatically on 429 / 5xx; clients
      using raw HTTP should mirror this and honor Retry-After when present.
  - name: Service Quotas Increases
    description: Account-level RPS quotas can be raised via the Service Quotas console (quota code
      L-8A5B8E43); control-plane and portal quotas are fixed and not increasable.
  - name: Per-Method / Per-Stage / Usage-Plan Layering
    description: Throttling is layered. The most restrictive of (account regional throttle / stage
      throttle / method throttle / usage plan throttle) wins for a given request.
  - name: WAF Layering
    description: AWS WAF rules apply before throttling; rate-based WAF rules can shape per-IP traffic
      independently of API Gateway throttles.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com