specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Budibase
providerId: budibase
generated: '2026-09-04'
method: probed
source: >-
  Live unauthenticated responses from https://budibase.app/api/public/v1 observed
  2026-09-04, plus a documentation search that found no published limit.
created: '2026-05-04'
modified: '2026-09-04'
provenance_note: >-
  REPLACED 2026-09-04. The previous version of this file was a bulk-sweep scaffold dated
  2026-05-04 that invented five limits across invented "free / professional / enterprise"
  tiers (10 rpm, 1,000 req/month, 100 rpm, 100,000 req/month, 1,000 rpm burst 5,000).
  Budibase publishes none of those numbers. Every value below was READ OFF A LIVE
  RESPONSE from Budibase's own API host.
tags:
  - AI Agents
  - Automation
  - Internal Tools
  - Low-Code
  - Workflow Automation
  - Rate Limiting
description: >-
  Budibase does not document rate limits anywhere in its public documentation, but the
  Public API DOES emit X-RateLimit-* headers on every response — including unauthenticated
  ones. The limit recorded here was measured directly against the production host, not
  taken from a docs page, because there is no docs page to take it from.
documented: false
documentation_search:
  - url: https://docs.budibase.com/llms.txt
    status: 200
    result: >-
      The full documentation index (400+ pages) contains no rate-limit, quota or
      throttling page. "Rate limit" appears nowhere in any page title or description.
  - url: https://docs.budibase.com/docs/rate-limits
    status: 404
  - url: https://docs.budibase.com/docs/public-api
    status: 200
    result: >-
      The Public API overview covers API keys, workspace IDs, table/row IDs, the OpenAPI
      location and Postman/Insomnia import. It says nothing about limits.
headers:
  limit: X-RateLimit-Limit
  remaining: X-RateLimit-Remaining
  reset: X-RateLimit-Reset
  retryAfter: null
  policy: null
  note: >-
    Header names observed lowercase over HTTP/2 (x-ratelimit-limit, x-ratelimit-remaining,
    x-ratelimit-reset). These are the legacy X-RateLimit-* family, not the RFC 9239
    RateLimit-* draft headers. No Retry-After and no RateLimit-Policy header is sent.
    X-RateLimit-Reset carries a Unix epoch second at the start of a window and then counts
    down as small integers (1, 0) inside it, so a client must not assume one encoding.
responseCodes:
  throttled: unobserved
  note: >-
    The exhaustion status code was NOT observed. Sixteen back-to-back requests never
    exceeded the limit because the window resets every second — remaining fell 9, 8, 7, 6
    and then jumped back to 9 as the epoch second rolled over. Recording "429" here would
    be a guess, so it is recorded as unobserved.
limit_count: 1
limits:
  - name: Public API default
    scope: per-client
    metric: requests
    limit: 10
    window: 1 second
    timeFrame: second
    burst: null
    observed: true
    observed_at: '2026-09-04'
    evidence:
      - request: GET https://budibase.app/api/public/v1/metrics
        response_status: 403
        headers:
          x-ratelimit-limit: '10'
          x-ratelimit-remaining: '9'
          x-ratelimit-reset: '1788567681'
      - request: POST https://budibase.app/api/public/v1/applications/search
        response_status: 400
        headers:
          x-ratelimit-limit: '10'
          x-ratelimit-remaining: '9'
          x-ratelimit-reset: '1788567671'
    note: >-
      Measured unauthenticated, so this is the anonymous/pre-auth budget. Whether an
      authenticated API key receives the same 10-per-second ceiling, or a different one by
      plan, cannot be established without a key and Budibase does not say.
findings:
  - >-
    The runtime signal exists and the documentation does not. An agent calling Budibase
    can read its remaining budget off every response, but a developer planning an
    integration cannot find the number anywhere on the site — the gap is documentation,
    not engineering.
  - >-
    A one-second window at 10 requests is tight for bulk work. Any row-level migration
    through /tables/{tableId}/rows will need client-side pacing, and there is no
    Retry-After header to pace against.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com