specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Cloud Native Buildpacks
providerId: buildpacks
generated: '2026-09-05'
method: probed
source: >-
  Live anonymous requests to https://registry.buildpacks.io/api/v1/search?matches=ruby (200) and
  https://registry.buildpacks.io/api/v1/buildpacks/nope/nope (404) on 2026-09-05, full response
  headers captured; plus https://github.com/buildpacks/registry-api (the API's only documentation)
created: '2026-05-04'
modified: '2026-09-05'
limit_count: 0
tags:
  - Build Tools
  - CI/CD
  - Cloud Native
  - CNCF
  - Container Images
  - Containers
  - OCI
  - Open Source
  - Rate Limiting
description: >-
  No rate limits are published for any Cloud Native Buildpacks surface, and none are signalled at
  runtime. The Buildpack Registry API returned no X-RateLimit-*, no RateLimit-*, no RateLimit-Policy
  and no Retry-After header on either a 200 or a 404 response. limit_count is 0 as a measured fact:
  the project documents no limit and the API tells a client nothing about one. An agent therefore
  has no runtime signal to back off on and must self-throttle.
headers: {}
headers_observed_200:
  - cache-control: max-age=0, private, must-revalidate
  - content-type: application/json; charset=utf-8
  - etag: W/"c34ead09956aac7ea909e6c7395cf1eb"
  - strict-transport-security: max-age=31556952; includeSubDomains; preload
  - vary: Accept, Origin
  - server: Heroku
  - via: 2.0 heroku-router
  - x-request-id: 609d67d4-9146-aabc-2e01-361de8710359
  - x-runtime: '0.073296'
  - x-content-type-options: nosniff
  - x-frame-options: SAMEORIGIN
responseCodes:
  throttled: unknown
  note: >-
    No 429 was observed and none is documented. Whether one is ever returned — and whether the
    Heroku router in front of the app enforces anything — is unknown, not known-absent.
limits: []
surfaces:
  - api: Buildpack Registry API
    base_url: https://registry.buildpacks.io/api/v1
    documented_limits: none
    runtime_signal: none
    auth: anonymous
    caching_hint: >-
      A weak ETag IS returned, so a well-behaved client can revalidate with If-None-Match instead of
      re-fetching. That is the only load-reduction affordance the API offers.
  - api: kpack (kpack.io/v1alpha1)
    documented_limits: n/a
    note: >-
      Served by the operator's own Kubernetes API server. Any throttling is the cluster's
      (API Priority and Fairness), not the project's, and is outside this record.
notes:
  - >-
    This file REPLACES a scaffold written by the 2026-05-04 bulk sweep which asserted
    X-RateLimit-Limit/Remaining/Reset headers, a RateLimit-Policy header, a 429 response and a
    per-minute free-tier limit. None of those were observed on the live API and none are documented.
    The fabricated values have been removed rather than carried forward.