specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Casdoor
providerId: casdoor
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-04'
tags:
  - Authentication
  - Authorization
  - IAM
  - Identity
  - LDAP
  - MCP
  - MFA
  - OAuth
  - OIDC
  - Open Source
  - Passkeys
  - SAML
  - SCIM
  - Single Sign-On
  - SSO
  - WebAuthn
  - Rate Limiting
  - Quotas
  - Throttling
description: Machine-readable rate limit definitions for the Casdoor API surface. Captures per-tier quotas,
  burst behavior, response signaling, and recovery semantics. Defaults are scaffold values to be replaced
  with published provider limits.
headers:
  limit: X-RateLimit-Limit
  remaining: X-RateLimit-Remaining
  reset: X-RateLimit-Reset
  retryAfter: Retry-After
  policy: RateLimit-Policy
responseCodes:
  throttled: 429
  quotaExceeded: 429
  serviceUnavailable: 503
limits:
  - tier: free
    name: Free Tier Default
    scope: api-key
    metric: requests_per_minute
    limit: 10
    burst: 20
    timeFrame: minute
    applies:
      - Casdoor REST API
      - Casdoor OAuth 2.0 / OIDC Provider
      - Casdoor SAML 2.0 Identity Provider
      - Casdoor CAS Server
      - Casdoor LDAP Server
      - Casdoor SCIM 2.0 API
      - Casdoor MCP Gateway
      - Casdoor Webhooks
  - tier: free
    name: Free Tier Monthly Quota
    scope: api-key
    metric: requests_per_month
    limit: 1000
    timeFrame: month
    applies:
      - Casdoor REST API
      - Casdoor OAuth 2.0 / OIDC Provider
      - Casdoor SAML 2.0 Identity Provider
      - Casdoor CAS Server
      - Casdoor LDAP Server
      - Casdoor SCIM 2.0 API
      - Casdoor MCP Gateway
      - Casdoor Webhooks
  - tier: professional
    name: Professional Tier Default
    scope: api-key
    metric: requests_per_minute
    limit: 100
    burst: 200
    timeFrame: minute
    applies:
      - Casdoor REST API
      - Casdoor OAuth 2.0 / OIDC Provider
      - Casdoor SAML 2.0 Identity Provider
      - Casdoor CAS Server
      - Casdoor LDAP Server
      - Casdoor SCIM 2.0 API
      - Casdoor MCP Gateway
      - Casdoor Webhooks
  - tier: professional
    name: Professional Tier Monthly Quota
    scope: api-key
    metric: requests_per_month
    limit: 100000
    timeFrame: month
    applies:
      - Casdoor REST API
      - Casdoor OAuth 2.0 / OIDC Provider
      - Casdoor SAML 2.0 Identity Provider
      - Casdoor CAS Server
      - Casdoor LDAP Server
      - Casdoor SCIM 2.0 API
      - Casdoor MCP Gateway
      - Casdoor Webhooks
  - tier: enterprise
    name: Enterprise Negotiated Limit
    scope: contract
    metric: requests_per_minute
    limit: 1000
    burst: 5000
    timeFrame: minute
    applies:
      - Casdoor REST API
      - Casdoor OAuth 2.0 / OIDC Provider
      - Casdoor SAML 2.0 Identity Provider
      - Casdoor CAS Server
      - Casdoor LDAP Server
      - Casdoor SCIM 2.0 API
      - Casdoor MCP Gateway
      - Casdoor Webhooks
policies:
  - name: Backoff Strategy
    description: Clients should implement exponential backoff with jitter, honoring the Retry-After header
      when present.
  - name: Burst Handling
    description: Short bursts above the steady-state limit are tolerated up to the documented burst ceiling
      before throttling engages.
  - name: Quota Reset
    description: Monthly quotas reset at the start of each calendar month in UTC. Per-minute and per-second
      windows reset on a sliding-window basis.
  - name: Fair Use
    description: Even on uncapped enterprise tiers, sustained usage that materially impacts shared infrastructure
      may be subject to fair-use throttling.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com