specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Check Point
providerId: checkpoint
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Cloud Security
  - Cybersecurity
  - Network Security
  - Security
  - Rate Limiting
description: Check Point does not publish a single, unified rate-limit policy for its API portfolio.
  Each API is bound to the customer's product deployment (on-prem Management Server, Smart-1 Cloud,
  Infinity Portal tenant, CloudGuard, Harmony Email, Spark Management) and the practical request ceiling
  is governed by deployment sizing rather than a published per-second number. The Management API documents
  a session-based model (login, run commands, publish, logout) where concurrency is bounded by the
  number of API sessions configured on the management server.
notes: No public per-second / per-minute rate-limit table is published. Customers should consult the
  product-specific Admin Guide on sk.checkpoint.com or open a TAC case for their deployment's tested
  limits.
sources:
  - https://sc1.checkpoint.com/documents/latest/APIs/
  - https://supportcenter.checkpoint.com/
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: Management API session concurrency
    scope: management-server
    metric: concurrent_requests
    limit: 'see deployment sizing — typically bounded by configured api-sessions on the management server'
    notes: The Check Point Management API uses session-based concurrency. Limits are determined by the
      management server configuration, not a published per-second cap.
  - name: CloudGuard / Harmony / Infinity Portal APIs
    scope: tenant
    metric: varies
    limit: 'see Infinity Portal admin guide; not publicly documented'
    notes: Cloud-hosted APIs may apply tenant-scoped throttling but Check Point does not publish the
      numeric ceilings.
policies:
  - name: Session Lifecycle (Management API)
    description: Clients call /login to obtain a session token (sid), perform commands, then /publish
      and /logout. Long-lived sessions block other writers; close sessions promptly.
  - name: Backoff Strategy
    description: On 429 / 503, apply exponential backoff with jitter and retry. Sustained pressure
      should be discussed with Check Point TAC.
  - name: Deployment Sizing
    description: Practical throughput depends on management-server CPU/RAM and the configured api-sessions
      pool. Resize the management server rather than expecting cloud-style horizontal scale.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com