specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Consul Connect
providerId: consul-connect
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Consul
  - HashiCorp
  - Service Mesh
  - Rate Limiting
description: Consul Connect's HTTP API is exposed by self-hosted Consul agents (default port 8500/8501).
  Rate limiting is operator-configured rather than imposed by HashiCorp — Consul ships built-in client-
  and server-side RPC rate-limiting (`limits.http_max_conns_per_client`, `limits.rpc_rate`, `limits.rpc_max_burst`,
  Enterprise-only `limits.request_limits`) and per-key ACL token enforcement. Cluster operators set
  the actual limits to protect the agent and the Raft leader.
sources:
  - https://developer.hashicorp.com/consul/docs/agent/config/config-files#limits
  - https://developer.hashicorp.com/consul/api-docs/connect
responseCodes:
  throttled: 429
  serviceUnavailable: 503
  rpcTooManyRequests: 429
limits:
  - name: Operator-Configured HTTP Connection Limit
    scope: agent/client-ip
    metric: concurrent_connections
    limit: 'configured via limits.http_max_conns_per_client'
    notes: Default Consul agent setting; tune to bound per-client HTTP concurrency against the agent.
  - name: Operator-Configured RPC Rate
    scope: agent
    metric: rpc_per_second
    limit: 'configured via limits.rpc_rate and limits.rpc_max_burst'
    notes: Token-bucket rate limit on RPCs leaving the agent; off by default.
  - name: Enterprise Read/Write Request Limits
    scope: agent
    metric: requests_per_second
    limit: 'configured via limits.request_limits.{read_rate, write_rate} (Consul Enterprise)'
    notes: Enterprise-only request-rate limiting on the HTTP API and gRPC server; supports `mode = enforcing
      / permissive / disabled`.
  - name: ACL Token Quota
    scope: ACL token
    metric: varies
    limit: 'enforced via X-Consul-Token policies'
    notes: Authorization (not throughput) is enforced through ACL policies; effective limits are operator-defined.
policies:
  - name: Operator-Owned Limits
    description: HashiCorp does not impose rate limits on the self-hosted Consul HTTP API; cluster operators
      configure agent and Raft-leader-side rate limits via the `limits` block in the Consul agent config.
  - name: Backoff Strategy
    description: Clients should respect 429 / 503 responses with exponential backoff and jitter; Consul
      returns `Retry-After` when a request is rate-limited.
  - name: Request Limits Modes
    description: Consul Enterprise's request_limits supports enforcing, permissive, and disabled modes
      to allow operators to observe before enforcing.
  - name: Federation Considerations
    description: Cross-datacenter / WAN federation traffic adds RPC load; tune `limits.rpc_*` accordingly
      on edge agents and the leader.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com