name: CyberArk API Rate Limits
specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: CyberArk
providerId: cyberark
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Identity Security
  - Privileged Access Management
  - Secrets Management
  - Rate Limiting
description: CyberArk REST APIs (PAM Self-Hosted, Privilege Cloud, Identity, Conjur) are tenant- or vault-scoped
  and do not publish fixed numeric rate limits. Conjur enforces a configurable throttle for token issuance;
  Privilege Cloud and Identity throttle abusive clients via 429.
sources:
  - https://www.cyberark.com/products/
  - https://docs.cyberark.com/
notes: CyberArk does not publish a single public rate-limit doc. Per-product limits live in product-specific
  documentation; reconcile after onboarding. Self-Hosted PAM limits depend on customer infrastructure
  sizing.
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: PAM Self-Hosted REST API
    scope: tenant
    metric: varies
    limit: depends on customer-deployed PVWA / CPM capacity (self-hosted)
    applies:
      - CyberArk PAM Self-Hosted REST API
  - name: Privilege Cloud REST API
    scope: tenant
    metric: varies
    limit: see CyberArk Privilege Cloud documentation
    applies:
      - CyberArk Privilege Cloud REST API
  - name: Identity REST API
    scope: tenant
    metric: varies
    limit: see CyberArk Identity API reference
    applies:
      - CyberArk Identity REST API
  - name: Conjur token issuance
    scope: tenant
    metric: requests_per_second
    limit: configurable per Conjur deployment (authn-throttle)
    applies:
      - CyberArk Conjur Secrets Manager API
policies:
  - name: Token caching
    description: Conjur and Identity authentication tokens should be cached and reused until expiry rather
      than minted per request to stay under throttles.
  - name: Backoff Strategy
    description: Honor 429 / 503 with exponential backoff and jitter; retry idempotent reads only.
  - name: Self-hosted vs SaaS
    description: Self-Hosted limits depend on customer-deployed PVWA / CPM sizing; SaaS limits are tenant-scoped
      by CyberArk.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com