specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Dapr
providerId: dapr
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Distributed Systems
  - Microservices
  - Open Source
  - Rate Limiting
description: Dapr is a self-hosted runtime; there is no provider-imposed rate limit on the Dapr APIs.
  Throughput is bounded by the operator's own sidecar resource limits, the underlying state store /
  message broker, and any Dapr Resiliency or Configuration policies the operator configures (rate
  limit middleware, circuit breakers, timeouts, retries). Dapr does ship a rate-limit HTTP middleware
  component that operators can attach to any building-block invocation, but the numeric limits are
  always operator-defined.
sources:
  - https://docs.dapr.io/operations/components/middleware/
  - https://docs.dapr.io/operations/resiliency/policies/
notes: Dapr does not impose vendor rate limits. All quotas are operator-configured via middleware
  or Resiliency policies. Reconciled remains false because there are no published vendor numbers
  to verify against.
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: Operator-configured rate limit middleware
    scope: per-component
    metric: requests_per_second
    limit: operator-defined via ratelimit middleware component
    notes: Configured in the rate-limit middleware spec (`maxRequestsPerSecond`) and bound to a
      pipeline. No default; not applied unless the middleware is attached.
  - name: Operator-configured Resiliency policy
    scope: per-component or per-app
    metric: varies
    limit: operator-defined via Resiliency CRDs (timeouts, retries, circuit breakers)
    notes: Resiliency policies bound circuit-breaker thresholds, retry budgets, and timeouts; they
      are not vendor rate limits.
policies:
  - name: Self-Hosted Throttling
    description: Because Dapr runs in the operator's own infrastructure, all throughput limits are
      under operator control. Tune sidecar CPU/memory, state-store throughput, and broker
      partitions to set effective limits.
  - name: Middleware Pattern
    description: Use the rate-limit HTTP middleware to enforce a per-app requests-per-second cap;
      attach it to specific building blocks via component pipelines.
  - name: Resiliency First
    description: Combine timeouts, retries with backoff, and circuit breakers via Resiliency CRDs
      rather than relying on a single rate-limit number. Dapr's Resiliency framework is the
      canonical place to encode these.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com