specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Envoy
providerId: envoy
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Cloud Native
  - Proxy
  - Service Mesh
  - Rate Limiting
  - Open Source
description: Envoy is open-source software, not a hosted service, so the Envoy project does not impose
  request limits. Instead, Envoy is itself a tool for enforcing rate limits — operators configure local
  (token-bucket) and global (rate-limit-service) policies on their own deployments. Limits documented
  here describe Envoy's role as a rate-limit enforcer rather than as a constrained API.
sources:
  - https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/local_rate_limit_filter
  - https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/rate_limit_filter
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: Operator-Configured Local Rate Limit
    scope: operator-defined
    metric: requests_per_second
    limit: operator-defined (token bucket)
    notes: Token-bucket filter applied per route/virtual-host; operator sets max_tokens and tokens_per_fill
      / fill_interval.
  - name: Operator-Configured Global Rate Limit
    scope: operator-defined
    metric: requests_per_second
    limit: operator-defined (RLS)
    notes: Distributed rate limiting via an external Rate Limit Service (RLS); descriptors and limits are
      defined by the operator.
  - name: Admin Endpoint Access
    scope: local
    metric: varies
    limit: localhost-only by default
    notes: The admin interface is intended to be bound to a non-public address; protect via network controls
      rather than rate limits.
policies:
  - name: Project as Rate-Limit Tool
    description: Envoy is the enforcement point — operators configure their own ingress/egress rate limits
      using local (in-process) and/or global (RLS-backed) filters.
  - name: 429 Response Convention
    description: Envoy returns HTTP 429 (Too Many Requests) when configured rate-limit thresholds are exceeded;
      operators may customize response headers and status code.
  - name: Backpressure
    description: At the data-plane level, Envoy supports circuit breakers, connection pool limits, and
      retry budgets in addition to rate limiting.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com