specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: ForgeRock
providerId: forgerock
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Access Management
  - Authentication
  - Authorization
  - Identity Governance
  - Identity Management
  - OAuth
  - OpenID Connect
  - Rate Limiting
description: Following the Ping Identity acquisition, the ForgeRock platform's runtime rate-limiting is governed by the deployed product (AM/IDM/DS/IG) configuration and, for cloud tenants, by PingOne service-level limits. Public per-second numbers are not published; PingOne API limits are documented per-endpoint in the developer portal but vary by tenant tier and may be raised via support.
notes: Numeric limits not publicly tabulated. ForgeRock self-hosted limits are operator-configured; PingOne hosted limits are tenant-tier dependent and not enumerated on a single public page.
sources:
  - https://developer.pingidentity.com/pingone-api/foundations/introduction.html
  - https://www.pingidentity.com/en/platform/pricing.html
headers:
  retryAfter: Retry-After
  requestId: X-Request-Id
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: PingOne tenant API throttle
    scope: tenant/api-key
    metric: varies
    limit: per-tenant tier; documented per-endpoint in PingOne developer docs
    applies:
      - PingOne Management API
      - PingOne Authentication API
      - PingOne MFA API
  - name: ForgeRock self-hosted (operator configured)
    scope: deployment/realm
    metric: requests_per_second
    limit: configured at the AM throttling filter; no platform-imposed default
    applies:
      - ForgeRock Access Management API
      - ForgeRock Identity Management API
      - ForgeRock Directory Services API
      - ForgeRock Identity Gateway API
      - ForgeRock Identity Governance API
      - ForgeRock Autonomous Identity API
policies:
  - name: Backoff Strategy
    description: Clients should implement exponential backoff with jitter on 429/5xx and honor Retry-After when present.
  - name: Self-Hosted Throttling
    description: ForgeRock AM exposes a throttling filter (rate-limit policy) configured by the operator; tune by realm and authorization context rather than relying on platform defaults.
  - name: Tenant-Tier Scaling
    description: PingOne hosted limits scale with the customer subscription tier; raise via Ping support after demonstrating sustained legitimate need.
  - name: Idempotency for IDM Provisioning
    description: For lifecycle/sync flows, design jobs to be idempotent and resumable so retries on 429/5xx do not create duplicate identities or audit churn.
maintainers:
  - name: Kin Lane
    email: kin@apievangelist.com
    url: https://apievangelist.com