specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Fortinet
providerId: fortinet
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Cybersecurity
  - Networking
  - Firewall
  - Rate Limiting
description: Fortinet device APIs (FortiOS REST, FortiManager JSON-RPC, FortiAnalyzer) execute against the customer-owned device or VM and are bound by device CPU/RAM rather than a platform-imposed RPS quota. FortiCloud SaaS APIs are subject to per-tenant throttles set per subscription tier. Numeric limits are not publicly published.
notes: On-device APIs scale with hardware; FortiCloud limits are tenant-tier-dependent. No central public rate-limit table.
sources:
  - https://www.fortinet.com/products
  - https://docs.fortinet.com/
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: FortiOS / FortiManager / FortiAnalyzer device API
    scope: device
    metric: requests_per_second
    limit: bound by device CPU/memory; no platform-imposed quota
    applies:
      - FortiOS REST API
      - FortiManager JSON-RPC API
      - FortiAnalyzer API
  - name: FortiCloud SaaS API per-tenant throttle
    scope: tenant/api-key
    metric: varies
    limit: per-tenant subscription tier; not publicly published
    applies:
      - FortiSASE API
      - FortiManager Cloud API
      - FortiAnalyzer Cloud API
      - FortiGate Cloud API
policies:
  - name: Backoff Strategy
    description: Clients should implement exponential backoff with jitter on 429/5xx and honor Retry-After when present.
  - name: Session-Based Auth
    description: Most Fortinet device APIs use session-based authentication; persist sessions across calls rather than re-authenticating per request to avoid log churn and device-CPU pressure.
  - name: Device Capacity Planning
    description: Sustained API load against FortiGate/FortiManager directly impacts data-plane CPU; size capacity and offload heavy queries to FortiAnalyzer where possible.
  - name: HA / Cluster Routing
    description: Direct API calls only to the active node in an HA cluster; queries to standby nodes return inconsistent state.
maintainers: []