specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Istio
providerId: istio
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Rate Limiting
  - Service Mesh
  - Open Source
  - Networking
description: Istio is open-source software, not a hosted SaaS, so there are no provider-enforced API
  rate limits. The "Istio APIs" are Kubernetes Custom Resources (VirtualService, DestinationRule, Gateway,
  AuthorizationPolicy, etc.) read and written via the Kubernetes API server. Rate limiting in an Istio
  mesh is something operators *configure* (local rate limit via Envoy, or global rate limit via an external
  rate-limit service) — it is not enforced against Istio itself.
sources:
  - https://istio.io/latest/docs/tasks/policy-enforcement/rate-limit/
  - https://istio.io/latest/docs/reference/config/networking/
responseCodes:
  throttled: 429
limits:
  - name: Self-managed
    scope: cluster
    metric: varies
    limit: operator-configured
policies:
  - name: Operator-controlled
    description: Throughput against Istio control-plane CRDs is governed by the underlying Kubernetes
      API server; clients should respect kube-apiserver QPS/burst settings.
  - name: In-mesh rate limiting
    description: Use Istio's local rate limit (Envoy local rate limit filter) for per-instance limits
      and the global rate limit pattern (Envoy + ext_authz to a rate-limit service) for shared quotas.
  - name: No vendor SaaS limit
    description: Istio itself does not impose a service-side rate limit; community / vendor distributions
      may set their own SLOs.
maintainers:
  - FN: API Evangelist
    email: info@apievangelist.com