specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: KrakenD
providerId: krakend
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Rate Limiting
  - API Gateway
  - API Aggregation
description: KrakenD is self-hosted software, not a hosted API service, so it does not impose vendor-side
  rate limits on its customers. Operators configure their own rate limiting using the built-in `qos/ratelimit/router`
  (per-endpoint) and `qos/ratelimit/proxy` (per-backend) middleware, plus the Enterprise `security/policies`
  layer for advanced quotas. License usage is unconstrained — Enterprise pricing explicitly is not linked
  to API count or throughput.
sources:
  - https://www.krakend.io/enterprise/
  - https://www.krakend.io/docs/endpoints/rate-limit/
notes: KrakenD itself is shipped software; vendor-side throttling does not exist. Limits below describe
  the built-in middleware operators apply to their own data-plane traffic.
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: License throughput
    scope: license
    metric: requests_per_second
    limit: -1
    notes: Enterprise pricing not tied to API count or throughput.
  - name: Endpoint rate limit (operator-configured)
    scope: endpoint
    metric: requests_per_second
    limit: 'configured per endpoint via qos/ratelimit/router'
  - name: Proxy rate limit (operator-configured)
    scope: backend
    metric: requests_per_second
    limit: 'configured per backend via qos/ratelimit/proxy'
  - name: Client rate limit (operator-configured)
    scope: client
    metric: requests_per_second
    limit: 'configured via client_max_rate (token-bucket per client IP / header)'
policies:
  - name: Operator-defined throttling
    description: Rate limiting in KrakenD is configured by the operator in krakend.json; it is not enforced
      by the vendor.
  - name: Token-bucket
    description: Built-in rate limiters use a token-bucket algorithm with `max_rate` (steady) and `capacity`
      (burst).
  - name: Standard headers
    description: When throttled, KrakenD returns 429 and may emit X-RateLimit-Limit / X-RateLimit-Remaining
      / X-RateLimit-Reset depending on plugin configuration.
  - name: Stateless scaling
    description: KrakenD is stateless; rate-limit state is per-instance unless backed by a shared store.
      Horizontal scaling effectively multiplies the configured rate per instance.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com