specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: McAfee (Trellix)
providerId: mcafee
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Antivirus
  - Cybersecurity
  - Endpoint Protection
  - Security
  - Rate Limiting
description: Most McAfee / Trellix APIs run inside customer-deployed appliances or virtual servers (ePO,
  TIE, DXL broker, Web Gateway, ESM) where rate limits are bounded by the deployed hardware / VM rather
  than by a vendor-published RPS. The cloud MVISION / Trellix XDR API has tenant-scoped throttles but
  numeric ceilings are not surfaced on the public marketing site. Consumers should refer to the product's
  Administration Guide for sizing and concurrency guidance per appliance.
notes: |
  No public RPS / RPM numbers documented. On-prem APIs scale with deployed hardware; cloud APIs use
  per-tenant throttles documented in the customer-gated docs portal. Set reconciled=true once vendor-
  documented numeric limits are confirmed.
sources:
  - https://www.trellix.com/
  - https://www.mcafee.com/
responseCodes:
  throttled: 429
  serviceUnavailable: 503
limits:
  - name: On-prem appliance throughput
    scope: appliance
    metric: varies
    limit: 'sized to deployed hardware / VM'
    applies:
      - McAfee ePO API
      - McAfee Threat Intelligence Exchange (TIE) API
      - McAfee Data Exchange Layer (DXL) API
      - McAfee Web Gateway API
      - McAfee ESM API
    notes: For on-prem products, throughput is bounded by the customer's deployment (CPU, memory, EPS
      sizing for ESM, broker count for DXL). Reference the product's Administration Guide for sizing.
  - name: Cloud MVISION / XDR tenant limit
    scope: tenant
    metric: varies
    limit: 'per-tenant throttle (not publicly documented)'
    applies:
      - McAfee MVISION API
    notes: Cloud APIs apply per-tenant throttles; specific numeric ceilings are documented in the customer-
      gated portal rather than on the public marketing site.
policies:
  - name: Backoff Strategy
    description: Use exponential backoff with jitter on transient errors and honor Retry-After when
      present.
  - name: Appliance Sizing
    description: For on-prem deployments, scale appliance / VM resources or add brokers (DXL) to handle
      higher request volumes; raw RPS is a function of deployed capacity rather than a vendor cap.
  - name: Cloud Throttle Escalation
    description: For cloud MVISION / XDR throttling, contact Trellix support to request quota review;
      tenants on enterprise plans may receive raised ceilings.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com