specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Azure Key Vault
providerId: azure-key-vault
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Security
  - Secrets Management
  - Key Management
  - Rate Limiting
description: Azure Key Vault enforces per-vault, per-region throttling measured in transactions per 10
  seconds. Throttling thresholds are weighted by key type and operation - HSM keys cost more than software
  keys; larger RSA keys cost more than smaller ones. The subscription-wide ceiling is 5x the per-vault
  limit. Managed HSM has its own per-partition object limits. Throttled requests return HTTP 429.
sources:
  - https://learn.microsoft.com/en-us/azure/key-vault/general/service-limits
  - https://learn.microsoft.com/en-us/azure/key-vault/general/overview-throttling
headers:
  retryAfter: Retry-After
  requestId: x-ms-request-id
responseCodes:
  throttled: 429
limits:
  - name: RSA 2048-bit software key - all other transactions
    scope: vault/region
    metric: requests_per_10s
    limit: 4000
    timeFrame: second
    notes: 4,000 GET / sign / verify / encrypt / decrypt operations per 10 seconds.
  - name: RSA 2048-bit software key - CREATE
    scope: vault/region
    metric: requests_per_10s
    limit: 20
    timeFrame: second
  - name: RSA 2048-bit HSM key - all other transactions
    scope: vault/region
    metric: requests_per_10s
    limit: 2000
    timeFrame: second
  - name: RSA 2048-bit HSM key - CREATE
    scope: vault/region
    metric: requests_per_10s
    limit: 10
    timeFrame: second
  - name: RSA 4096-bit HSM key - all other transactions
    scope: vault/region
    metric: requests_per_10s
    limit: 250
    timeFrame: second
    notes: Larger RSA keys are weighted more heavily; thresholds are summed.
  - name: RSA 3072-bit HSM key - all other transactions
    scope: vault/region
    metric: requests_per_10s
    limit: 500
    timeFrame: second
  - name: ECC P-256/P-384/P-521 HSM key - all other transactions
    scope: vault/region
    metric: requests_per_10s
    limit: 2000
    timeFrame: second
  - name: Secret create / cert import / key import (combined)
    scope: vault/region
    metric: requests_per_10s
    limit: 300
    timeFrame: second
    notes: 300 transactions collectively across these three operations.
  - name: All other secret/vault transactions
    scope: vault/region
    metric: requests_per_10s
    limit: 4000
    timeFrame: second
  - name: Subscription-wide aggregate
    scope: subscription
    metric: requests_per_10s
    limit: 20000
    timeFrame: second
    notes: 5x the per-vault limit across all transaction types.
  - name: Managed HSM instances per subscription per region
    scope: subscription/region
    metric: instances
    limit: 5
  - name: Keys per Managed HSM
    scope: hsm
    metric: keys
    limit: 5000
  - name: Versions per key (Managed HSM)
    scope: key
    metric: versions
    limit: 100
policies:
  - name: Backoff
    description: Honor Retry-After on 429 responses; use exponential backoff with jitter.
  - name: Weighted thresholds
    description: Throttling is enforced on the weighted sum of operations. Mixing key types and sizes
      can hit the limit before any individual count is reached.
  - name: Cache and reuse
    description: Cache decrypted secrets and key references at the application tier to reduce vault
      transaction volume.
  - name: Backup ceiling
    description: Backup operations support max 500 versions per key/secret/certificate; older versions
      cannot be deleted.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com