name: MuleSoft API Rate Limits
specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: MuleSoft
providerId: mulesoft
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Rate Limiting
  - API Management
  - Integration Platform
  - Anypoint Platform
description: MuleSoft's Anypoint Platform does not impose a single global call-per-second cap. Throttling
  is applied by the customer at the API Manager / Flex Gateway layer using the Rate-Limiting and Rate-Limiting
  SLA policies — the customer defines numbers per API and per client application contract. Platform-side
  consumption is sized by the subscribed Mule Flow / Mule Message capacity (vCores), not by HTTP rate.
sources:
  - https://docs.mulesoft.com/api-manager/latest/rate-limiting-and-throttling-sla-based-policies
  - https://docs.mulesoft.com/general/pricing
headers:
  limit: X-Ratelimit-Limit
  remaining: X-Ratelimit-Remaining
  reset: X-Ratelimit-Reset
responseCodes:
  invalidCredentials: 401
  quotaExceeded: 429
limits:
  - name: Customer-defined per API (Rate-Limiting policy)
    scope: api
    metric: requests_per_window
    limit: customer-defined per API
    notes: Defined as max requests per time window in API Manager; applied by Flex Gateway / Mule runtime.
  - name: Customer-defined per client app (Rate-Limiting SLA policy)
    scope: client_application
    metric: requests_per_window
    limit: customer-defined per SLA tier
    notes: SLA-tier limits are bound to a contract between a registered client application and the API.
  - name: Platform capacity (Mule Flow / Mule Message)
    scope: subscription
    metric: vCore_capacity
    limit: per subscribed package
    notes: Platform-side throughput is governed by the subscribed Integration Starter / Advanced / API
      Management package capacity rather than by an HTTP rate ceiling.
policies:
  - name: Customer-owned throttling
    description: MuleSoft's role is to enforce policies the API owner configures — there is no MuleSoft-supplied
      default RPS for customer APIs. Choose Rate-Limiting (single-threshold) or Rate-Limiting SLA (per-client-app
      contract).
  - name: Distributed quotas
    description: When 'Distributed' is enabled on Flex Gateway, quotas are shared across replicas via
      shared storage; if storage is unreachable, the 'Block on unknown quota' option determines whether
      requests are blocked or allowed.
  - name: Replica scope
    description: A Rate-Limiting SLA policy is scoped to Flex Gateway replicas, not the gateway as a whole.
      Local Mode does not support the policy.
  - name: Header exposure
    description: When 'Expose Headers' is enabled, X-Ratelimit-Limit, X-Ratelimit-Remaining, and X-Ratelimit-Reset
      (in milliseconds) are returned to the client.
  - name: Credential failures
    description: 401 is returned when the client_id (and optional client_secret) DataWeave expression
      cannot resolve a valid registered client application.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com