specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: NGINX
providerId: nginx
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Rate Limiting
  - API Gateway
  - Reverse Proxy
  - Web Server
description: NGINX is itself a rate-limiting infrastructure component, not a SaaS API. The relevant "rate
  limits" are the configurable directives that NGINX exposes for downstream services — limit_req_zone,
  limit_conn_zone, and the leaky-bucket algorithm — plus the management-API rate limits that NGINX Plus
  / NGINX One expose for monitoring and configuration.
sources:
  - https://nginx.org/en/docs/http/ngx_http_limit_req_module.html
  - https://nginx.org/en/docs/http/ngx_http_limit_conn_module.html
  - https://docs.nginx.com/nginx/admin-guide/security-controls/controlling-access-proxied-http/
responseCodes:
  throttled: 503
  configuredOverride: 429
limits:
  - name: limit_req_zone (configurable directive)
    scope: configurable (key — typically client IP)
    metric: requests_per_second
    limit: configurable per-zone via rate=Nr/s
    notes: Leaky-bucket algorithm; supports burst= and nodelay options. Default rejection status is 503;
      override with limit_req_status 429.
  - name: limit_conn_zone (configurable directive)
    scope: configurable (key — typically client IP)
    metric: concurrent_connections
    limit: configurable per-zone
    notes: Bounds simultaneous connections per key.
  - name: limit_rate (configurable directive)
    scope: connection
    metric: bytes_per_second
    limit: configurable
    notes: Bandwidth-limiting per response.
  - name: NGINX Plus API
    scope: instance
    metric: varies
    limit: see NGINX Plus management API docs
    notes: Local management API; not externally rate-limited.
  - name: NGINX One Console API
    scope: tenant
    metric: varies
    limit: see NGINX One docs
    notes: SaaS-side limits not publicly documented.
policies:
  - name: Leaky-bucket algorithm
    description: limit_req uses leaky-bucket; configure rate, burst, and nodelay to balance steady-state
      vs short bursts.
  - name: Configurable rejection status
    description: Default 503; set `limit_req_status 429;` to return Retry-After-friendly 429s instead.
  - name: Distributed limits
    description: Per-instance shared-memory zones do not synchronize across NGINX instances; use NGINX
      Plus key-value store with cluster-wide state, or external Redis-backed limiter, for fleet-wide quotas.
  - name: Configuration via signal reload
    description: Apply config changes via `nginx -s reload`; SIGHUP reloads config without dropping connections.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com