specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: National Institute of Standards and Technology (NIST)
providerId: nist
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Rate Limiting
  - Cybersecurity
  - Government
  - Public Data
description: NIST publishes explicit rate limits for the National Vulnerability Database (NVD) API. Anonymous
  callers get 5 requests per 30-second rolling window; callers with a free API key get 50 requests per
  30-second rolling window. Other NIST APIs (NIST Chemistry WebBook, Internet Time Service) do not document
  per-key limits but are subject to firewall-level DOS protection. NIST recommends a 6-second sleep between
  requests to stay within compliance.
sources:
  - https://nvd.nist.gov/developers/start-here
  - https://nvd.nist.gov/developers
responseCodes:
  throttled: 403
  forbidden: 403
limits:
  - name: NVD API — Anonymous
    scope: IP
    metric: requests_per_30_seconds
    limit: 5
    timeFrame: second
    notes: 30-second rolling window. Recommended 6-second sleep between requests.
  - name: NVD API — API Key
    scope: api_key
    metric: requests_per_30_seconds
    limit: 50
    timeFrame: second
    notes: 30-second rolling window. 10x increase over anonymous.
  - name: Other NIST APIs (Chemistry WebBook, Time Service, etc.)
    scope: IP
    metric: requests_per_second
    limit: see firewall fair-use policy
    notes: No published per-key RPS; firewall enforces DOS protection.
policies:
  - name: 6-second sleep recommendation
    description: NIST recommends sleeping ~6 seconds between requests so legitimate requests are not
      blocked by firewall DOS protection.
  - name: Free API key registration
    description: API keys are free and obtained via the NVD developer portal — request, accept Terms
      of Use, and activate via email link.
  - name: Firewall-level enforcement
    description: NIST firewall rules apply at the perimeter; 403 responses indicate firewall throttling
      rather than application-level 429.
  - name: Spread queries
    description: For full NVD ingest, paginate with resultsPerPage=2000 and use lastModStartDate / lastModEndDate
      windowed sync rather than re-querying the full dataset.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com