specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: NuGet
providerId: nuget
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Package Management
  - .NET
  - Packages
  - Registry
  - Rate Limiting
description: nuget.org does not publish numeric rate limits for the V3 HTTP API. Reads (PackageBaseAddress,
  RegistrationsBaseUrl, SearchQueryService) are CDN-fronted via api.nuget.org and tolerate normal client
  traffic; abusive or scraping traffic is throttled per-IP at the edge. The official client retries up
  to three times on 5xx responses. Authenticated push operations use X-NuGet-ApiKey and are throttled
  at the application layer.
notes: nuget.org does not document numeric rate limits; values below describe official-client behavior
  rather than published per-second ceilings. Reconciled flag is false until Microsoft publishes specific
  limits.
sources:
  - https://learn.microsoft.com/en-us/nuget/api/overview
  - https://learn.microsoft.com/en-us/nuget/api/nuget-protocols
responseCodes:
  throttled: 429
  serviceUnavailable: 503
  conflict: 409
limits:
  - name: nuget.org public reads
    scope: IP
    metric: varies
    limit: not numerically published; CDN-throttled per-IP
    applies:
      - NuGet Server API
      - NuGet Catalog API
      - NuGet Search API
      - NuGet Package Metadata API
      - NuGet Package Content API
  - name: Authenticated push
    scope: api-key
    metric: varies
    limit: not numerically published; abuse-throttled at the application layer
    applies:
      - NuGet Server API
policies:
  - name: Client retry behavior
    description: 'The official NuGet client retries up to three times on 500-level status codes or TCP/DNS
      errors. Recommended for third-party clients: exponential backoff with jitter on 429/503.'
  - name: Redirects
    description: GET responses may return 301/302; clients must follow Location headers and re-issue the
      GET.
  - name: Authentication scope
    description: Only the PackagePublish resource requires authentication via X-NuGet-ApiKey. All other
      V3 resources on nuget.org accept anonymous requests.
  - name: Bulk indexing
    description: Use the Catalog resource (commit-driven page log) rather than scraping search to mirror
      the registry; this is the supported pattern for full ingestion.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com