specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Open Policy Agent
providerId: open-policy-agent
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: false
tags:
  - Policies
  - Standards
  - Rate Limiting
  - Open Source
notes: OPA is self-hosted open-source software. Rate limits are determined by the operator's deployment
  (CPU, memory, replicas) rather than by an upstream provider. The project does not publish hosted-API
  rate limits because there is no hosted API.
description: Open Policy Agent has no centrally enforced rate limits because the engine is operated by
  the consumer. Throughput depends on the deployment topology (sidecar, daemonset, library) and underlying
  hardware. Operators commonly front OPA with their own gateway and apply throttling there.
responseCodes:
  throttled: 429
limits:
  - name: Self-hosted throughput
    scope: deployment
    metric: varies
    limit: see operator deployment sizing
    notes: OPA throughput is bounded by host CPU and policy complexity; benchmark for your workload.
policies:
  - name: Operator-controlled
    description: Because OPA is self-hosted, all rate limiting is the operator's responsibility — typically
      enforced by an upstream API gateway, service mesh, or ingress controller.
  - name: Decision caching
    description: Use bundle service polling and decision caching to reduce evaluation pressure under high
      query rates.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com