specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Ory
providerId: ory
created: '2026-05-04'
# Provenance stamped 2026-08-11: this artifact was written by the API Evangelist
# bulk sweep dated 2026-05-04, not harvested from the provider. See roadmap#35.
method: generated
modified: '2026-05-05'
reconciled: true
tags:
  - Rate Limiting
  - Identity
  - OAuth2
  - OpenID Connect
  - CIAM
description: Ory Network enforces per-project rate limits scaled by subscription plan and
  environment type (production vs dev/staging). Each policy combines a burst limit (requests
  per second) and a sustained limit (requests per minute). Limits documented here apply
  specifically to the /sessions/whoami endpoint as published; many other endpoints have their
  own service-specific quotas. Endpoints return HTTP 429 when limits are exceeded.
sources:
  - https://www.ory.com/docs/guides/rate-limits
responseCodes:
  throttled: 429
  quotaExceeded: 429
limits:
  - name: Developer plan (all environments) - /sessions/whoami
    scope: project/environment
    metric: requests_per_second
    limit: 10
    timeFrame: second
    notes: Sustained limit 300 rpm. Applies to Developer (free) plan in all environments.
  - name: Production plan - production environment - /sessions/whoami
    scope: project/environment
    metric: requests_per_second
    limit: 80
    timeFrame: second
    notes: Sustained 1800 rpm in production environment.
  - name: Production plan - dev/staging - /sessions/whoami
    scope: project/environment
    metric: requests_per_second
    limit: 10
    timeFrame: second
    notes: Sustained 300 rpm. Dev/staging environments retain Developer-tier limits.
  - name: Growth plan - production environment - /sessions/whoami
    scope: project/environment
    metric: requests_per_second
    limit: 800
    timeFrame: second
    notes: Sustained 18000 rpm in production environment.
  - name: Growth plan - dev/staging - /sessions/whoami
    scope: project/environment
    metric: requests_per_second
    limit: 10
    timeFrame: second
    notes: Sustained 300 rpm.
  - name: Enterprise plan - production environment - /sessions/whoami
    scope: project/environment
    metric: requests_per_second
    limit: 1200
    timeFrame: second
    notes: Sustained 36000 rpm in production environment.
  - name: Enterprise plan - dev/staging - /sessions/whoami
    scope: project/environment
    metric: requests_per_second
    limit: 10
    timeFrame: second
    notes: Sustained 300 rpm.
  - name: Other endpoints
    scope: project/environment
    metric: varies
    limit: see service-specific rate limits in the Ory rate-limits guide
    notes: Identity, session, OAuth2, and permission endpoints have their own per-endpoint
      burst/sustained policies tied to the same plan tiers.
policies:
  - name: Burst vs Sustained
    description: Each policy defines a burst (requests per second) and sustained (requests
      per minute) limit. Both must be respected.
  - name: Inflight Protection
    description: Write operations on identity and session endpoints have additional inflight
      protection that returns HTTP 429 when concurrency exceeds the policy limit.
  - name: Backoff
    description: Clients receiving 429 responses should pause and retry with exponential
      backoff and jitter; specific Retry-After semantics are not documented.
  - name: Plan Scoping
    description: Limits scale by both plan tier and environment type. Dev and staging environments
      retain Developer-tier ceilings even on paid plans.
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com