specification: API Commons Rate Limits
specificationVersion: '0.1'
schema: https://raw.githubusercontent.com/api-evangelist/interface-research/main/schema/api-commons.yml#/$defs/RateLimits
provider: Vendure
providerId: vendure
created: '2026-05-22'
modified: '2026-05-25'
tags:
  - Commerce
  - Headless
  - eCommerce
  - GraphQL
  - Open Source
  - TypeScript
  - NestJS
  - Rate Limiting
  - Throttling
description: >-
  Rate limit posture for Vendure. The open-source framework does not impose
  request rate limits — operators configure their own throttling at the
  edge (reverse proxy, CDN, API gateway) or via the harden-plugin. This
  document captures the operator-side controls Vendure exposes plus the
  GraphQL safety knobs shipped in `@vendure/harden-plugin`.
headers:
  limit: X-RateLimit-Limit
  remaining: X-RateLimit-Remaining
  reset: X-RateLimit-Reset
  retryAfter: Retry-After
responseCodes:
  throttled: 429
  serviceUnavailable: 503
operatorControls:
  - name: '@vendure/harden-plugin — apiMode'
    description: Disable GraphQL introspection on production Shop and Admin APIs.
    documentation: https://docs.vendure.io/
  - name: '@vendure/harden-plugin — maxQueryComplexity'
    description: Bound aggregate GraphQL query complexity to protect the server from expensive queries.
    documentation: https://docs.vendure.io/
  - name: '@vendure/harden-plugin — maxQueryDepth'
    description: Bound GraphQL query nesting depth.
    documentation: https://docs.vendure.io/
  - name: 'authOptions.requireVerification'
    description: Require email verification before NATIVE-auth customers can authenticate.
    documentation: https://docs.vendure.io/
  - name: 'apiOptions.cors'
    description: Restrict origins allowed to call the Shop and Admin APIs.
    documentation: https://docs.vendure.io/
limits: []
recoveryStrategies:
  - name: Exponential Backoff
    description: >-
      When an edge/proxy returns 429, wait Retry-After seconds (or back off
      exponentially up to 60s) before retrying. Vendure itself does not
      issue 429 responses.
  - name: Bulk Through Job Queue
    description: >-
      For large catalog or order workflows, prefer the Admin API job-queue
      pattern (e.g. reindex search, bulk imports) over hot inline mutations.
notes:
  - >-
    Vendure Core (`@vendure/core`) does not ship a built-in per-key request
    rate limiter. Production deployments are expected to terminate
    untrusted traffic at a reverse proxy / CDN / WAF (Cloudflare, NGINX,
    Fastly, AWS WAF) that imposes the operator's chosen limits.
  - >-
    Use `@vendure/harden-plugin` in production to disable introspection
    and limit query complexity/depth.
  - >-
    Vendure Cloud (design-partner / GA Q4 2026) may impose its own
    edge-level limits; consult the operator agreement for current values.