Open Status
API rate limits

API rate limits

Request budgets, response headers, and retry behavior.

Status applies rate limits at specified API endpoints. Limits are shared across web instances; requests consume the same budget regardless of which instance handles them.

BoundaryIdentityLimit
Deployment event ingestionAuthenticated account120/minute
Deployment event listingAuthenticated account300/minute
External alert ingestionAuthenticated account120/minute
Status-page password unlockClient IP + page5/10 minutes
Heartbeat pushClient IP600/minute
Public SVG badgesClient IP300/minute
Public RSS feedsClient IP300/minute

Authenticated limits are applied only after the session or scoped API key has been verified. Public routes use the client's address.

Protected responses include:

  • RateLimit-Limit
  • RateLimit-Remaining
  • RateLimit-Reset as a Unix timestamp
  • Retry-After on 429 Too Many Requests

Behind a reverse proxy

When Status sits behind a reverse proxy, configure it to overwrite X-Forwarded-For and enable Trust proxy headers in Settings → Instance. Status then uses the first valid forwarded address for IP-keyed limits.

Reverse proxies should still apply coarse connection and body-size limits before traffic reaches Status.

Related documentation