Non-configurable rate limits

  • Tier: Free, Premium, Ultimate
  • Offering: GitLab Self-Managed, GitLab Dedicated

GitLab enforces the following rate limits in the application.

Limit Rate limit Details
Changelog generation 5 calls per minute per user per project Applies to the :id/repository/changelog endpoint. The limit is shared between GET and POST actions.
Commit diff files 6 requests per minute Applies to expanded commit diff files (/[group]/[project]/-/commit/[:sha]/diff_files?expanded=1). The limit applies per user for authenticated requests, and per IP address for unauthenticated requests.
Delete a deployment 500 requests per minute per authenticated user Applies to deleting a deployment with DELETE /projects/:id/deployments/:deployment_id. Reduces the infrastructure impact of mass deployment deletions. Introduced in GitLab 19.2.
FogBugz import 1 triggered import per minute per user Applies to triggering project imports from FogBugz. Introduced in GitLab 17.6.
GitHub import 6 triggered imports per minute per user Applies to triggering project imports from GitHub.
New user accounts 20 calls per minute per IP address Applies to the /users/sign_up endpoint. Mitigates attempts to mass discover usernames or email addresses in use.
Notification emails 1,000 notifications per 24 hours per project or group per user Applies to notification emails related to a project or group. Generally available in GitLab 17.2.
Offline transfer exports and imports 6 requests per minute per user Applies to offline transfer exports and imports, which are limited separately. Introduced in GitLab 19.3.
Repository archives 5 requests per minute per user Applies to downloading repository archives through the UI or the API. The limit applies to the project and to the user who starts the download.
Repository blob and file access 5 calls per minute per object per project Applies to files larger than 10 MB on the repository blob and repository file endpoints. Introduced in GitLab 18.1.
Update username 10 calls per minute per authenticated user Limits how frequently a username can be changed. Mitigates attempts to mass discover which usernames are in use.
Username exists 20 calls per minute per IP address Applies to the internal /users/:username/exists endpoint, which checks whether a chosen username is taken.