The enhancement
The Need
Both Octopus Cloud and self-hosted customers inform us that sometimes they encounter misbehaving scripts or third party integrations which send excessive numbers of requests to the API. This increases load on the server, and can slow down or other work or cause it to fail.
Rate limiting is an industry-standard mitigation for this kind of problem.
Solution
Octopus Server now includes rate limiting functionality, configurable by privileged users in both Octopus Cloud and self-hosted installations.
Please refer to our documentation at https://octopus.com/docs/administration/managing-infrastructure/rate-limiting for an explanation of the rate limiting feature and how to configure it.
Version Applicability
For Octopus Cloud instances created after August 2026, and self-hosted installations of Octopus Server created with version 2026.3 or newer, all rate limiting policies are enabled by default.
For Cloud instances created before August 2026, or self-hosted installations created with 2026.2 or earlier versions, the rate limiting feature is a new addition when they upgrade to 2026.3 or the latest Octopus Cloud version. When these instances upgrade, the Unauthenticated and Authenticated (non-AI) policies will stay disabled to avoid breaking pre-existing workflows. The Authenticated AI policy will be enabled.
The enhancement
The Need
Both Octopus Cloud and self-hosted customers inform us that sometimes they encounter misbehaving scripts or third party integrations which send excessive numbers of requests to the API. This increases load on the server, and can slow down or other work or cause it to fail.
Rate limiting is an industry-standard mitigation for this kind of problem.
Solution
Octopus Server now includes rate limiting functionality, configurable by privileged users in both Octopus Cloud and self-hosted installations.
Please refer to our documentation at https://octopus.com/docs/administration/managing-infrastructure/rate-limiting for an explanation of the rate limiting feature and how to configure it.
Version Applicability
For Octopus Cloud instances created after August 2026, and self-hosted installations of Octopus Server created with version 2026.3 or newer, all rate limiting policies are enabled by default.
For Cloud instances created before August 2026, or self-hosted installations created with 2026.2 or earlier versions, the rate limiting feature is a new addition when they upgrade to 2026.3 or the latest Octopus Cloud version. When these instances upgrade, the Unauthenticated and Authenticated (non-AI) policies will stay disabled to avoid breaking pre-existing workflows. The Authenticated AI policy will be enabled.