[DO NOT MERGE] Rate limits #1

dafortune · 2019-05-22T20:42:20Z

Global rate limits WIP

luuuis · 2019-05-23T12:16:37Z

articles/policies/rate-limits.md

+The rate limits for this API differ depending on whether your tenant is free or paid.
+
+::: note
+For all __free tenants__, Authentication API usage is restricted to 300 requests per minute. Note that the limit is set by tenant and not by endpoint.


Would we link to the "long" page from here?

If we decide to use both (my particular preference) then yes.

luuuis · 2019-05-23T12:21:11Z

articles/policies/global-limit.md

+useCase:
+  - support
+---
+# Authentication API: Global Rate Limit Policy


I can't find the document right now but I seem to remember reading (and talking to others) about how our SLA covers the Authentication API only.

So we may want to be careful about calling these sets of endpoints the Authentication API as that might cause confusion if we use a different definition here than elsewhere.

How would you call them?

Firstly, I'm not 100% sure having "Authentication API" in there is a problem, just raising it here for discussion.

What if the short paragraph below was called "Free Tenants Global Rate Limit Policy" and at the same level as https://auth0.com/docs/policies/rate-limits#endpoints-with-rate-limits?

Then this could just be the "Free Tenants Global Rate Limit Policy" details page.

khorne3 · 2019-05-24T18:04:09Z

articles/policies/global-limit.md

+# Authentication API: Global Rate Limit Policy
+To ensure the quality of Auth0's services, the Authentication API is subject to several levels of rate limiting.
+
+This document describes the global rate limiting policy applicable to __free tenants__. Please visit [Rate limits](policies/rate-limits) for more information on other applicable limits.


URL should be /policies/rate-limits

khorne3 · 2019-05-24T18:04:59Z

articles/policies/global-limit.md

+It is important to consider that the limit is set globally by tenant and not by endpoint.
+
+### Affected endpoints
+The global rate limit applies to all the [Authentication API](/api/authentication) endpoints, below you will find a complete list of endpoints that are affected by this limit and the associated response in case the rate limit is exceeded.


The global rate limit applies to all the Authentication API endpoints. Below you will find a complete list of endpoints that are affected by this limit and the associated response if you exceed the rate limit.

khorne3 · 2019-05-24T18:08:26Z

articles/policies/global-limit.md

+`GET /v2/logout` | [Error Page](#error-page)
+
+## Exceeding the Rate Limit
+If you exceed the provided rate limit for a given API endpoint, you will receive a response with [HTTP Status Code 429 (Too Many Requests)](http://tools.ietf.org/html/rfc6585#section-4) except for the cases documented above. The response will also contain the [HTTP Response Headers](policies/rate-limits#http-response-headers) which you can refer to for more information on the rate limits applicable to that endpoint.


If you exceed the rate limit for a given API endpoint, you'll receive an HTTP 429 (Too Many Requests) response (except for the cases documented in the section immediately above. The response will also contain HTTP Response Headers that provide additional information on the rate limits applicable to that endpoint.

khorne3 · 2019-05-24T18:11:10Z

articles/policies/global-limit.md

+If you exceed the provided rate limit for a given API endpoint, you will receive a response with [HTTP Status Code 429 (Too Many Requests)](http://tools.ietf.org/html/rfc6585#section-4) except for the cases documented above. The response will also contain the [HTTP Response Headers](policies/rate-limits#http-response-headers) which you can refer to for more information on the rate limits applicable to that endpoint.
+
+### Response body
+The response body depends on the endpoint and, in particular, the response the endpoint was meant to render originally. For example, if the response was meant to render JSON, then a JSON error response will be sent.


The response body you receive depends on the endpoint itself, as well as the response the endpoint was meant to send originally. For example, if the original response expected was JSON, then a JSON error response will be sent if there are any issues.

The following sections provide additional information about the errors possible.

khorne3 · 2019-05-24T18:12:20Z

articles/policies/global-limit.md

+The particular response per endpoint is stated in [Affected endpoints](#affected-endpoints) section, below you will find a description for each case.
+
+#### Error Page
+This response is sent for endpoints that render HTML content to the end user. When the rate limit is exceeded the [Error Page](https://auth0.com/docs/universal-login/custom-error-pages) will be rendered instead of the usual content.


The Error Page response is sent for endpoints that render HTML content to the end user. When you exceed the rate limit, Auth0 renders the Error Page instead of the expected content.

khorne3 · 2019-05-24T18:15:35Z

articles/policies/global-limit.md

+- `fed:BadRequest` will be sent for WSFED-related endpoints.
+- `wst:RequestFailed` will be used in for WSTrust-related endpoints.
+
+```xml


Again, maybe move the sample to follow the first sentence of this section?

khorne3 · 2019-05-24T18:20:34Z

articles/policies/global-limit.md

+</env:Envelope>
+```
+
+## FAQ


We try to avoid FAQ sections, so let's turn these into headers and move them to near the top of the page:

Exceeding the rate limit

For every hour that you exceed the global rate limit, Auth0 will write the following to your logs: You have reached the global limit for your account.

You can search for the log entries using the Dashboard.

Reducing the number of calls to Auth0

When you exceed your rate limits, you'll need to reduce the number of calls you make to Auth0. The specifics of what you need to do depends on your use case, but here are some recommendations with which to begin:

Cache /.well-known/* information: this information does not change frequently, so you can usually cache it to reduce the number of times you need to call Auth0

Consider requesting an id_token instead of calling /userinfo to get information about the user

khorne3 · 2019-05-24T18:21:47Z

articles/policies/rate-limits.md

 ### Authentication API

-The following Auth0 Authentication API endpoints return rate limit-related headers.
+The rate limits for this API differ depending on whether your tenant is free or paid.


The rate limits for the Authentication API differ depending on whether you have a free or a paid tenant.

khorne3 · 2019-05-24T18:22:36Z

articles/policies/rate-limits.md

+::: note
+For all __free tenants__, Authentication API usage is restricted to 300 requests per minute. Note that the limit is set by tenant and not by endpoint.
+
+The tenants that have no credit card associated in the [Dashboard](${manage_url}/#/tenant/billing/payment) are free except for tenants associated to an enterprise subscription.


The tenants that have no credit card information associated in the Dashboard are considered to be free tenants (excepting tenants associated with an enterprise subscription).

khorne3 · 2019-05-24T18:24:54Z

articles/policies/rate-limits.md

+  <tr>
+    <td>(any request)</td>
+    <td>Free (*)</td>
+    <td>200 requests per minute</td>


200 or 300?

300, great catch

dafortune · 2019-05-28T15:47:03Z

@khorne3 applied your feedback, moved the faq inside ## Limits section because there was already an exceeding the rate limits section there

New RL

3d88c2a

luuuis reviewed May 23, 2019

View reviewed changes

khorne3 reviewed May 24, 2019

View reviewed changes

Applied feedback

5654bf2

dafortune force-pushed the rl branch from e5f54e8 to 5654bf2 Compare May 28, 2019 15:55

[DO NOT MERGE] Rate limits #1

Are you sure you want to change the base?

[DO NOT MERGE] Rate limits #1

Uh oh!

Conversation

dafortune commented May 22, 2019

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dafortune May 23, 2019 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Exceeding the rate limit

Reducing the number of calls to Auth0

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dafortune commented May 28, 2019

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dafortune May 23, 2019 •

edited

Loading