PingOne Platform APIs

Rate Limiting

We use rate limiting for all PingOne multi-tenant products. This ensures PingOne services' availability to all tenants is not degraded due to attacks, or to any one tenant’s excessive volume of requests or messages. Rate limits are defined per License, and shared by all environments assigned to that license. As opposed to PingOne usage entitlements that limit active user transactions per year, rate limiting affects the number of API requests you’re allowed to make per second. The rate limits can also simplify your load testing by reducing the necessary scope. Refer to Load Testing for more information. Refer also to PingOne Platform Limits for limits applied to services and their resources.

We’ve defined base rate limits that are intended to be sufficient for most tenants’ usage requirements. These base rate limits apply to all tenants. Refer to Base rate limits for details. However, through the Maximum Throughput Assurance program, you’re able to purchase higher rates if needed.

You can be alerted when traffic levels approach or exceed the limits of the license by:

  • Subscribing to rate limit alerts in the admin console. Refer to Alerts for more information.

  • Viewing events generated by the Audit service when thresholds are reached or exceeded. Refer to Audit for more information.

  • Viewing the API Usage Dashboard in the admin console to see peak usage history and trends. Refer to API Usage Dashboard for more information.

Requests that exceed the rate limits will be rejected with the 429 error, REQUEST_LIMITED. When this error occurs, the following header is returned in the response:

`Retry-After`
The delay in seconds indicating how long to wait before retrying the request.

Avoiding rate limiting issues

Some options to consider if you’re hitting rate limits:

  • Limit concurrent requests

    Check whether a client app is spawning an excessive number of concurrent requests or messages. This can cause the HTTP API requests to go over quota. To avoid this, set a limit on the number of threads used by the client app when these contribute to the total concurrent requests or messages, then adjust this limit for optimal throughput within the rate limit bounds.

  • Use message queues

    Message queues can be useful to control the rate of requests. Multiple operations can push messages to the queue, and you can implement throttlers to remain within the rate limits. If you hit a rate limit, you can adjust throttling, and resubmit the request.

  • Client-side throttling

    Implement client-side throttling to restrict the volume of requests or messages sent by the client app.

Assigning admin roles and permissions to this service

Admin role assignments determine access to PingOne APIs. When assigning admin roles to this service, refer to PingOne Permissions by Service for the service-specific permissions.

You can also choose to assign admin roles based on particular service resources. Refer to PingOne Permissions by Resource when assigning admin roles per service resources.

Admin assignments to roles are set by:

Refer to Roles Management for more information.

IP allow listing data model

Property Type Required Mutable Description

id

String

N/A

Read-only

The UUID of the rate limit configuration.

createdAt

String

N/A

Read-only

The date and time the rate limit configuration was created.

updatedAt

String

N/A

Read-only

The date and time the rate limit configuration was updated.

type

String

Required

Immutable

The type of rate limit configuration. Currently, the only type supported is "WHITELIST", indicating that the IP address in value is to be excluded from rate limiting.

value

String

Required

Immutable

The IP address (v4 or v6), or a CIDR range, for the IP address or addresses to be excluded.

Rate limit configuration errors

In addition to the general error codes, rate limit configuration operations can return the following errors:

HTTP status Top‑level code Detail code When it happens and what the response contains

400

INVALID_DATA

EMPTY_VALUE

Message: Validation Error : [<property> <message>]

When and details

When: A POST /rateLimitIpConfigs request omits the required type or value property

Details: must not be null for type, must not be blank for value, for example Validation Error : [type must not be null]

400

INVALID_DATA

INVALID_VALUE

Message: The request could not be completed. One or more validation errors were in the request.

When and details

When: A POST /rateLimitIpConfigs request supplies a value that is not a valid IPv4 or IPv6 address or CIDR range

Details: should be a IP address in V4 or v6 format or a CIDR range

400

INVALID_DATA

UNIQUENESS_VIOLATION

Message: The request could not be completed. One or more validation errors were in the request.

When and details

When: A POST /rateLimitIpConfigs request supplies a value (or a CIDR range containing the address) that an existing configuration in the environment already covers

Details: Another [<format>] config '<id>' exists that matches this new config or Multiple configs already exist matching the current config

400

INVALID_REQUEST

None

Message: The request could not be completed. The request was malformed or invalid.

When and details

When: A path identifier cannot be parsed as a UUID, the request body cannot be deserialized, or a type value that is not WHITELIST (the only supported value) fails request-body conversion

Details: For a JSON field conversion error (including an unsupported type value), the target is the field path. Otherwise no detail is returned.

403

ACCESS_FAILED

INSUFFICIENT_PERMISSIONS

Message: The request could not be completed. You do not have access to this resource.

When and details

When: The environment’s license is restricted (trial); IP rate limit configuration can only be changed for fully licensed environments

Details: Ip Rate Limit Config can only be changed for fully licensed environments.

403

ACCESS_FAILED

None

Message: The actor attempting to perform the request is not authorized.

When and details

When: The actor lacks the ratelimiting:create:rateLimitConfigs permission (POST), the ratelimiting:read:rateLimitConfigs permission (GET operations), or the ratelimiting:delete:rateLimitConfigs permission (DELETE)

Details: None.

404

NOT_FOUND

None

Message: The request could not be completed. The requested resource was not found.

When and details

When: GET /rateLimitIpConfigs/{configurationID} or DELETE /rateLimitIpConfigs/{configurationID} references a configuration that does not exist in the environment

Details: None. The 404 handler discards the more specific internal message (Unable to find rate limit config with id: '<id>' for environment '<envID>') and returns the standard NOT_FOUND default message.

429

REQUEST_LIMITED

None

Message: The request could not be completed. A rate or quota limit was reached. Please try again later.

When and details

When: The request exceeds the rate limit for its rate limit group (applies to all platform operations, not only rate limit configuration operations). The response includes a Retry-After header giving the delay in seconds before retrying

Details: None.