With the advent of AI, individuals now have the ability to generate heavy workloads / queries / etc that can impact service host APIs far more than previously. Buildkite currently has an Org level API rate limit which exposes the company to a material outage if 1 bad actor causes a spike in API access triggering a limit at the Org level.
This request is to eliminate the Org level rate limit and focus on rate access at the user / token level. This closes the risk exposure at the Org / Company level.
Hi William,
Thanks for reaching out via our Community forum. We understand your concern and I’d like to clarify that Buildkite supports per-user rate limits for both the REST and GraphQL APIs, alongside the organization-wide limit. When a user reaches their individual limit, their requests are throttled; that does not, by itself, throttle other users. Human and machine users can have separately configured limits, allowing different allowances for individual usage and automation.
A few important details:
- Limits apply to the authenticated user associated with the API token, rather than independently to each token. Separate tokens belonging to the same user therefore share that user’s allowance.
- Requests count toward both limits, so aggregate usage can still exhaust the organization’s allowance. Per-user limits provide an additional safeguard rather than replace the shared limit.
- For existing organizations, per-user limits are initially set to match the organization-wide limit to preserve existing integrations. We can help apply stricter per-user limits to reduce the risk of one user consuming the shared allowance.
We’d be happy to review your organization’s current human-user, machine-user, and organization-wide limits with you, and help determine appropriate settings for your workloads.
For more information:
Organization administrators can also view the applicable per-user limits under Settings → Quotas.
Hope that helps. Let me know if you have any further questions.
Thanks,
Dahtey