ZDX GraphQL API Rate Limits
Rate limits for the ZDX GraphQL API are based on the license tier level.
| Tier Level | Number of Licenses | Requests/second | Requests/minute | Requests/hour | Requests/day |
|---|---|---|---|---|---|
| 1 | 5,000 | 5 | 30 | 1,000 | 10,000 |
| 2 | 20,000 | 5 | 60 | 3,000 | 15,000 |
| 3 | 40,000 | 5 | 120 | 6,000 | 30,000 |
| 4 | 100,000 | 12 | 300 | 15,000 | 75,000 |
| 5 | More than 100,000 | 12 | 450 | 22,500 | 150,000 |
NOTE
For a fleet of 5,000 devices configured with first: 1000, a full sweep requires only 5 calls. Sweeping is resource efficient. Budget exhaustion typically occurs due to per-application metric fan-out (such as calling web_app_metrics(app_id: ...) with one application per filter).
ZDX GraphQL API sends Rate Limit headers in the response to provide information about the current status of rate limits. Users can use the Rate Limit headers to plan ahead for their API integration to prevent reaching the limit.
The Rate Limit headers are:
x-ratelimit-limit: The rate limit ceiling that is applicable for the current API request.x-ratelimit-remaining: The number of API requests remaining for the current rate limit window.x-ratelimit-reset: The time (in seconds) remaining in the current window, after which the rate limit resets.