Skip to main content

ZPA API Rate Limits

For each organization, all Zscaler Private Access (ZPA) API endpoints called from a specific IP address are subjected to the following rate limits:

  • 20 times in a 10-second interval for a GET call
  • 10 times in a 10-second interval for any POST/PUT/DELETE call

All rate limits start as soon as the first call is executed. Calls can occur more than once per second, but no more than the limits for each operation type.

When an API request exceeds the defined rate limit, an HTTP 429 response code is returned along with a response header that includes the retry-after field. This field indicates the time required to wait before the next API call is made to facilitate the retry mechanism. The following example is a response header that includes the retry-after field and the value 13s indicates 13 seconds of wait period:

{
 "content-type": "application/json",
 "date": "Wed, 6 Mar 2024 11:38 GMT",
 "retry-after": "13s"
}