## Problem statement We have fairly commonly used API endpoints that do not have their own rate limits right now. These endpoints can be fairly heavy depending on the structure of the groups, and should have their own specific endpoints. ### Proposed rate limits for each endpoint | Endpoint | Rate limit per user or IP | |-------------------------------------------------|------------------------------| | GET /api/v4/users/:id/followers | 100 requests per minute | | GET /api/v4/users/:id/following | 100 requests per minute | | GET /api/v4/users/:user_id/status | 240 requests per minute | | GET /api/v4/users/:user_id/keys | 120 requests per minute | | GET /api/v4/users/:id/keys/:key_id | 120 requests per minute | | GET /api/v4/users/:id/gpg_keys | 120 requests per minute | | GET /api/v4/users/:id/gpg_keys/:key_id | 120 requests per minute | | GET /api/v4/users/:user_id/projects | 300 requests per minute | | GET /api/v4/users/:user_id/contributed_projects | 100 requests per minute | | GET /api/v4/users/:user_id/starred_projects | 100 requests per minute | | GET /api/v4/projects | 2000 requests per 10 minutes | | GET /api/v4/groups/:id/projects | 600 requests per minute | | GET /api/v4/projects/:id | 400 requests per minute | | GET /api/v4/groups | 200 requests per minute | | GET /api/v4/groups/:id | 400 requests per minute | See the following issues for more details: - https://gitlab.com/gitlab-org/gitlab/-/issues/452349+ - https://gitlab.com/gitlab-org/gitlab/-/issues/421909+ ## Exit criteria 1. Rate limits implemented for all specified API endpoints with proposed limits 2. Feature flag mechanism in place for controlled rollout 3. Rate limiting configurable by self-managed administrators 4. Customer communication for GitLab.com users exceeding proposed limits ## DRI @abdwdd @lohrc