rate-limit
Caps how many requests a client — or any bucket you define — can make in a time window.
| Phases | on_http_request |
| Terminating | No — the next action runs after it. |
| Cost | 1 Traffic Policy unit per run · not on the Free plan |
Example
policy.yaml
on_http_request:
- name: RateLimitCallers
actions:
- type: rate-limit
config:
name: Allow 30 requests per minute per client
algorithm: sliding_window
capacity: 30
rate: 60s
bucket_key:
- conn.client_ip
Start an agent endpoint with it: devgate http 8080 --traffic-policy-file policy.yaml, or paste it into a
reserved or cloud endpoint’s Traffic Policy tab in the dashboard.
Configuration
| Field | Type | Description |
|---|---|---|
name required | string | Names the limit; buckets with the same name share counts. |
algorithm required | string | sliding_window. |
capacity required | integer | Requests allowed per window. |
rate required | duration | The window: a multiple of 10s between 60s and 24h, e.g. 60s or 10m. |
bucket_key required | list of expressions | 1 to 10 CEL expressions whose values together pick the bucket, e.g. conn.client_ip. |
enforce | boolean | When false, requests aren’t blocked; the result is only recorded. Default: true. |
Result variables
After it runs, later rules can read what it decided:
-
actions.ngrok.rate_limit.limited— Whether this request was over the limit. -
actions.ngrok.rate_limit.bucket_key— The bucket it was counted in.
Behaviour
- Over the limit, the client gets 429 with a Retry-After header.
Other actions
add-headers remove-headers compress-response basic-auth oauth openid-connect jwt-validation custom-response deny redirect url-rewrite restrict-ips circuit-breaker verify-webhook http-request set-vars log close-connection forward-internal