> For the complete documentation index, see [llms.txt](https://docs.netmap.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.netmap.dev/api/rate-limits.md).

# Rate Limits

Rate limits protect expensive network tools, login, discovery, and API-key authentication. The values below are defaults from `backend/app/core/config.py`.

| Area                           | Default                                    |
| ------------------------------ | ------------------------------------------ |
| API key calls                  | 120 calls per 60 seconds per key           |
| Invalid API-key lookup lockout | 10 failures, then 15 minutes per source IP |
| Tools                          | 20 calls per 60 seconds                    |
| Discovery                      | 60 seconds between scans                   |
| Login failures                 | 5 failures, then 15 minutes                |

API-key rate limits return `429`.

## API-Key Call Limit

Each active API key has a fixed-window request counter. Default:

```dotenv
API_KEY_RATE_LIMIT_MAX_CALLS=120
API_KEY_RATE_LIMIT_WINDOW_SECONDS=60
```

When exceeded, NetMap returns:

```json
{"detail":"API key rate limit exceeded"}
```

## Invalid API-Key Lookup Lockout

Invalid API-key attempts are tracked per source IP. Default:

```dotenv
API_KEY_MAX_FAILED_LOOKUPS=10
API_KEY_LOOKUP_LOCKOUT_MINUTES=15
```

When locked, NetMap returns:

```json
{"detail":"Too many failed API key attempts; try again later"}
```

## Tools And Discovery

Network tools and discovery can generate traffic from the NetMap host, so they have separate limits:

```dotenv
TOOL_RATE_LIMIT_MAX_CALLS=20
TOOL_RATE_LIMIT_WINDOW_SECONDS=60
DISCOVERY_RATE_LIMIT_SECONDS=60
```

## Operational Guidance

* Back off on `429`; do not retry in a tight loop.
* Use one key per automation integration so usage is visible.
* Increase limits only when the host and database can support the request volume.
* Treat repeated invalid-key lockouts as a possible leaked or misconfigured secret.

## Related Pages

* [API-Key Problems](/troubleshooting/api-key-problems.md)
* [API Keys](/api/api-keys.md)
* [Configuration Reference](/configuration/configuration.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.netmap.dev/api/rate-limits.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.