CrowdStrike · Rate Limits

Crowdstrike Rate Limits

CrowdStrike Falcon signals rate limiting on every response with X-Ratelimit-Limit and X-Ratelimit-Remaining, and returns HTTP 429 on exhaustion — 429 is a documented response on operations across the reference including POST /oauth2/token. The numeric ceiling is NOT published in prose anywhere on the public developer surface, but it is observable: an unauthenticated caller is served X-Ratelimit-Limit: 300 with a decrementing X-Ratelimit-Remaining on api.crowdstrike.com. Per-tenant and per-collection ceilings are stated only inside the authenticated Falcon console.

Crowdstrike Rate Limits is the machine-readable rate-limit profile for CrowdStrike on the APIs.io network, in the API Commons Rate Limits shape.

It captures 2 rate-limit definitions, measuring requests and varies.

Limit state is signalled in the limit, remaining, region, and trace response headers, and an exhausted limit returns HTTP 429.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled, quotaExceeded, and serviceUnavailable.

Tagged areas include Cybersecurity, Endpoint Security, Rate Limiting, Quotas, and Throttling.

2 Limits Exhausted: HTTP 429 Quota: 429 limitremainingregiontrace
Read from the provider's live responses on 2026-09-19 — live unauthenticated probe of api.crowdstrike.com/oauth2/....
View Source
CybersecurityEndpoint SecurityRate LimitingQuotasThrottling

Limits

Observed default ceiling (unauthenticated edge) api-client
requests · per unstated
300/unstated
The header names a limit of 300 and a decrementing remainder; the WINDOW is not stated in the header or the docs.
Per-service-collection limits api-client
varies
Limits are scoped per service collection (Detects, Hosts, RTR, Spotlight, IOC …) and their numbers are published only inside the authenticated Falcon console. Not guessed here.

Policies

OAuth2 token reuse
Tokens are issued by POST /oauth2/token and expire after 30 minutes; cache and reuse until expiry rather than minting per request.
Backoff on 429
No Retry-After is returned, so exponential backoff with jitter is the only available strategy; read X-Ratelimit-Remaining to back off before exhaustion.
Pagination over polling
Use offset/limit (meta.pagination.total) on listing endpoints rather than tight polling loops.
Stream instead of poll
For continuous change, subscribe to the Event Streams datafeed rather than repeatedly querying — see asyncapi/crowdstrike-event-streams.yml.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/crowdstrike-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.