HashiCorp Cloud Platform · Rate Limits

Hcp Rate Limits

HCP enforces API rate limits per authenticated user (or per IP for unauthenticated requests). The headline limit for HCP Terraform is ~30 requests/second across most endpoints. Sensitive endpoints have stricter ceilings — SMS/2FA at 5 requests/minute, email-sending at 10–100 requests/minute (per endpoint), and certain account operations at 40 requests/hour. Limits are scoped per user, so multiple tokens issued to the same user share the budget. Other HCP products (Vault, Consul, Boundary, Packer, Waypoint) inherit the HCP platform throttling layer.

Hcp Rate Limits is the machine-readable rate-limit profile for HashiCorp Cloud Platform on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 4 rate-limit definitions, across the all tier, measuring requests_per_second, requests_per_minute, and requests_per_hour.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled, quotaExceeded, and serviceUnavailable.

Tagged areas include Cloud, Infrastructure, DevOps, Secrets Management, and Service Networking.

4 Limits Throttle: 429 Quota: 429
CloudInfrastructureDevOpsSecrets ManagementService NetworkingRate LimitingQuotasThrottling

Limits

HCP Terraform — Default API rate user-or-ip
requests_per_second · second
30
Documented for HCP Terraform; other HCP products share the platform throttling layer.
SMS / 2FA endpoints user
requests_per_minute · minute
5
Email-sending endpoints user
requests_per_minute · minute
10–100
Specific endpoints fall in the 10–100/min band; verify per-endpoint.
Account operations user
requests_per_hour · hour
40

Policies

Per-User Scoping
Rate limits are scoped per authenticated user, not per token — multiple tokens issued to the same user share the limit budget.
Backoff Strategy
On HTTP 429 with the JSON-API error 'You have exceeded the API's rate limit', back off and retry with jitter; honor Retry-After when present.
Sensitive Endpoint Throttling
SMS/2FA, email, and account-mutation endpoints have tighter ceilings than the default 30 rps; design clients accordingly.
Unauthenticated Requests
Unauthenticated requests are bucketed by source IP rather than user.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/hcp-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no email required.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.