National Institute of Standards and Technology (NIST) · Rate Limits

Nist Rate Limits

NIST publishes explicit rate limits for the National Vulnerability Database (NVD) API. Anonymous callers get 5 requests per 30-second rolling window; callers with a free API key get 50 requests per 30-second rolling window. Other NIST APIs (NIST Chemistry WebBook, Internet Time Service) do not document per-key limits but are subject to firewall-level DOS protection. NIST recommends a 6-second sleep between requests to stay within compliance.

Nist Rate Limits is the machine-readable rate-limit profile for National Institute of Standards and Technology (NIST) on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 3 rate-limit definitions, measuring requests_per_30_seconds and requests_per_second.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled and forbidden.

Tagged areas include Rate Limiting, Cybersecurity, Government, and Public Data.

3 Limits Throttle: 403
Rate LimitingCybersecurityGovernmentPublic Data

Limits

NVD API — Anonymous IP
requests_per_30_seconds · second
5
30-second rolling window. Recommended 6-second sleep between requests.
NVD API — API Key api_key
requests_per_30_seconds · second
50
30-second rolling window. 10x increase over anonymous.
Other NIST APIs (Chemistry WebBook, Time Service, etc.) IP
requests_per_second
see firewall fair-use policy
No published per-key RPS; firewall enforces DOS protection.

Policies

6-second sleep recommendation
NIST recommends sleeping ~6 seconds between requests so legitimate requests are not blocked by firewall DOS protection.
Free API key registration
API keys are free and obtained via the NVD developer portal — request, accept Terms of Use, and activate via email link.
Firewall-level enforcement
NIST firewall rules apply at the perimeter; 403 responses indicate firewall throttling rather than application-level 429.
Spread queries
For full NVD ingest, paginate with resultsPerPage=2000 and use lastModStartDate / lastModEndDate windowed sync rather than re-querying the full dataset.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/nist-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.