PortSwigger · Rate Limits

Portswigger Rate Limits

PortSwigger Burp Suite DAST APIs do not publish explicit per-minute or per-hour request rate limits in public documentation. The PAYS (Pay-as-you-scan) model enforces a default cap of 500 scan-hours per month, adjustable upon request. API access is gated by API key authentication and role-based permissions.

Portswigger Rate Limits is the machine-readable rate-limit profile for PortSwigger on the APIs.io network, in the API Commons Rate Limits shape.

It captures 3 rate-limit definitions, measuring requests_per_minute and scan_hours_per_month.

Limit state is signalled in the retryAfter response header, and an exhausted limit returns HTTP 429.

This profile was written by API Evangelist and has not been verified against a page the provider published; treat every limit as unconfirmed until a dated transcription replaces it.

The profile also includes response codes documented for throttled.

Tagged areas include Rate Limiting, DAST, and API Security.

3 Limits Exhausted: HTTP 429 retryAfter
Method: generated, dated 2026-06-12.
Written by API Evangelist on 2026-06-12 and not verified against a page the provider published. Treat every limit as unconfirmed until a dated transcription replaces it.
View Source
Rate LimitingDASTAPI Security

Limits

DAST GraphQL API Requests key
requests_per_minute · minute
-1
No explicit rate limit documented. Requests are authenticated via API key and subject to role-based access control. Contact PortSwigger for enterprise-specific limits.
DAST REST API Requests key
requests_per_minute · minute
-1
No explicit rate limit documented. Requests require API key authentication. REST API exposes limited functionality compared to GraphQL API.
PAYS Scan Hours Monthly Cap org
scan_hours_per_month · month
500
Default monthly scan hours cap for Pay-as-you-scan subscriptions. Cap is adjustable upon request. Scans run to completion even if the monthly limit is exceeded; overages are billed. Billed per minute, rounded to the nearest cent.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/portswigger-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.