Snyk · Rate Limits

Snyk Rate Limits

Snyk publishes an exact numeric ceiling: 1,620 requests per minute per API key, with a one-minute rate-limiting interval. Exceeding it returns 429 Too Many Requests, and Snyk states that all requests above the limit are rejected until requests stop for the duration of the interval. Snyk also reserves the right to introduce new limits without treating it as a breaking change, and tells clients to handle 429 and retry safely. Runtime signalling is thin: the REST OpenAPI declares a `retry-after` response header on the 429 responses of the two asynchronous export operations, but there are NO RateLimit-* or X-RateLimit-* headers anywhere in the contract, so a client cannot see how much budget it has left before it hits the wall - only that it has hit it.

Snyk Rate Limits is the machine-readable rate-limit profile for Snyk on the APIs.io network, conforming to the API Commons Rate Limits specification.

It captures 3 rate-limit definitions, measuring requests, tier_eligibility, and export_jobs.

The profile also includes 4 backoff/retry policies defined and response codes documented for throttled, unauthorized, and serverError.

Tagged areas include Security, DevSecOps, Rate Limiting, and Throttling.

3 Limits Throttle: 429
SecurityDevSecOpsRate LimitingThrottling

Limits

Per-API-key request rate api-key
requests · minute
1620
"There is a limit of 1620 requests per minute, per API key. All requests above the limit will get a response with the status code 429 - Too many requests until requests stop for the duration of the rate-limiting interval (one minute)." Applies to the REST API; Snyk documents no separate published figure for the V1 API.
API entitlement by plan account
tier_eligibility
enterprise-only
Not a throughput limit but the gate in front of it. Snyk states that for Free and Team plan users the personal token does not have access to the API and may be used only for IDE, CLI and CI/CD authentication. API use is an Enterprise entitlement, with service accounts recommended for automation.
Asynchronous export jobs organization
export_jobs
unpublished
POST /orgs/{org_id}/export and POST /groups/{group_id}/export are the only two operations in the contract that declare a 429 response, and they are the only two carrying a retry-after header. Snyk does not publish the concurrency number; the contract only tells you that these operations can be throttled and will tell you how long to wait.

Policies

Retry on 429
Snyk states that clients are expected to handle 429 correctly and that such requests can be retried later safely. Where retry-after is present, honour it; elsewhere back off for the remainder of the one-minute interval.
New limits are not breaking changes
Snyk reserves the right to introduce new rate limits from time to time to maintain system health, and explicitly says this is not considered a breaking change. Clients must not treat the 1,620/min figure as a contract guarantee.
Prefer the Export API over pagination
For large data pulls use the asynchronous Export API rather than paginating issue lists, which is the pattern that most often exhausts the per-key budget.
Regional endpoint selection
Call the base URL for your tenant's region - api.snyk.io, api.us.snyk.io, api.eu.snyk.io or api.au.snyk.io. Tokens do not cross regions.

Sources

Work with this as data

Every rate limit here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for rate limits

4 MCP tools reach this
  • find_rate_limitsBrowse and filter every rate limit in the catalog.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This rate limit 
curl "https://apis.io/api/v1/rate-limits/snyk-rate-limits"
All rate limits 
curl "https://apis.io/api/v1/rate-limits?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.