> ## Documentation Index
> Fetch the complete documentation index at: https://auth0.generaltranslation.app/llms.txt
> Use this file to discover all available pages before exploring further.

> Rate limits for the self service public subscription type

# Self Service

See below for the rate limit policies for the Self service subscription type.

<AccordionGroup>
  <Accordion title="Authentication API: Rate Limits for the Authentication API and API Endpoints in the Self service subscription type.">
    <table class="table">
      <thead>
        <tr>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#api-rate-limits">API</a></th>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm">Burst Request Limit</a></th>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm">Sustained Request Limit</a></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td>Authentication API</td>
          <td>25</td>
          <td>25/second</td>
        </tr>
      </tbody>
    </table>

    <table class="table">
      <thead>
        <tr>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#endpoint-rate-limits">Endpoint</a></th>
          <th>Method</th>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm">Burst Request Limit</a></th>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm">Sustained Request Limit</a></th>
          <th>Limit Type</th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><a href="https://auth0.com/docs/api/authentication#get-user-info">User Info</a></td>
          <td><code>GET</code>, <code>POST</code></td>
          <td>10</td>
          <td>5/minute</td>
          <td>To a unique User ID</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/authentication#change-password">Change Password</a> <br /><br /> <a href="/docs/authenticate/database-connections/password-change#universal-login-page">Reset Password with Universal Login</a></td>
          <td><code>POST</code></td>
          <td>10</td>
          <td>1/minute</td>
          <td>From an IP Address to a unique Email Address</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/authentication#passwordless">Get Passwordless Code or Link</a></td>
          <td><code>GET</code>, <code>POST</code></td>
          <td>50</td>
          <td>50/hour</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/authentication#verify-with-one-time-password-otp-">Native Social Login (Apple / Facebook Only)</a></td>
          <td><code>POST</code></td>
          <td>50</td>
          <td>500/minute</td>
          <td>Any Request for Apple or Facebook Native Social Login</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/authentication#dynamic-application-client-registration">Dynamic Application (Client) Registration</a></td>
          <td><code>POST</code></td>
          <td>5</td>
          <td>5/second</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/authentication#global-token-revocation">Universal Logout</a></td>
          <td><code>POST</code></td>
          <td>35</td>
          <td>35/second</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>Pushed Authorization Requests (PAR)</td>
          <td><code>POST</code></td>
          <td>100</td>
          <td>100/second</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>Back-Channel authorize (CIBA)</td>
          <td><code>POST</code></td>
          <td>500</td>
          <td>500/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>Device code activation (no prompt)</td>
          <td><code>POST</code></td>
          <td>30</td>
          <td>6/second</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>Device code authorization</td>
          <td><code>POST</code></td>
          <td>5</td>
          <td>5/second</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>MFA OOB token exchange</td>
          <td><code>POST</code></td>
          <td>12</td>
          <td>12/minute</td>
          <td>To a unique session</td>
        </tr>
      </tbody>
    </table>

    \*Represents the default limit. You can configure the Signup endpoint limit in Auth0 Dashboard. To learn more, read [Suspicious IP Throttling](/docs/secure/attack-protection/suspicious-ip-throttling).
  </Accordion>

  <Accordion title="Management API: Rate Limits for the Management API, API Endpoints, and API Endpoint Groups in the Self service subscription type.">
    <table class="table">
      <thead>
        <tr>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#endpoint-rate-limits"><strong>Endpoint</strong></a></th>
          <th><strong>Method</strong></th>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm"><strong>Burst Request Limit</strong></a></th>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm"><strong>Sustained Request Limit</strong></a></th>
          <th><strong>Limit Type</strong></th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/get-organizations">Read Organizations</a></td>
          <td><code>GET</code></td>
          <td>5</td>
          <td>50/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/get-organizations-by-id">Read Organizations by ID</a></td>
          <td><code>GET</code></td>
          <td>20</td>
          <td>200/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/get-name-by-name">Read Organizations by Name</a></td>
          <td><code>GET</code></td>
          <td>10</td>
          <td>100/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/post-organizations">Write Organizations</a></td>
          <td><code>POST</code>, <code>PATCH</code>, <code>DELETE</code></td>
          <td>5</td>
          <td>25/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/get-members">Read Organization Members</a></td>
          <td><code>GET</code></td>
          <td>40</td>
          <td>500/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/post-members">Write Organization Members</a></td>
          <td><code>POST</code>, <code>DELETE</code></td>
          <td>20</td>
          <td>200/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/get-members">Read Members of an Organization</a></td>
          <td><code>GET</code></td>
          <td>20</td>
          <td>200/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/get-organization-member-roles">Read Organization Member Roles</a></td>
          <td><code>GET</code></td>
          <td>20</td>
          <td>200/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/post-organization-member-roles">Write Organization Member Roles</a></td>
          <td><code>POST</code>, <code>DELETE</code></td>
          <td>20</td>
          <td>200/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/get-enabled-connections">Read Organization Connections</a></td>
          <td><code>GET</code></td>
          <td>5</td>
          <td>50/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/post-enabled-connections">Write Organization Connections</a></td>
          <td><code>POST</code>, <code>PATCH</code>, <code>DELETE</code></td>
          <td>5</td>
          <td>25/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/users/get-users">Read Users</a></td>
          <td><code>GET</code></td>
          <td>40</td>
          <td>500/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/users/post-users">Write Users</a></td>
          <td><code>POST</code>, <code>PATCH</code></td>
          <td>20</td>
          <td>200/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/users/delete-users-by-id">Write Users</a></td>
          <td><code>DELETE</code></td>
          <td>20</td>
          <td>200/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/logs/get-logs">Read Logs</a></td>
          <td><code>GET</code></td>
          <td>10</td>
          <td>100/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/clients/get-clients">Read Clients</a></td>
          <td><code>GET</code></td>
          <td>5</td>
          <td>100/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/connections/get-connections">Read Connections</a></td>
          <td><code>GET</code></td>
          <td>5</td>
          <td>50/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/device-credentials/post-device-credentials">Write Device Credentials</a></td>
          <td><code>POST</code>, <code>DELETE</code></td>
          <td>5</td>
          <td>100/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/custom-domains/post-verify">Write Custom Domain</a></td>
          <td><code>POST</code></td>
          <td>5</td>
          <td>5/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/connections/get-status">Read Status Connection</a></td>
          <td><code>GET</code></td>
          <td>100</td>
          <td>15/second</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/keys/post-signing-keys">Write Signing Keys</a></td>
          <td><code>POST</code></td>
          <td>5</td>
          <td>5/day</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/prompts/get-partials">Read Partials for a Prompt</a></td>
          <td><code>GET</code></td>
          <td>5</td>
          <td>5/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/prompts/put-partials">Write Partials for a Prompt</a></td>
          <td><code>PUT</code></td>
          <td>5</td>
          <td>5/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/clients/get-clients">Read Clients</a><p><br />Only applies to the usage of the <code>q</code> parameter.<br /></p></td>
          <td><code>GET</code></td>
          <td>5</td>
          <td>150/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/get-organization-client-grants">Read Organization Client Grants</a></td>
          <td><code>GET</code></td>
          <td>10</td>
          <td>100/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/organizations/create-organization-client-grants">Write Organization Client Grants</a></td>
          <td><code>POST</code></td>
          <td>5</td>
          <td>150/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/email-templates/post-email-templates">Write email templates</a></td>
          <td><code>POST</code>, <code>PATCH</code>, <code>DELETE</code></td>
          <td>5</td>
          <td>25/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/email-templates/get-email-templates-by-template-name">Read email templates</a></td>
          <td><code>GET</code></td>
          <td>10</td>
          <td>50/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/emails/patch-provider">Write email provider</a></td>
          <td><code>POST</code>, <code>PATCH</code>, <code>DELETE</code></td>
          <td>5</td>
          <td>25/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td><a href="https://auth0.com/docs/api/management/v2/emails/get-provider">Read email provider</a></td>
          <td><code>GET</code></td>
          <td>5</td>
          <td>25/minute</td>
          <td>Any request</td>
        </tr>

        <tr>
          <td>All other Endpoints Combined</td>
          <td>N/A</td>
          <td>10</td>
          <td>150/minute</td>
          <td>Any request</td>
        </tr>
      </tbody>
    </table>
  </Accordion>

  <Accordion title="SCIM API: Rate limits for the inbound SCIM API endpoints in Public cloud subscriptions that include Enterprise connections.">
    <table class="table">
      <thead>
        <tr>
          <th>Limit Type</th>
          <th>Endpoint Path</th>
          <th>Operation</th>
          <th>Limit</th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td>Single SCIM connection endpoint</td>
          <td>`/scim/v2/connections/{connection-id}`</td>
          <td>Any request</td>
          <td>25 requests per second</td>
        </tr>

        <tr>
          <td>Global tenant limit for all SCIM connections</td>
          <td>`/scim/v2/connections/*`</td>
          <td>Any request</td>
          <td>100 requests per second</td>
        </tr>
      </tbody>
    </table>
  </Accordion>

  <Accordion title="Universal Login Flow Endpoints: Rate limits for the endpoints utilized for the Universal Login Authentication Flow for all subscription types.">
    <table class="table">
      <thead>
        <tr>
          <th>Endpoint</th>
          <th>Method</th>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm">Burst Request Limit</a></th>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm">Sustained Request Limit</a></th>
          <th>Limit Type</th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td>Universal login prompts (global)</td>
          <td><code>GET</code>, <code>POST</code></td>
          <td>500</td>
          <td>500/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>Universal login prompts (per prompt)</td>
          <td><code>GET</code></td>
          <td>20</td>
          <td>10/minute</td>
          <td>From an IP Address and state value.</td>
        </tr>

        <tr>
          <td>Universal login prompts (per prompt)</td>
          <td><code>POST</code></td>
          <td>10</td>
          <td>5/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>Password reset prompt</td>
          <td><code>GET</code></td>
          <td>500</td>
          <td>500/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>MFA push enrollment prompt</td>
          <td><code>GET</code>, <code>POST</code></td>
          <td>500</td>
          <td>500/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>MFA push challenge prompt</td>
          <td><code>GET</code>, <code>POST</code></td>
          <td>500</td>
          <td>500/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>MFA SMS enrollment prompt</td>
          <td><code>GET</code></td>
          <td>20</td>
          <td>10/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>MFA SMS enrollment prompt</td>
          <td><code>POST</code></td>
          <td>10</td>
          <td>5/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>MFA SMS enrollment verify prompt</td>
          <td><code>GET</code></td>
          <td>20</td>
          <td>10/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>MFA SMS enrollment verify prompt</td>
          <td><code>POST</code></td>
          <td>10</td>
          <td>5/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>Passwordless SMS challenge prompt</td>
          <td><code>GET</code>, <code>POST</code></td>
          <td>5</td>
          <td>5/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>Passwordless email challenge prompt</td>
          <td><code>GET</code>, <code>POST</code></td>
          <td>5</td>
          <td>5/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>Phone verification enrollment prompt</td>
          <td><code>GET</code>, <code>POST</code></td>
          <td>5</td>
          <td>5/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>Phone verification challenge prompt</td>
          <td><code>GET</code>, <code>POST</code></td>
          <td>5</td>
          <td>5/minute</td>
          <td>From an IP Address</td>
        </tr>

        <tr>
          <td>Device code prompt</td>
          <td><code>GET</code>, <code>POST</code></td>
          <td>5</td>
          <td>5/second</td>
          <td>From an IP Address</td>
        </tr>
      </tbody>
    </table>
  </Accordion>

  <Accordion title="Additional MFA rate limits: Additional MFA rate limits.">
    <table class="table">
      <thead>
        <tr>
          <th>Endpoint</th>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm">Burst Request Limit</a></th>
          <th><a href="/docs/troubleshoot/customer-support/operational-policies/rate-limit-policy#rate-limit-algorithm">Sustained Request Limit</a></th>
          <th>Limit Type</th>
          <th>Limit</th>
        </tr>
      </thead>

      <tbody>
        <tr>
          <td>OTP (6 numeric digits) failures</td>
          <td>10</td>
          <td>10</td>
          <td>per hour</td>
          <td>To a unique User ID</td>
        </tr>

        <tr>
          <td>Recovery code failures</td>
          <td>10</td>
          <td>10</td>
          <td>per hour</td>
          <td>To a unique User ID</td>
        </tr>

        <tr>
          <td>Webauthn challenge failures</td>
          <td>15</td>
          <td>15</td>
          <td>per minute</td>
          <td>To a unique User ID</td>
        </tr>

        <tr>
          <td>Webauthn challenge generated</td>
          <td>15</td>
          <td>15</td>
          <td>per minute</td>
          <td>To a unique User ID</td>
        </tr>

        <tr>
          <td>Push notifications sent per user</td>
          <td>5</td>
          <td>5</td>
          <td>per minute</td>
          <td>To a unique User ID</td>
        </tr>

        <tr>
          <td>SMS sent per user</td>
          <td>10</td>
          <td>1</td>
          <td>per hour</td>
          <td>To a unique User ID</td>
        </tr>

        <tr>
          <td>Email sent per user</td>
          <td>20</td>
          <td>1</td>
          <td>per minute</td>
          <td>To a unique User ID</td>
        </tr>
      </tbody>
    </table>
  </Accordion>
</AccordionGroup>