Quick answer
Unauthenticated public REST API requests are limited to 60 requests per hour. Authenticated requests made on a user's behalf generally use a 5,000 requests per hour personal budget.
Verified Aug 22, 2026Official source
Current limits
| Constraint | Current value | Scope | Verified source |
|---|---|---|---|
| Unauthenticated REST requestsApplies when fetching public data without authentication. | 60 requests per hour | Originating IP address | GitHubAug 22, 2026 |
| Authenticated personal REST requestsSome GitHub Enterprise Cloud app and OAuth contexts have higher limits; search and GraphQL use separate constraints. | 5,000 requests per hour | Authenticated user | GitHubAug 22, 2026 |
Why does this limit matter?
Unauthenticated calls are grouped by source IP, so unrelated workloads behind one egress address can share the same small budget.
Secondary limits can throttle bursty or compute-heavy traffic even when primary remaining headers are nonzero.
What should you check?
- Prefer authenticated requests for production integrations.
- Read x-ratelimit-limit, remaining, resource, and reset headers.
- Honor Retry-After and use serialized/backoff behavior for secondary throttling.
Important caveats
- Search endpoints, GraphQL, Git LFS, GitHub Apps, Enterprise contexts, and GITHUB_TOKEN use distinct rules.
- GitHub says secondary limits can change without notice and some triggers are not publicly disclosed.
HyperObserve reports the documented platform constraint. Your application, SDK, gateway, provider, region, or account can impose a lower effective limit.
Related