{"record":{"id":"8ba1734263088d2c","repo":"crowdsecurity/crowdsec","slug":"request-quota-exceeded-please-reduce-your-request","errorCode":null,"errorMessage":"request quota exceeded, please reduce your request rate","messagePattern":"request quota exceeded, please reduce your request rate","errorType":"http","errorClass":null,"httpStatus":429,"severity":"warning","filePath":"pkg/cticlient/client.go","lineNumber":24,"sourceCode":"\t\"errors\"\n\t\"fmt\"\n\t\"io\"\n\t\"net/http\"\n\t\"strings\"\n\n\t\"github.com/crowdsecurity/crowdsec/pkg/apiclient/useragent\"\n\tlog \"github.com/sirupsen/logrus\"\n)\n\nconst (\n\tCTIBaseUrl    = \"https://cti.api.crowdsec.net/v2\"\n\tsmokeEndpoint = \"/smoke\"\n\tfireEndpoint  = \"/fire\"\n)\n\nvar (\n\tErrUnauthorized  = errors.New(\"unauthorized\")\n\tErrLimit         = errors.New(\"request quota exceeded, please reduce your request rate\")\n\tErrNotFound      = errors.New(\"ip not found\")\n\tErrDisabled      = errors.New(\"cti is disabled\")\n\tErrUnknown       = errors.New(\"unknown error\")\n\tdefaultUserAgent = useragent.Default()\n)\n\ntype CrowdsecCTIClient struct {\n\thttpClient *http.Client\n\tapiKey     string\n\tLogger     *log.Entry\n\tUserAgent  string\n}\n\nfunc (c *CrowdsecCTIClient) doRequest(ctx context.Context, method string, endpoint string, params map[string]string) ([]byte, error) {\n\turl := CTIBaseUrl + endpoint\n\tif len(params) > 0 {\n\t\turl += \"?\"\n\t\tfor k, v := range params {","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/cticlient/client.go#L6-L42","documentation":"ErrLimit is the sentinel error returned when the CTI API responds HTTP 429 Too Many Requests, meaning the request quota for your API key has been exceeded. Returned by doRequest and surfaced through CrowdsecCTI calls.","triggerScenarios":"Any CTI call (GetIPInfo, Fire) when the per-key rate/quota limit is hit — HTTP 429 response from https://cti.api.crowdsec.net/v2.","commonSituations":"High-traffic CrowdSec instances enriching every alert with CTI lookups; missing/undersized local CTI cache causing repeated API hits; batch jobs iterating many IPs.","solutions":["Reduce CTI request rate or enable the local CTI cache to deduplicate lookups","Upgrade your CTI subscription for a higher quota","Back off and retry after a delay; treat ErrLimit as transient and fall back to empty SmokeItem"],"exampleFix":"// before\nitem, err := ctiClient.GetIPInfo(ip)\n// after\nitem, err := ctiClient.GetIPInfo(ip)\nif errors.Is(err, cticlient.ErrLimit) {\n    time.Sleep(backoff)\n    item, err = ctiClient.GetIPInfo(ip)\n}","handlingStrategy":"retry","validationCode":"null","typeGuard":"null","tryCatchPattern":"item, err := ctiClient.GetIPInfo(ip)\nif errors.Is(err, cticlient.ErrLimit) {\n    select { case <-time.After(backoff): case <-ctx.Done(): }\n    item, err = ctiClient.GetIPInfo(ip)\n}","preventionTips":["Enable/deduplicate the local CTI cache so repeated IPs hit cache, not API","Batch or sample CTI lookups on high-volume alerts","Upgrade quota or spread enrichment over time"],"tags":["api","rate-limit","http","cti"],"backgroundTag":"rate-limit-exceeded","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}