GitLab.com now limits requests without credentials to 60 per hour per IP address, at least for part of its traffic. On the evening of October 28 we sent 140 anonymous API requests to GitLab's own gitlab-runner project in under ten minutes, and every one of them came back 200 . Then we pointed the same loop at a public project in a personal namespace. After 58 requests, the 59th came back 429 Too Many Requests , and our IP stayed blocked for more than 40 minutes.

Three things from that evening matter if you run CI or automation against GitLab.com:

What counts depends on what you ask for. While we were blocked, requests to projects in the gitlab-org and inkscape groups still worked, and requests to personal projects and to /api/v4/version did not. If you test against a big open source project, you may conclude that nothing has changed.

Successful responses do not show the new limit. The last 200 before the block carried RateLimit-Remaining: 476 . That number belongs to the old 500-per-minute throttle.…