Stay organized with collections
Save and categorize content based on your preferences.
Chronicle API quotas
Chronicle API quotas are enforced at the server level using an interceptor.
Each service that integrates with Chronicle API needs to specify the appropriate
quota server key to enable quota enforcement.
The following table lists the quotas that are being enforced, where:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-24 UTC."],[[["\u003cp\u003eChronicle API enforces quotas at the server level using an interceptor, requiring each integrating service to specify the correct quota server key.\u003c/p\u003e\n"],["\u003cp\u003eThe API query quotas are categorized by Queries Per Second (QPS), Queries Per Minute (QPM), and Queries Per Day (QPD).\u003c/p\u003e\n"],["\u003cp\u003eSearch APIs like \u003ccode\u003eListAlerts\u003c/code\u003e, \u003ccode\u003eListEvents\u003c/code\u003e, \u003ccode\u003eListIocs\u003c/code\u003e, and \u003ccode\u003eListIocDetails\u003c/code\u003e have a quota of 1 QPS, while \u003ccode\u003eListAssets\u003c/code\u003e has a quota of 5 QPS, and \u003ccode\u003eSearchRawLogs\u003c/code\u003e has a quota of 1 QPM.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ePartner\u003c/code\u003e group's \u003ccode\u003eCreateCustomer\u003c/code\u003e API has a quota of 10 QPD.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003eRules\u003c/code\u003e group includes a wide array of APIs for managing detections, retrohunts, and rules, with most having a 1 QPS quota, except for \u003ccode\u003eListDetections\u003c/code\u003e which is 10 QPM, and \u003ccode\u003eStreamTestRule\u003c/code\u003e, which is 3 QPM.\u003c/p\u003e\n"]]],[],null,[]]
