Bitbucket Cloud API Rate Limiting

6 posts · May 2022 – Dec 2025

What this trail covers

Bitbucket Cloud API rate limits have been scaled based on the workspace's paid user count, with a new points-based model for API usage and shared rate limits for global and per-tenant quotas. New rate limit headers have been added to help users monitor their API usage. This post extends the capability by introducing a points-based model for API usage, tiered global and per-tenant quotas, and shared rate limits for clustered apps. API token traffic is being evaluated for a quota-based approach.

All Atlassian trails

Dec 2025Scaling responsibly: evolving our API rate limits to power the next generation of Atlassian CloudIntroduces a new points-based API rate-limiting model for Jira and Confluence Cloud, replacing request-per-second caps. Each request consumes points based on work performed. Implements Tier 1 Global Pool (shared hourly quota) and Tier 2 Per-Tenant Pool (hourly quotas per tenant). Clustered apps will share a single rate limit quota. API token traffic is being evaluated for a quota-based approach. Enforcement begins March 2, 2026.
Sep 2024Introducing Scaled Rate Limits for Bitbucket Cloud APIIntroduces scaled rate limits for the Bitbucket Cloud API, specifically for the 'api' resource group covering most `/2.0/repositories/*` endpoints. The new limits are based on the workspace's paid user count, with a base of 1000 RPH for up to 100 seats, and an additional 10 RPH per seat above 100, capped at 10,000 RPH. This applies to requests made via Access Tokens and Forge `asApp` API requests. New response headers (`X-RateLimit-Limit`, `X-RateLimit-Resource`, `X-RateLimit-NearLimit`) are added to help monitor API usage.
Sep 2024Keeping your code secure in the cloudThis post details Atlassian's platform-level cloud security practices for Bitbucket Cloud, including AWS hosting, data encryption (TLS 1.2+, AES-256), daily backups with quarterly testing, endpoint protection, and role-based access control for staff. It also outlines user-manageable security settings within Bitbucket Cloud such as IP allowlisting, enforced 2FA, disabling public content and forking outside the workspace, support for self-hosted runners, audit logs, and enforced signed commits (GPG/SSH). Additionally, it highlights CI/CD integrations for security, including secret scanning, infrastructure-as-code scanning, dependency scanning, workspace-level merge checks, and dynamic pipelines for orchestrating security steps.
Apr 2023Building Bitbucket Cloud for enhanced security, compliance, and scaleThis post details the scaling of Bitbucket Cloud API rate limits based on paid user count, introducing a points-based model with Tier 1 (Global Pool) and Tier 2 (Per-Tenant Pool) quotas, and shared rate limits. It also highlights new rate limit headers (X-RateLimit-Limit, X-RateLimit-Resource, X-RateLimit-NearLimit) for monitoring API usage.
May 2022Changes to deleting snippet commentsThis post introduces the ability for snippet owners and workspace admins to delete snippet comments, in addition to the original author. This is achievable via API or the UI, providing a self-service moderation option and reducing the need to contact support. API documentation for this specific action is linked.
Advertisement