Why Is My Duo Admin API Rate Limit Being Hit Despite Low Traffic?

[gabrielladawn]

Hello

We are using the Duo Admin API to automate user lifecycle management primarily adding & removing users in sync with our internal provisioning system. While our actual API calls are relatively infrequent (roughly 30–50 per hour); we have been facing rate limit errors (429 Too Many Requests) sporadically; even during off-peak hours.

We have reviewed the official rate limits and confirmed we are far below the documented threshold of 100 requests per minute. We also implemented exponential backoff with retries but the errors still occur unpredictably. This makes us wonder if background polling by another integration or stale API keys may be contributing to silent overuse. As I am exploring automation roles including understanding what is a Prompt Engineer? I find it essential to grasp how API behaviors like rate limits can silently disrupt downstream workflows.

Has anyone else experienced similar rate-limit issues despite seemingly low usage? Any tips for better visibility into API consumption per integration / ways to proactively audit key activity would be greatly appreciated.

Thank you !!

Thank you !!

[Enes Simnica]

hello @gabrielladawn. I've seen similar Duo API rate limit issues even under low loads. Key findings from my deployments:

1. HIdden causes:  

• Duo's per-endpoint limits (some APIs have tighter quotas than the global 100/min)
• Cached credentials triggering auth storms
• Duo Mobile background checks consuming slots

1. dont forget to use soem debugs: and as i can remember i used something like this; to check the perKey usage...

curl -H "Authorization: Basic $(echo -n '<ikey>:<skey>' | base64)" \
https://api.duosecurity.com/admin/v1/logs/administrator | grep -A 5 "rate_limit"

the other thing that i would do is: Proactive fixes, meaning Implement request pacing (max 2/sec even if under 100/min), then rotate keys monthly and audit orphans, and why not use dedicated keys per integration. Also i have to tell u man, that the most common fices I've implemented is adding 500ms delays between sequential calls, which resolved 90% of false 429s.

check these links G:

• https://duo.com/docs/adminapi#administrator-logs 
• https://www.ibm.com/docs/en/dsm?topic=options-cisco-duo-protocol-configuration 
• https://duo.com/docs/rate-limits 
• https://www.lcsc.edu/media/12673/duo-4-issues-errors-and-troubleshooting.pdf (some truobleshooting stuff...) 
• https://duo.com/docs 
• https://www.cisco.com/c/en/us/support/security/duo/products-tech-notes-list.html (troubleshooting options...)

hope it helps G..

-Enes