Intermittent CloudFront 403 when triggering pipelines via API v2

Build Environment
1

Hello,

We trigger CircleCI pipelines from GitHub-hosted automation using the API v2 endpoint:

POST https://circleci.com/api/v2/project/github/<org>/<repo>/pipeline

The vast majority of requests succeed, but occasionally we receive the following response:

<TITLE>ERROR: The request could not be satisfied</TITLE>
</HEAD><BODY>
<H1>403 ERROR</H1>
<H2>The request could not be satisfied.</H2>
<HR noshade size="1px">
Request blocked.
We can't connect to the server for this app or website at this time. There might be too much traffic or a configuration error. Try again later, or contact the app or website owner.
<BR clear="all">
If you provide content to customers through CloudFront, you can find steps to troubleshoot and help prevent this error by reviewing the CloudFront documentation.
<BR clear="all">
<HR noshade size="1px">
<PRE>
Generated by cloudfront (CloudFront)

A few observations:

  • The failures appear to happen randomly and are difficult to reproduce consistently.
  • The CircleCI token is valid and unchanged.
  • The same request succeeds immediately before and after the failure.
  • The response is HTML generated by CloudFront rather than the normal CircleCI API JSON response.
  • We are calling the API from GitHub-hosted runners.
  • In some cases there may be multiple pipeline trigger requests occurring around the same time.
  • When these incidents occur, the CircleCI status page reports all systems as operational and does not indicate any ongoing incident.

We recently discovered that roughly a total of 2% of our requests receive a CloudFront 403 (“Request blocked — We can’t connect to the server for this app or website at this time”).
We have a total of ~1,600 POST requests to https://circleci.com/api/v2/project/github/<org>/<repo>/pipeline over the week, ranging from ~28 requests/hour on average during working hours (07:00–19:00 UTC, Mon–Fri), with peaks reaching ~80 requests/hour.

Looking at the timestamps, the 403s are not uniformly distributed: the majority cluster between 15:40 and 19:30 UTC, which coincides with peak overlap between European and US East Coast business hours. Outside that window we see very few failures (but we also have less activity).

Our main questions are:

  1. Does CircleCI have any documented recommendations or hard limits regarding API request rates, burst sizes, or concurrent pipeline trigger requests that customers should follow when triggering pipelines using the API?
  2. Is there anything in our usage pattern above — 80 req/hour peak, all originating from GitHub Actions runner IPs — that would be expected to trigger CloudFront edge blocking?

Thanks.