Rate limits
API requests are limited to 60 requests per minute per authenticated principal (per user or token; per IP for unauthenticated endpoints).
Every response carries the standard throttle headers:
| Header | Meaning |
|---|---|
X-RateLimit-Limit |
Requests allowed per window (60) |
X-RateLimit-Remaining |
Requests left in the current window |
Retry-After |
(on 429) Seconds to wait before retrying |
When you exceed the limit you get:
HTTP/1.1 429 Too Many Requests
Retry-After: 34
{ "message": "Too Many Attempts." }
Recommendations
- Honor
Retry-Afterand back off exponentially on repeated 429s. - Spread bulk work over time, or use the batch endpoints (
POST /api/v1/batch/...) to do more per request. - Cache stable reads (organization data, customer lists) instead of re-fetching per operation.
If your integration legitimately needs a higher ceiling, contact support.