Rate Limits

Each API client can send a limited number of requests per minute. An OAuth client that acts for more than one organisation has one limit for all of them. The limit is counted in fixed one-minute windows. Don’t hardcode it: read it from the response headers, because it can change.

Response Headers

Every response carries the current limit and what is left of it, in the format of the IETF draft RateLimit header fields for HTTP:

Response headers

RateLimit-Policy: "300-in-60sec"; q=300; w=60
RateLimit: "300-in-60sec"; r=296; t=42

Header	Parameter	Description
`RateLimit-Policy`	`q`	Requests allowed per window.
	`w`	Window length in seconds.
`RateLimit`	`r`	Requests left in the current window.
	`t`	Seconds until the current window ends.

Over the Limit

A request over the limit gets a 429 response with a Retry-After header that holds the seconds until the next window starts:

429 response

HTTP/1.1 429 Too Many Requests
Retry-After: 42
Content-Type: application/json

{
  "code": "too_many_requests",
  "message": "Too many requests. Try again after the time given in the Retry-After header."
}

Wait for the seconds in Retry-After, then send the request again. A refused request has no effect, so it is safe to retry.

To stay under the limit, spread batch imports over time: when r in the RateLimit header gets close to 0, wait t seconds before you send more.

Get Started

Guides

Response Headers

Over the Limit

​Response Headers

​Over the Limit

Response Headers

Over the Limit