Rate limiting
Limits run over a 1-hour sliding window — each request counts against the limit for the next 60 minutes; there is no fixed-time reset — and split into three bands: read (GET), write (POST, PUT, PATCH, DELETE), and money-moving actions, which get their own, tighter bucket.
| Type | Limit |
|---|---|
Read (GET) | 60 requests/hour |
Write (POST, PUT, PATCH, DELETE) | 1000 requests/hour |
| Money-moving (issue/cancel a charge, send/cancel a bank payment) | 60 requests/hour |
Money-moving actions count only against their own band (throttle_v1_money), not the write band. If your operation needs a higher limit, talk to support or sales.
Response headers
On every request, the server attaches to the response headers the limits used and when the count frees up:
| Header | Example | Description |
|---|---|---|
ratelimit-limit | 60 | Request limit for the client. |
ratelimit-name | throttle_v1_write | Name of the throttle used. |
ratelimit-remaining | 0 | Number of requests still available. |
ratelimit-reset | 1782648000000 | Unix time in milliseconds — when the count resets. |
retry-after | 30 | Seconds until the count resets. See Retry-After. |
Example of a successful response
Date: Fri, 17 Jul 2026 12:00:00 GMT
Content-Type: application/json; charset=utf-8
ratelimit-limit: 1000
ratelimit-remaining: 486
Example of a blocked response
When the limit is reached, the server returns HTTP 429 Too Many Requests. Wait the number of seconds from the retry-after header before the next request.
HTTP/1.1 429 Too Many Requests
Date: Fri, 17 Jul 2026 12:00:00 GMT
Content-Type: application/json; charset=utf-8
ratelimit-limit: 1000
ratelimit-remaining: 0
ratelimit-reset: 1784293200000
ratelimit-name: throttle_v1_write
retry-after: 3600
{ "error": { "code": "RATE_LIMITED", "message": "Write request rate limit exceeded for this token." } }
tip
Reference: RateLimit header fields for HTTP