How limits are applied
When an endpoint is rate-limited:- The limit is 20 requests per 60 seconds by default. Some endpoints set their own.
- The bucket is keyed by the authenticated token (Api-Token or JWT), or by IP address for unauthenticated endpoints.
- Hitting the limit returns
429 Too Many Requestswith aRetry-Afterheader telling you how many seconds to wait.
GET /api/v1/users, GET /api/v1/events, etc.) are not application-rate-limited under normal circumstances — you can paginate freely.
Endpoints with explicit limits
Where a limit is not listed in an endpoint’s reference page, assume it is not application-rate-limited beyond platform protections.
The 429 response
Retry-After. Retrying inside the window will not succeed and only delays your overall throughput.
Designing for the limits
Bulk operations — batch instead of looping
Bulk operations — batch instead of looping
Many endpoints have explicit bulk variants:
POST /api/v1/contacts/bulk-delete, POST /api/v1/waitlist_entries/bulk-approve, etc. Each bulk call counts as one request and is far cheaper than N individual calls.Prefer bulk endpoints over for entry in entries: api.delete(entry) loops.Pagination — use the maximum page size
Pagination — use the maximum page size
itemsPerPage=100 is the cap. Setting it lower means more requests for the same data and a higher chance of tripping platform-level throttles. Use 100 unless you have a specific reason not to.Polling — switch to webhooks
Polling — switch to webhooks
If you find yourself polling
GET /api/v1/payments?status=PENDING every few seconds, subscribe to the product_payment.updated webhook instead. Webhooks deliver in under a second and cost no API calls. See Webhooks.OAuth and JWT — cache tokens
OAuth and JWT — cache tokens
Do not call
/api/v1/login-check before every request. Cache the JWT for its full ~11-day lifetime and only re-login when a request returns 401. The same applies to OAuth access tokens — cache and refresh on demand, never on every call.Background sync — go off-peak
Background sync — go off-peak
For nightly data syncs, schedule them during your tenant’s off-hours. The platform handles concurrent tenants well, but a single integration making a thousand requests at noon still adds latency on top of normal user traffic.

