Skip to content
Apploye

Rate limits

The Partner API has two independent protection layers:

  1. API Gateway applies a coarse service and route ceiling.
  2. The application applies a Redis-backed quota per organization, HTTP method,

and canonical resource group.

The default application quota is 30 requests per 60 seconds. Contracted overrides can differ. List and detail paths share a bucket, so /v1/projects/ and /v1/projects/{id}/ consume the same project quota.

Rate-limit headers

Authenticated responses include these headers whenever quota accounting succeeds:

  • RateLimit-Limit: request limit for the current window.
  • RateLimit-Remaining: requests left in the current window.
  • RateLimit-Reset: Unix timestamp when the window resets.

They appear on authenticated success and application-generated error responses. They are absent before authentication and when Redis accounting cannot complete.

Organization quota response

{
  "error": {
    "code": "RATE_LIMIT_EXCEEDED",
    "message": "Rate limit exceeded.",
    "request_id": "req_abc123",
    "retry_after_seconds": 30
  }
}

The response is HTTP 429 and includes Retry-After. A coarse API Gateway ceiling can also return 429 before Lambda using AWS's native response shape.

Temporary quota-service outage

If authenticated quota accounting cannot reach Redis, the API fails closed with HTTP 503, Retry-After: 5, and SERVICE_UNAVAILABLE. Retry after the indicated delay with jitter.

Authentication-failure throttle

Repeated invalid-key attempts from one source IP are separately blocked before organization authentication. That response uses AUTH_FAILURE_THROTTLE and Retry-After, but no organization quota headers.

Contact Apploye support if your integration needs a higher contracted quota.

Related docs