Rate limits
The API limits how many requests a credential sends. A request over the limit
gets 429 throttled, with a Retry-After header: the number of seconds to
wait.
| Caller | Limit |
|---|---|
| An API key | 300 requests a minute, for each key |
| An OAuth token (an MCP client) | 300 requests a minute, for each token |
| A person in the browser | 600 requests a minute |
| No credential | 60 requests a minute, for each address |
Expensive operations
Some operations do more work, and have a second limit of 20 requests a minute on top of the first:
- The reports: trial balance, general ledger, open items, balance sheet, profit and loss, and the VAT preview. Each returns the whole answer and is cached until the books change, so asking again for the same report is cheap for you but still counts.
- The file upload.
What to do
- On 429, wait for the seconds in
Retry-After, then retry. Retry a write with the sameIdempotency-Key(see Idempotency). - Read a list with a large
limit(up to 200) instead of many small pages. - Keep a report you read often, and ask again when you need newer figures.
The limits can change. Read Retry-After, and do not hard-code the numbers.