Rate limits
Request quotas per window and the headers that report what is left.
Generated from public-api.mdVersion 1.2.0Last updated 2026-09-20
#Rate Limits
Rate limiting is per merchant, enforced in the API gateway with a 1-minute sliding window. There is no per-endpoint limit.
| Bucket | Limit (default) | Covers |
|---|---|---|
| Payment API | 60 requests/min | All of /v1/payments/* together |
| Merchant Reports API | 60 requests/min | All of /v1/merchant-reports/* together |
| Sandbox helpers | 300 requests/min per IP | /sandbox/* (edge limit, not per merchant) |
The two merchant buckets are independent, so pulling reports never consumes your
payment budget. Limits are deployment-configurable
(RATE_LIMIT_REQUESTS_PER_MINUTE, REPORTS_RATE_LIMIT_PER_MINUTE); the values
above are the deployed defaults — confirm your contracted limits with support.
Rate limit headers are returned on every authenticated response:
| Header | Description |
|---|---|
X-RateLimit-Limit | Maximum requests per window |
X-RateLimit-Remaining | Remaining requests in the window |
X-RateLimit-Reset | Unix timestamp when the window resets |
Exceeding a limit returns 429 with Retry-After (seconds):
{
"code": "RATE_LIMIT_EXCEEDED",
"message": "Rate limit exceeded. Please retry later.",
"retry_after": 37
}If the limiter's backing store is unavailable the request is allowed through
rather than rejected, so an absent X-RateLimit-* header set is not an error.