Rate limits

Limit	Counted per	Window
60 calls (Exchange) or 300 calls (Enterprise) on /api/integrations/v1	Key	1 minute, fixed
20 token requests on /oauth/token	Calling IP address	1 minute, fixed
50 document uploads and 250 MB (Exchange) or 200 and 1 GiB (Enterprise) on POST /deals/{id}/documents	Company (live and sandbox apart)	The UTC day
5,000 new idempotency keys on writes	Key	The UTC day

• Your plan sets the numbers. These are the defaults. The rate and the upload allowance follow your company’s plan on every call, so a plan change applies from the next call. See Getting access.
• Per key, not per company. Each key has its own budget; a person using the app never shares it. A token issued for a key counts against that key.
• All replicas share one window, so the limit does not grow with the number of servers behind the API.
• Fixed windows. The count starts again at the start of each minute window, not on a rolling basis.

When you reach it

The answer is 429 Too Many Requests. When it carries a Retry-After header, wait that many seconds. When it does not, wait a few seconds. Do not rely on the body: it can be empty.

A good client:

1. Spreads its calls instead of sending bursts.
2. On 429, waits Retry-After (or a few seconds), then retries with growing pauses (for example 2, 4, 8 seconds).
3. Retries a create with the same X-Idempotency-Key, so a create that did run is never repeated. See Idempotency.

Needing fewer calls

• Listen instead of polling. Webhooks tell you when a request is published, an offer arrives, a deal goes live, a milestone is recorded and more. Read the details when an event arrives. See Webhooks.
• Get a token once per 15 minutes, not per call, when you use OAuth.

Calls refused by the rate limit are not listed in the call log.

The daily upload allowance

Document uploads also count against a daily allowance per company: by default 50 files and 250 MB per UTC day on Exchange, 200 files and 1 GiB on Enterprise, live and sandbox counted apart. Past it, an upload answers 429 with Integration.DailyUploadLimit and a Retry-After that runs to midnight UTC. An upload refused for a rule is not counted; a file refused for malware is. See Uploading documents.

The daily idempotency allowance

Each key can send 5,000 writes with a new X-Idempotency-Key per UTC day, on every plan. Past it, a write answers 429 with Idempotency.DailyLimit and a Retry-After that runs to midnight UTC, and nothing runs, so a write is never carried out without its retry protection. A repeat of a key already answered is not counted. See Idempotency.