Limits protect every partner's service. They are counted in fixed windows and reported on every response:
X-RateLimit-Limit: 600
X-RateLimit-Remaining: 587
X-RateLimit-Reset: 1791890460| Class | Limit | Counted |
|---|---|---|
| Writes (POST, PATCH, DELETE) | 60 per minute | Per key (per person in the portal) |
| Reads (Partner API GET) | 600 per minute | Per key (per person in the portal) |
| Tracking API reads | 1200 per minute | Per key (per person in the portal) |
| Exports | 10 per hour | Per key (per person in the portal) |
| Bulk jobs | 5 per hour | Per key (per person in the portal) |
| All keys of your account together | 10× each limit above | Per mode (live and test separately), across every API key |
| Failed authentications | 60 per minute | Per client IP address |
| Webhook replays | 20 per hour | Per endpoint |
| Webhook test events | 20 per hour | Per endpoint |
| Concurrent tracking-platform reads | 4 | Per fleet (Tracking API); excess requests get 503 with Retry-After |
Over a limit you get 429 RATE_LIMITED with Retry-After (seconds). Payment recovery, invoice reads and deactivation requests have their own, separate limits (per key: payment recovery 60, invoice reads 600 and deactivations 600 a minute; invoice document links 120 a minute per partner), so they keep working when the other limits are used up or the account is restricted. If your volume needs different limits, contact support — limits are set per partner, never charged as overage.