We apply rate limits to keep the Rho API available and responsive for all integrations.
| Limit | Threshold |
|---|---|
| Per API Access Token | Approximately 60 requests per minute |
| Per source IP | Approximately 600 requests per minute |
These limits apply uniformly across all public Rho API endpoints. The source-IP limit covers the combined traffic from every integration sharing that IP address, including integrations using different API Access Tokens.
We enforce rate limits across a distributed edge network, so the limits are approximate rather than an exact concurrency allowance. Clients must not assume that exactly 60 simultaneous requests will succeed.
Pace traffic steadily below one request per second instead of sending the full minute's allowance in a burst. Queueing requests and limiting concurrency reduces the chance of crossing a distributed counter while other requests are still in flight.
When a limit is exceeded, we return 429 Too Many Requests. Handle the Retry-After header as follows:
- If it is a positive integer, wait at least that many seconds before retrying.
- If it is
0, we have not applied a fixed cooldown. This does not guarantee that an immediate retry will succeed, so use exponential backoff with jitter instead of retrying in a tight loop.