# Rate limits

We apply rate limits to keep the Rho API available and responsive for all integrations.

## Limits

| Limit | Threshold |
|  --- | --- |
| Per API Access Token | Approximately 60 requests per minute |
| Per source IP | Approximately 600 requests per minute |


These limits apply uniformly across all public Rho API endpoints. The source-IP limit covers the combined traffic from every integration sharing that IP address, including integrations using different API Access Tokens.

We enforce rate limits across a distributed edge network, so the limits are approximate rather than an exact concurrency allowance. Clients must not assume that exactly 60 simultaneous requests will succeed.

## Avoid bursts

Pace traffic steadily below one request per second instead of sending the full minute's allowance in a burst. Queueing requests and limiting concurrency reduces the chance of crossing a distributed counter while other requests are still in flight.

## Handle rate-limit responses

When a limit is exceeded, we return `429 Too Many Requests`. Handle the `Retry-After` header as follows:

- If it is a positive integer, wait at least that many seconds before retrying.
- If it is `0`, we have not applied a fixed cooldown. This does not guarantee that an immediate retry will succeed, so use exponential backoff with jitter instead of retrying in a tight loop.