Rate limits & quotas

1. Rate limit — burst guard

A uniform, per-application ceiling on how fast requests can arrive, identical in sandbox and production. It absorbs short bursts and stops abusive traffic; it does not measure how much you use. A batch request counts as one request against the rate limit, whatever its size.

Exceeding it returns 429 with "error": "rate_limited" and a retry_after duration — wait that long and retry. This is a transient, per-second condition, unrelated to your quota or your balance.

2. Quota — metered per service

Each service is metered independently, per application: using up KYC Validation’s quota has no effect on Face Recognition’s or Fraud Reporting’s. This quota covers single calls only. Batches have a separate batch quota (see section 3) — batch items never consume the single-call quota. Asynchronous single requests count the same as synchronous ones.

Sandbox quotas reset daily at UTC midnight. Production quotas are set per application and per service when your production access is approved, sized to the volumes declared in your due-diligence dossier; an Administrator can request an increase from the console. Current usage per service is visible on the application’s usage page.

Exceeding a quota returns 429 with "error": "quota_exceeded", along with service, calls_used, calls_limit, reset_at and an upgrade_url. Waiting a few seconds and retrying won't help — the quota only clears at reset_at.

3. Batch and asynchronous limits

Batches and asynchronous jobs have their own size and retention limits, the same for every service:

Batches have their own quota, separate from single calls, per service and per application: a daily number of batch items and a daily number of batch submissions. Test-environment values are below; production values are set when production access is approved. Beyond either limit, new batches are rejected with 429 batch_quota_exceeded until the quota resets at 00:00 UTC — single calls are not affected.

A synchronous batch over 50 items returns 413 with batch_too_large — resend it with Prefer: respond-async. Page through GET /v1/batches/{batch_id}/results with cursor and limit. After 30 days, job results and batch results are deleted and their ids return job_not_found or batch_not_found: copy what you need into your own systems, within your own retention policy. See Single, batch & async.

4. Billing limits — 402, not 429

Whether your organization is prepaid or postpaid, running out of funds is not a rate limit. A prepaid organization with an empty wallet receives 402 with insufficient_balance; a postpaid organization over its credit limit receives 402 with credit_limit_reached. Retrying will not help until a Financial officer tops up the wallet or the credit position is resolved. Listen for the billing.balance_low webhook to act before it happens. See Billing.