Skip to content
DevSecure API

Rate limits

Limits use a rolling one-minute window. The defaults are below; your plan may set different numbers.

Limit Default per minute
Per credential 300 requests
Per workspace, all credentials together 1,000 requests
Writes per credential (POST, PATCH, DELETE) 60 requests
Issue exports per workspace 10 requests
Token requests per OAuth client 30 requests

Every authenticated response reports the tightest limit that applied:

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 287
X-RateLimit-Reset: 41

X-RateLimit-Reset is the number of seconds until a slot frees up. Over the limit, the API answers 429 rate_limited with Retry-After in seconds:

HTTP/1.1 429 Too Many Requests
Retry-After: 12

Backing off

Section titled “Backing off”
  • Wait for Retry-After before retrying. Do not retry in a tight loop.
  • When X-RateLimit-Remaining gets low, slow down before you hit the limit.
  • Use limit=200 and webhooks instead of polling.
  • Retry 500, 502 and 503 with exponential backoff and jitter. For creating or starting something, send an Idempotency-Key so the retry is safe.

Repeated authentication failures from one address are also limited, and get 429 until the window passes.