Rate limits

Generous defaults today, with planned ceilings so you can build against them now.

Limits

Scope	Limit	Window
Per token	100 requests	1 minute (rolling)
Per account (all tokens)	1,000 requests	1 minute (rolling)
Per token — bulk read	5,000 records	Single response (use pagination)
Webhook deliveries — inbound	Unlimited; deduplicated by message id	—
EHR sync polling	1 cursor advance / 30 seconds	Per vendor per account

Response headers

Once enforcement lands, every response will carry the standard headers below. Cache the bucket on your side and back off when X-RateLimit-Remaining drops toward zero.

HTTP

HTTP/1.1 200 OK
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 87
X-RateLimit-Reset: 2026-05-18T14:31:00Z

When you exceed a limit

Excess requests get 429 Too Many Requests with a Retry-After header in seconds. Wait, then resume.

HTTP

HTTP/1.1 429 Too Many Requests
Retry-After: 12
Content-Type: application/json

{ "error": "Rate limit exceeded" }

Best practices

Paginate large reads. Don't poll the same list endpoint in a tight loop.
For bulk imports, batch your POST calls and add jitter (200–500ms) between them.
Subscribe to webhooks for events you care about instead of polling. The inbox and EHR sync paths both have webhook entry points.
Cache GETresponses that don't need to be fresh — properties, pipelines, providers, and intake forms change rarely.