Rate limits

When a route's limit is exceeded the API answers 429 with the standard error envelope (error: rate_limited, see /docs/errors#rate_limited), a Retry-After header with the seconds until the window resets, and the limit in hint:

{
  "error": "rate_limited",
  "error_description": "Too many requests: this route allows 60 per minute.",
  "error_uri": "https://api.bind.co/docs/errors#rate_limited",
  "fault": "client_problem",
  "hint": {"limit": "60 per 1 minute", "retry_after_seconds": 23},
  "request_id": "req_xxxxxxxxxx"
}

Wait Retry-After seconds, then retry; back off exponentially if you keep hitting it.

Every answer from a limited route carries the budget you have left, so you can slow down before you reach a 429. That includes errors such as a 401 or a 412: an answer refused before the limit was counted shows the full window.

Counts are kept by each server instance, so these numbers are approximate. Browsers can read every one of these headers, as well as Retry-After, X-Request-Id, ETag, Location, Deprecation, Sunset and Link.

Webhook budgets

Counted per application (or per endpoint), rolling one-minute window; the reply is the same 429 envelope with hint.limit_per_minute.

Per-route limits

Counted per application and user: each user your application acts for has their own budget, and another application's traffic never uses yours. POST /oauth2/token, /oauth2/revoke and /oauth2/introspect are counted per application (the client_id you authenticate with); the consent pages, called before a user is signed in, per calling IP address. Fixed window. Counts are kept by each server instance, so a limit is approximate: you may get a few more requests than the table says before a 429. This table is generated from the running API, so it is always current for the routes in the API reference. The webhook event-type list is outside the reference; its limit is stated in the webhooks guide. Limits may tighten; the 429 envelope and Retry-After are the contract, not the numbers.

Every route in the API reference belongs to one family: sign_in, token, read or write; only these guide pages and static files have none. The table shows each family's standard limit; your application's limit for a family may be set differently, and the X-RateLimit-Limit header always carries the one that applies to you. A few routes also carry a fixed second limit, listed after the family's.