Rate limiting
How the BoxHero API limits request rates per team and how to back off and retry.
To keep the service stable for everyone, the BoxHero API limits how many requests a team can send.
Limits are per team
Section titled “Limits are per team”All API tokens that belong to the same team share the same limits. Issuing more tokens in one team does not raise the limit. Per-second and per-minute limits apply together, and the response headers report the per-minute limit.
When you hit the limit
Section titled “When you hit the limit”The API responds with 429 and an error envelope whose type is /errors/too-many-requests. The response headers tell you when you can try again:
| Header | Description |
|---|---|
Retry-After | Seconds to wait before retrying |
RateLimit, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset | The current limit, the requests left, and when the limit resets |
Back off and retry after the time in Retry-After. If you send many requests in a row, spread them out instead of sending them all at once.
If requests from the same IP address fail authentication repeatedly (more than 30 times in 60 seconds), further requests from that IP receive 429 regardless of the token used.