Rate limits

Rate limits apply to each credential separately, so one busy integration can’t slow down another.

Each API key: 300 requests per minute, with bursts of up to 20 requests per second. Imports and campaigns count as one request each, however many patients they cover.
Each OAuth connection (one admin connected to one app): 60 requests per minute, with bursts of up to 10 requests per second. Your app also has an overall limit, set when we register it.

Rate limit headers

Every response includes these headers:

Header	Meaning
`RateLimit-Limit`	Requests allowed per minute.
`RateLimit-Remaining`	Requests left in the current window.
`RateLimit-Reset`	Seconds until the window resets.
`Retry-After`	On `429` responses only: whole seconds to wait before retrying.

Response · 429 Too Many Requests


HTTP/1.1 429 Too Many Requests
Content-Type: application/problem+json
Retry-After: 12
RateLimit-Limit: 60
RateLimit-Remaining: 0
RateLimit-Reset: 12

Read only what’s new. Request messages with after set to the newest one you’ve seen instead of re-reading a whole range. Polling every 1 to 5 minutes is enough. See Read messages.
Read across conversations at once. One List messages request with a time range replaces a request per conversation.
Page with page[limit]=100. Larger pages mean fewer requests. See Pagination.
Back off exponentially after a 429 or 503, starting from Retry-After when it’s present.
Spread out batch jobs. Digests for 300 clinicians that all run at 7:00 sharp hit your app’s overall limit. Stagger them over the hour before the clinic opens.

Need a higher limit for a large organization? Mention it when you request API access.