Skip to content

Rate limits

MiaRec can limit how many REST API requests a tenant sends per minute and per day. The limits are configured by the service provider in the tenant's rate limits settings (API requests, per minute and per day). When no limit is set, requests are not throttled.

The limits are counted per tenant, for all API users of that tenant together, in sliding windows of one minute and 24 hours.

Response headers

When a limit is configured, every API response carries the current state of the limit:

Header Description
RateLimit-Limit Number of requests allowed in the current window.
RateLimit-Remaining Number of requests still allowed in the current window.
RateLimit-Reset Number of seconds until the window resets and requests are allowed again.
X-RateLimit-RPM Configured limit of requests per minute, or 0 when not set.
X-RateLimit-RPD Configured limit of requests per day, or 0 when not set.

When a limit is exceeded

The request is rejected with 429 Too Many Requests and is not processed. The response carries the headers listed above and a JSON body:

HTTP/1.1 429 Too Many Requests
RateLimit-Limit: 100
RateLimit-Remaining: 0
RateLimit-Reset: 37
X-RateLimit-RPM: 100
X-RateLimit-RPD: 4000
Content-Type: application/json

{
    "error": "Too Many Requests",
    "explanation": "Too Many Requests",
    "details": "Too many requests. Wait 37 seconds before making a new request."
}

Rejected requests are counted as denied on the API usage page of the web portal.

Recommendations

  • Read RateLimit-Remaining and slow down before the window is exhausted, instead of retrying after a 429 response.
  • When you receive 429, wait for the number of seconds in RateLimit-Reset before you send the next request. Do not retry in a tight loop, because every rejected request is still counted.
  • Use paging with a large limit (up to 1000) to retrieve lists in fewer requests. See Collections.
  • Use Advanced search filters, for example a date range, to retrieve only the records you need.

Failed sign-in attempts

A separate throttle protects accounts from password guessing. It also answers with 429 Too Many Requests, with the delay in the Retry-After header. See Protection against password guessing.