API rate limits protect the platform from accidental floods and abusive scripts. Limits are applied per API key (or per user token), per endpoint family, in a sliding window.
Default Limits
- Per IP, unauthenticated: 30 requests/minute.
- Per user token: 300 requests/minute.
- Per service key, default scope: 1000 requests/minute.
- Per service key, with elevated tier: 10,000 requests/minute.
- Per service key, write endpoints: 100 writes/minute.
- Per service key, bulk import endpoints: 5 bulk operations/minute.
Headers
Every response includes three headers:
X-RateLimit-Limit— total allowed in the current window.X-RateLimit-Remaining— how many you have left.X-RateLimit-Reset— Unix epoch when the window resets.
When you exceed the limit, you get HTTP 429 with a Retry-After header. Back off and retry then.
Tuning for Your Workload
- Read-heavy: Default 1000/min is generous; rare to hit.
- Bulk imports: Use the bulk endpoints; one bulk request can carry 1000 records.
- Real-time mirroring: Request elevated tier and stagger writes — 100 writes/min ≈ 1.67/sec.
- Webhook-driven: Almost never hits limits — events drive your calls.
Worked Examples
- Nightly sync: 200,000 records pulled via 200 paginated requests. At 1000/min that's 12 seconds — well within limits.
- Live mirror: Mirror Salesforce to ActiveManage on every change. Write traffic ~50/hour — far below.
- Bulk migration: Import 1M records via 1000 bulk requests of 1000 records each. At 5 bulk/min that's 200 minutes — schedule overnight.
Tip: If you regularly bump the limit, you're probably building wrong — consider webhooks (push, not pull) or bulk endpoints instead of single-record calls.