Skip to content

Stay within the rate limits

Follow these and your integration won’t meet a 429 in normal running. The usual causes are signing in before every call and polling a list or a count too often.

  • Reuse an access token until shortly before it expires (72 hours), then get a new one with the refresh token instead of signing in with the password again.
  • Sign in at most 3 times a minute from one IP address; keep the access token and refresh it instead of requesting a new one per call.
  • Each paged list operation allows one user 15 calls a minute; ask for larger pages and narrow the list with filters instead of paging through everything.
  • Check the ticket count at most twice a minute for one user.

An access token lasts 72 hours, so one sign-in serves thousands of calls. Signing in is limited by IP address, which makes it the limit a badly behaved integration hits first.

Everything else counts for each user and each operation. The limit measures calls, not records. A larger page and a tighter filter get you the same data in fewer calls.