Rate Limits

Overview

Replenit applies rate limits to protect platform stability and ensure fair usage across tenants.

Rate limits are enforced per API key, across all tenants the key has access to.

All ingestion endpoints are subject to the same rate-limiting rules.

Default Rate Limits

Limits apply to:

• Customers API
• Orders API
• Products API
• DELETE endpoints

How Rate Limits Are Calculated

• Each HTTP request counts toward the rate limit
• Batch size does not affect request count
• Requests across different tenants using the same API key share the same quota

Rate Limit Headers

Responses may include the following headers:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 95
X-RateLimit-Reset: 1700000000
Retry-After: 30

Header Definitions

429 Too Many Requests

When the rate limit is exceeded, the API returns HTTP 429.

Example Response

{
  "success": false,
  "message": "Rate limit exceeded.",
  "data": {}
}

Retry Strategy

Only retry requests that fail with:

• 429Too Many Requests
• 500Internal Server Error

Recommended Approach

• Apply exponential backoff
• Respect the Retry-After header when present
• Add jitter to avoid synchronized retries

Example Backoff Sequence (seconds)

Batch Usage Recommendations

Batching reduces request volume and rate-limit pressure.

Recommended Batch Sizes

Multi-Tenant Considerations

When an API key is authorized across multiple tenants:

• Rate limits are shared across all tenants
• High-volume ingestion for one tenant affects available capacity for others

For Parallel Multi-Tenant Ingestion

• Use batching aggressively
• Serialize requests where possible
• Monitor remaining quota via headers

Handling Sustained High Volume

For sustained ingestion workloads:

• Prefer fewer, larger batches
• Avoid per-record requests
• Spread ingestion over time
• Monitor 429 responses and backoff behavior

Common Rate-Limit Pitfalls

• Sending single-record requests in loops
• Retrying 400-series errors
• Ignoring Retry-After
• Running parallel ingestion jobs with the same API key

Observability

Rate-limit behavior can be observed via response headers.

Ingestion success and volume can be monitored in:

Access depends on tenant permissions.