Rate limits - Instant Compliance API

Each API key is independently rate-limited.

Limits

Window	Default
Burst	60 requests per minute
Daily	10,000 requests per 24 hours

These limits apply per API key, not per organisation — so a key issued to Zapier and a key issued to your internal cron each get their own budget.

When you hit the limit

You receive 429 rate_limited with a Retry-After header:

HTTP/1.1 429 Too Many Requests
Retry-After: 12
Content-Type: application/json

{
  "error": {
    "code": "rate_limited",
    "message": "Rate limit exceeded. Slow down and retry shortly.",
    "details": { "limit": 60, "window_seconds": 60 }
  }
}

Honouring `Retry-After`

Wait at least Retry-After seconds before retrying. A simple backoff loop:

async function withRateLimit(fn) {
  for (let attempt = 0; attempt < 5; attempt++) {
    const res = await fn();
    if (res.status !== 429) return res;
    const wait = Number(res.headers.get('Retry-After') ?? 5);
    await new Promise((r) => setTimeout(r, wait * 1000));
  }
  throw new Error('Rate limited repeatedly');
}

Need higher limits?

Most integrations sit far below the default. If you have a legitimate need for a higher ceiling — bulk migrations, high-volume nightly sync — contact support@instantcompliance.ai with a description of the workload.

Best practices

Batch via cursor pagination instead of N parallel calls.
Use updated_since so polling pulls only changed records.
Spread cron jobs. Pick a random minute offset so all customers don’t poll on the same :00.
Cache reads in your own CRM. Hit our API for refreshes, not for every page load.