Rate limits
What is enforced today
Public v1 list routes enforce a sliding-window throttle per organization API key and caller IP. Default public v1 budget:
Successful responses include:
X-RateLimit-LimitX-RateLimit-RemainingX-RateLimit-Reset(Unix seconds)
limit <= 100, support offset, and use stable descending
ordering so offset pagination does not reshuffle rows with identical timestamps.
When the window is exhausted, the API returns 429 with Retry-After plus the same rate-limit headers.
Plan catalog (reference only)
lib/pricing/plan-core.ts includes an apiRateLimit field that maps to apiRateLimitRpm (requests per minute) in the plan registry:
Treat these as plan catalog ceilings. The live public v1 handler budget may be lower for abuse protection and can be raised for Enterprise integrations by agreement.
Recommended client behavior
- Prefer incremental sync (filter appointments by
startDate/endDate) over full-table pulls every minute. - Cap concurrency (for example 1–2 parallel requests per key).
- On
429, wait at leastRetry-Afterseconds before retrying. - On unexpected
5xxor connection errors, use exponential backoff with jitter. - Cache customer lists when your job only needs appointments.
If you need higher volume
Contact sales / support for Enterprise. Do not scrape dashboard HTML or call session-authenticated/api/* routes from an integration — those are not the public contract.