Rate limits

Limit scope

For authenticated requests, the limit is counted per user and organization (separately for each account + organization pair identified by the X-Organization-Id header). For unauthenticated requests (for example the public contact form), the limit is counted per client IP address.

Default limit windows

The standard limit for authenticated requests is a fixed window of roughly 300 requests per 60 seconds — the counter resets at the boundary of each window rather than rolling continuously (the exact value can vary by environment configuration). Some endpoints have additional, stricter limits — this applies to computationally expensive operations (such as the AI assistant, report generation, route optimization) and to public unauthenticated endpoints (the contact form, telematics integration webhooks).

Response when the limit is exceeded

Once the limit is exceeded, the API returns 429 Too Many Requests. The response may include a Retry-After header with the number of seconds to wait before retrying.

Recommendations

• Read and respect the Retry-After header when present.
• Use exponential backoff with jitter for automatic retries.
• Avoid sharing a single account/organization header across multiple independent integration processes — each user + organization pair has its own counter.