Rate limits and quotas
Limits are attached to your plan and counted per credential. REST calls and MCP tool calls draw on the same counter — an agent and an integration using the same credential share its budget, whatever the establishments that credential covers.
Reading the headers
Every response carries the state of your budget, so you can pace yourself without waiting to be refused:
| Header | Meaning |
|---|---|
RateLimit-Limit |
Calls allowed in the current window. |
RateLimit-Remaining |
Calls left in it. |
RateLimit-Reset |
Seconds until the window resets. |
Watch RateLimit-Remaining and slow down as it approaches zero. Treating a 429 as the signal to slow
down means you are already being refused.
When you exceed it
HTTP/1.1 429 Too Many Requests
Retry-After: 12
Content-Type: application/problem+json
{ "type": "quota/exceeded", "title": "Quota exceeded", "status": 429, … }
Wait Retry-After seconds. Retrying sooner does not get you served faster — it consumes attempts.
Add jitter when several workers retry at once: identical backoff across a fleet reconstitutes the burst that got you throttled.
Payload limits
Your plan also caps request body size.
| Status | type |
Cause |
|---|---|---|
411 |
— | The request has no Content-Length. Send one. |
413 |
quota/payload-too-large |
The body exceeds your plan's cap; detail gives the limit in bytes. |
Neither is retryable as-is — split the payload or ask about a higher plan.
Plans
Plans are Free, Standard, Premium and Partner, in increasing order of allowance. Specific endpoints
may carry their own tighter limit, independent of the plan, when the underlying operation is expensive or
sensitive — payroll being the obvious case.
Your Staff & Go contact tells you which plan applies to you and its concrete values.
Legacy tokens
Calls authenticated with a deprecated BearerClient token are not counted and receive no RateLimit
headers. Do not read that as unlimited capacity: it means you have no back-pressure signal at all, and no
protection from being the reason a limit gets tightened. See Authentication.