Skip to main content
We limit the number of requests each customer can send. This prevents abuse and keeps the load balanced across all our users.

Q: How is my rate limit calculated?

  • One budget across the whole API. All your API requests share a single limit for your environment, whichever endpoints they call. Each endpoint does not have its own limit.
  • Default: 500 requests per minute. If you need more, contact support and we can raise it for your environment.
  • Rolling window. We count requests over a sliding one-minute window, not a fixed bucket that resets at the start of each minute. A burst just before and just after the minute boundary doesn’t give you two minutes’ worth of requests.
  • Dashboard use is separate. Your team using the Heron dashboard does not count against your API limit.
  • Some endpoints have a stricter limit of their own.

Q: How do I know when I’m close to the limit?

Every response carries headers that tell you where you stand: Watch X-RateLimit-Remaining. Slow down as it gets close to zero, rather than waiting for a 429.

Q: We are receiving 429 “Too Many Requests” errors. How should we handle them?

A 429 means you went over your limit. The request was not processed, so it is safe to retry.
  1. Wait for the number of seconds in the Retry-After header, then retry.
  2. If you get another 429, back off exponentially (for example 1s, 2s, 4s, 8s, with random jitter added). Never wait less than Retry-After.
  3. Cap the number of retries, and log any requests you give up on.
Here’s a worked code example for retry behaviour: