Limits

The API enforces the size and count limits below. It has no per-partner rate tiers, no per-key quotas and sends no rate-limit headers. The only request-rate limits are the per-IP limits of the network edge (Edge limits), and the only attempt limits are the ones that protect the email OTP on Redemption Link landing pages.

Request limits

Limit	Value	When exceeded
Items per list page (`perPage`)	1 to 100, default 25	`400 data-failed-validation`, constraint `invalid-page`
List page number (`page`)	1 to 100,000, default 1	`400 data-failed-validation`, constraint `invalid-page`
Sort fields per request	1	`400 data-failed-validation`, constraint `invalid-sort`
`filter[…]` parameters per request	20	`400 data-failed-validation`, constraint `invalid-filter`
Values per `in` filter	100	`400 data-failed-validation`, constraint `invalid-filter`
`search` term	255 characters	`400 data-failed-validation`
JSON nesting depth of a body	32 levels	`400` `malformed-json`
`Idempotency-Key`	1 to 255 printable ASCII characters	`400` `invalid-idempotency-key`
Vouchers per batch redemption (sum of `quantity`)	10	`422` `batch-too-large`
Redemption Links per bulk create	100	`400 data-failed-validation`
Webhook payload	64 KiB	Payloads are kept below this size by design
Webhook response time	15 seconds	The delivery counts as failed and is retried

Edge limits

The network edge in front of the API counts requests per source IP address. There are no per-partner or per-key quotas.

Traffic	Limit per source IP address	When exceeded
Authenticated API requests (every path except `/public/` and `/auth/`)	Up to 30,000 requests per 60 seconds (on average 500 per second)	`429` with `Retry-After`; the address is blocked for 60 seconds
Keyless endpoints under `/public/` and `/auth/`	Up to 1,200 requests per 60 seconds	`429` with `Retry-After`; the address is blocked for 60 seconds

A short burst above 500 requests per second is fine as long as the 60-second total stays under 30,000. The edge answers the 429 itself, so its body is not the error format: branch on the status and Retry-After only. If one egress IP address of yours needs more, contact your AllRide account manager or AllRide through the Support link at the top of this site.

Resource limits

Limit	Value
`metadata` objects (redemptions, entities, links)	16 KiB, nesting depth 5, 100 keys per object (constraint `invalid-metadata`)
Redemption entity `refId`	1 to 128 characters of letters, digits and `._:@/+=-` (constraint `invalid-ref-id`)
Catalog `externalRef`	64 characters, unique per consumer
Void window	30 days after the redemption (`void-window-expired`)
IP allowlist entries	100 per partner (`ip-allowlist-limit-reached`)
Active API keys	20 per partner (`api-key-limit-reached`)
API key lifetime	at most 2 years
Billing document download link	valid 15 minutes

Data retention

Data	Kept
Idempotency keys and stored responses	24 hours
Webhook delivery logs and replay	30 days after the event (one entry per stored event and endpoint, with its attempts; replay works while the delivery is in the log)
Audit log	2 years online
Redemptions	Kept as your ledger; erasing a redemption entity removes its personal data and leaves the redemptions anonymous

Get started

Authentication and security

API conventions

Webhooks

Consumer guides

Workspace

Request limits

Edge limits

Resource limits

Data retention

​Request limits

​Edge limits

​Resource limits

​Data retention

​Related

Request limits

Edge limits

Resource limits

Data retention

Related