> ## Documentation Index
> Fetch the complete documentation index at: https://docs-consumer.voucher.allride.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Limits

> Size and count limits of requests and resources, and how long data and logs are kept.

The API enforces the size and count limits below. It has no per-partner rate tiers, no per-key quotas and sends no rate-limit headers. The only request-rate limits are the per-IP limits of the network edge ([Edge limits](#edge-limits)), and the only attempt limits are the ones that protect the [email OTP](https://docs-consumer.voucher.allride.io/consumer/email-otp-links.md#limits) on Redemption Link landing pages.

## Request limits

| Limit | Value | When exceeded |
| - | - | - |
| Items per list page (`perPage`) | 1 to 100, default 25 | `400 data-failed-validation`, constraint [`invalid-page`](https://docs-consumer.voucher.allride.io/errors/catalog#invalid-page) |
| List page number (`page`) | 1 to 100,000, default 1 | `400 data-failed-validation`, constraint [`invalid-page`](https://docs-consumer.voucher.allride.io/errors/catalog#invalid-page) |
| Sort fields per request | 1 | `400 data-failed-validation`, constraint [`invalid-sort`](https://docs-consumer.voucher.allride.io/errors/catalog#invalid-sort) |
| `filter[…]` parameters per request | 20 | `400 data-failed-validation`, constraint [`invalid-filter`](https://docs-consumer.voucher.allride.io/errors/catalog#invalid-filter) |
| Values per `in` filter | 100 | `400 data-failed-validation`, constraint [`invalid-filter`](https://docs-consumer.voucher.allride.io/errors/catalog#invalid-filter) |
| `search` term | 255 characters | `400 data-failed-validation` |
| JSON nesting depth of a body | 32 levels | `400` [`malformed-json`](https://docs-consumer.voucher.allride.io/errors/catalog#malformed-json) |
| `Idempotency-Key` | 1 to 255 printable ASCII characters | `400` [`invalid-idempotency-key`](https://docs-consumer.voucher.allride.io/errors/catalog#invalid-idempotency-key) |
| Vouchers per batch redemption (sum of `quantity`) | 10 | `422` [`batch-too-large`](https://docs-consumer.voucher.allride.io/errors/catalog#batch-too-large) |
| Redemption Links per bulk create | 100 | `400 data-failed-validation` |
| Webhook payload | 64 KiB | Payloads are kept below this size by design |
| Webhook response time | 15 seconds | The delivery counts as failed and is retried |

## Edge limits

The network edge in front of the API counts requests per source IP address. There are no per-partner or per-key quotas.

| Traffic | Limit per source IP address | When exceeded |
| - | - | - |
| Authenticated API requests (every path except `/public/` and `/auth/`) | Up to 30,000 requests per 60 seconds (on average 500 per second) | `429` with `Retry-After`; the address is blocked for 60 seconds |
| Keyless endpoints under `/public/` and `/auth/` | Up to 1,200 requests per 60 seconds | `429` with `Retry-After`; the address is blocked for 60 seconds |

A short burst above 500 requests per second is fine as long as the 60-second total stays under 30,000. The edge answers the `429` itself, so its body is not the [error format](https://docs-consumer.voucher.allride.io/errors.md): branch on the status and `Retry-After` only. If one egress IP address of yours needs more, contact your AllRide account manager or AllRide through the **Support** link at the top of this site.

## Resource limits

| Limit | Value |
| - | - |
| `metadata` objects (redemptions, entities, links) | 16 KiB, nesting depth 5, 100 keys per object (constraint [`invalid-metadata`](https://docs-consumer.voucher.allride.io/errors/catalog#invalid-metadata)) |
| Redemption entity `refId` | 1 to 128 characters of letters, digits and `._:@/+=-` (constraint [`invalid-ref-id`](https://docs-consumer.voucher.allride.io/errors/catalog#invalid-ref-id)) |
| Catalog `externalRef` | 64 characters, unique per consumer |
| Void window | 30 days after the redemption ([`void-window-expired`](https://docs-consumer.voucher.allride.io/errors/catalog#void-window-expired)) |
| IP allowlist entries | 100 per partner ([`ip-allowlist-limit-reached`](https://docs-consumer.voucher.allride.io/errors/catalog#ip-allowlist-limit-reached)) |
| Active API keys | 20 per partner ([`api-key-limit-reached`](https://docs-consumer.voucher.allride.io/errors/catalog#api-key-limit-reached)) |
| API key lifetime | at most 2 years |
| Billing document download link | valid 15 minutes |

## Data retention

| Data | Kept |
| - | - |
| Idempotency keys and stored responses | 24 hours |
| Webhook delivery logs and replay | 30 days after the event (one entry per stored event and endpoint, with its attempts; replay works while the delivery is in the log) |
| Audit log | 2 years online |
| Redemptions | Kept as your ledger; [erasing a redemption entity](https://docs-consumer.voucher.allride.io/consumer/redemption-entities.md#erasure-gdpr) removes its personal data and leaves the redemptions anonymous |

## Related

* [Pagination, filtering and sorting](https://docs-consumer.voucher.allride.io/guides/pagination.md)
* [Idempotency](https://docs-consumer.voucher.allride.io/guides/idempotency.md)
* [Retries, logs and replay](https://docs-consumer.voucher.allride.io/webhooks/retries-and-logs.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.