Developer guide
Rate limits
Per-key and per-address budgets, the headers that report them, and how to back off.
Open the Developer CenterNever send patient information to a sandbox key.
On this deployment: Headless Connect API: Not available in this environment
- Headless Connect API: Not available in this environment. What runs now: Sandbox-key calls to /api/v1 on the nonproduction deployment with synthetic data: claims scan, formulary, rulebook, the sandbox order preview, delivery reads and replay, and the MCP endpoint, on a deployment whose database has the 20261101090000-range migrations applied (a hard deploy-order dependency the merge gate enforces; ahead of them the rulebook, claims scan, MCP and replay answer 503).
Budgets
| Budget | Limit | Counted per |
|---|---|---|
| Every request a key makes | 600 per minute | key |
| Every write a key makes, in addition | 120 per minute | key |
| Reads, with or without a key (the public catalog, disclosures and formulary included) | 600 per minute | network address |
| Writes presenting a key to a keyed resource, before the key's own budgets | 1200 per minute | network address |
| Writes with no key, and writes to a public resource (records requests) | 60 per minute | network address |
A key's budget is spent before its scope is checked, so a request a key is not allowed to make still counts. Keys behind one egress address do not share their budgets; their writes share only a per-address ceiling of 1200 a minute.
Headers and refusals
RateLimit-Limit,RateLimit-RemainingandRateLimit-Reset(seconds) on every keyed answer.429 rate_limitedwithRetry-Afterwhen a budget is spent. Wait that long; nothing was applied.503 rate_limit_unavailablewithRetry-After: 30when the budget could not be checked. The request was refused, not applied.
Back off with jitter and retry writes with their original Idempotency-Key, so a retry after a timeout cannot apply twice.