# Rate limits The Developer Platform enforces rate limits at the Cloudflare edge, in front of `api.carebit.co`. Every limit uses a rolling 60-second window. | Limit | Value | | -------------------------------- | ------------------------- | | Per access token | 120 requests per minute | | Per developer project | 240 requests per minute | | Per Organization | 300 requests per minute | | Writes per access token | 30 requests per minute | | Writes per developer project | 60 requests per minute | | Writes per Organization | 90 requests per minute | | Patient creates per access token | 10 requests per minute | | `/oauth/token` per IP | 10 requests per minute | | `/oauth/token` per `client_id` | 10 requests per minute | | Unattributed requests per IP | 120 requests per minute | | API backstop per IP | 1,000 requests per minute | **Per access token** is keyed on the SHA-256 hash of the raw bearer token. The gateway never persists or logs the token itself. **Write** limits apply to `POST`, `PUT`, `PATCH`, and `DELETE` requests under `/v1`. They use separate counters and apply in addition to the all-request limits above. Read requests do not consume write capacity. **Patient create** limits apply to `POST /v1/patients` in addition to the general write and all-request limits. This lower limit protects the duplicate-review workflow from automated probing. **Unattributed** requests are those the edge cannot map to a real project or Organization yet: unauthenticated requests, fabricated tokens, and real requests that arrive before Rails has cached the token's identity. **API backstop** is a defense-in-depth per-IP limit applied to every resource API request in addition to the tenant limits. It is higher than the tenant limits because one integration IP typically serves several Organizations. ## 429 response When any limit is hit the API returns `429` with `Retry-After: 60`. ``` HTTP/1.1 429 Too Many Requests Retry-After: 60 Content-Type: application/json { "error": { "type": "rate_limit_error", "code": "too_many_requests", "message": "Too many requests. Please slow down." } } ``` Back off for at least the number of seconds in `Retry-After`, using the same `Idempotency-Key` on any write retry so a duplicate write never mutates state twice. ## Requesting a higher ceiling Contact support with your project ID, an estimate of steady-state and burst traffic, and the endpoint mix you are calling. Include the `Carebit-Developer-Platform-API-Request-Id` header from a recent `429` response so we can trace the throttle.