Limits

Size and count limits of requests and resources, and how long data and logs are kept.

The API enforces the size and count limits below. It has no per-partner rate tiers, no per-key quotas and sends no rate-limit headers. The only request-rate limits are the per-IP limits of the network edge (Edge limits), and the only attempt limits are the ones that protect the email OTP on Redemption Link landing pages.

Request limits

Limit	Value	When exceeded
Items per list page (perPage)	1 to 100, default 25	400 data-failed-validation, constraint invalid-page
List page number (page)	1 to 100,000, default 1	400 data-failed-validation, constraint invalid-page
Sort fields per request	1	400 data-failed-validation, constraint invalid-sort
filter[…] parameters per request	20	400 data-failed-validation, constraint invalid-filter
Values per in filter	100	400 data-failed-validation, constraint invalid-filter
search term	255 characters	400 data-failed-validation
JSON nesting depth of a body	32 levels	400 malformed-json
Idempotency-Key	1 to 255 printable ASCII characters	400 invalid-idempotency-key
Vouchers per batch redemption (sum of quantity)	10	422 batch-too-large
Redemption Links per bulk create	100	400 data-failed-validation
Webhook payload	64 KiB	Payloads are kept below this size by design
Webhook response time	15 seconds	The delivery counts as failed and is retried

Edge limits

The network edge in front of the API counts requests per source IP address. There are no per-partner or per-key quotas.

Traffic	Limit per source IP address	When exceeded
Authenticated API requests (every path except /public/ and /auth/)	Up to 30,000 requests per 60 seconds (on average 500 per second)	429 with Retry-After; the address is blocked for 60 seconds
Keyless endpoints under /public/ and /auth/	Up to 1,200 requests per 60 seconds	429 with Retry-After; the address is blocked for 60 seconds

A short burst above 500 requests per second is fine as long as the 60-second total stays under 30,000. The edge answers the 429 itself, so its body is not the error format: branch on the status and Retry-After only. If one egress IP address of yours needs more, contact your AllRide account manager or AllRide through the Support link at the top of this site.

Resource limits

Limit	Value
metadata objects (redemptions, entities, links)	16 KiB, nesting depth 5, 100 keys per object (constraint invalid-metadata)
Redemption entity refId	1 to 128 characters of letters, digits and ._:@/+=- (constraint invalid-ref-id)
Catalog externalRef	64 characters, unique per consumer
Void window	30 days after the redemption (void-window-expired)
IP allowlist entries	100 per partner (ip-allowlist-limit-reached)
Active API keys	20 per partner (api-key-limit-reached)
API key lifetime	at most 2 years
Billing document download link	valid 15 minutes

Data retention

Data	Kept
Idempotency keys and stored responses	24 hours
Webhook delivery logs and replay	30 days after the event (one entry per stored event and endpoint, with its attempts; replay works while the delivery is in the log)
Audit log	2 years online
Redemptions	Kept as your ledger; erasing a redemption entity removes its personal data and leaves the redemptions anonymous

Related

• Pagination, filtering and sorting
• Idempotency
• Retries, logs and replay