The limits are a ceiling against runaway loops, set well above what an integration needs. They count requests per minute for each API key and each OAuth connection (one app, company and user), so every company your app is connected to has its own.
| Group | Requests per minute |
|---|---|
| Every request to the API | 600 |
Uploads: POST /v1/attachments, POST /v1/attachments/{id}/files and POST /v1/journal-entries/{id}/attachments |
120 |
Invoice PDFs: GET /v1/invoices/{id}/pdf |
60 |
Uploads and PDFs also count toward the 600.
Nothing is counted per IP address for a request with a working credential, so it does not matter that your host shares its outgoing addresses with others. The one limit per address is on failures: 300 requests per minute that end in 401.
Headers
Responses carry the IETF RateLimit headers, so you can slow down before you reach a limit:
RateLimit-Policy: 600;w=60
RateLimit-Limit: 600
RateLimit-Remaining: 595
RateLimit-Reset: 41RateLimit-Reset is the number of seconds until the window resets. Past a limit, requests fail with 429 rate_limit_exceeded and a Retry-After header until then.
MCP
The MCP server counts separately from the API: 600 requests per minute per key or connection to /mcp, where every message counts, and 60 file uploads per minute to upload links from one IP address.
Need more for a production integration? Write to support@numina.app.