API request limits: per key, per account and per task, the headers and what to do after a 429

The short answer: with a valid key you can make 90 requests per minute, per key, and 300 per minute across the whole account, adding up all keys. Some tasks have their own, lower limits. When you go over, the API answers 429 with a Retry-After header: wait that long and try again.

General and per-task limits

Who asks, or what	Limit
With a valid key	90 requests per minute, per key
The whole account, all keys together	300 requests per minute
Without a valid key	30 requests per minute, per IP
Checking domain names	30 per minute, per account
Changing domains, DNS, renewal cycle and SMS, and closing tickets (shared limit)	20 per minute, per account
Buying domains and extras and paying invoices (shared limit)	5 per minute, per account
Reading nameservers, lock, contacts and DNS zone	30 per minute, per account (answers from the 60-second copy do not count)
Requesting the transfer code	3 per hour, per account
Opening tickets	10 per hour, per account
Replying to tickets	30 per hour, per account
Downloading an invoice PDF	20 per minute, per account
Searching the Knowledge Base	30 per minute, per account
Requesting a cancellation	5 per hour, per account

GET /v1/ping and GET /v1/openapi.json always count per IP, even with a key. A request body can be up to 1 MB.

Hosting, e-mail and server limits

Area	Limit
Hosting: changes	20 per minute, per hosting account
Hosting: cPanel login link	5 per minute
E-mail: changes	20 per minute, per hosting account
E-mail: passwords	10 per minute
Servers: between actions on the same server	15 seconds
Servers: actions across the account	10 per minute
Servers: new passwords	5 per hour, across the account
Servers: reinstalls or restores	3 per hour, across the account

For hosting and servers, sandbox_ keys have these limits separately: testing in Sandbox does not use up the Production ones.

These are the current values and they can change. Do not hard-code them: read the headers on each answer, which always say what applies at that moment.

The headers that keep count for you

Header	What it says
X-RateLimit-Limit	Requests allowed per minute.
X-RateLimit-Remaining	Requests left this minute.
X-RateLimit-Reset	When the minute ends, in Unix seconds.
Retry-After	Only on a 429: how many seconds to wait.

GET /v1/limits returns the same values, plus the key's spending limit. Any valid key can call it.

What to do when you get a 429

1	Wait at least the Retry-After time before retrying.

2	If the 429 repeats, wait longer on each attempt.

3	Avoid very fast polling loops. For a long-running operation, check its status at a calm pace instead of asking non-stop: see long-running operations.

4	For lists, use per_page=100: every page counts as one request, and fewer pages mean fewer requests. See pagination.

Several programs hitting the account limit? The 300 per minute adds up every key. If a reporting script uses a lot, space it out: your other programs will thank you.

Want to see the limits live? The documentation, reached from the API page, shows them on every Playground answer.

See the API page

Categories

Categories