> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xpressbot.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Rate limits

> How many requests each kind of endpoint allows, and what to do when you hit a limit.

## What is this?

Requests are limited **per API user**, in a 60-second window, by the kind of endpoint. Limits protect your workspace from runaway scripts.

## What can I do here?

* See the limit for each type of endpoint
* Read the rate-limit headers on every response
* Handle `429` responses correctly

## How to use it

### Limits by endpoint type

| Endpoint type               | Limit                                 | Endpoints                                                           |
| --------------------------- | ------------------------------------- | ------------------------------------------------------------------- |
| **Read**                    | 120 requests per minute               | All `/list` endpoints, plus **Get message status**                  |
| **Write**                   | 30 requests per minute                | Workspace `/manage` endpoints — contacts, custom fields, and labels |
| **Messaging**               | 20 requests per minute                | **Send template message** and **Send session message**              |
| **Automation trigger**      | 20 requests per minute                | **Trigger automation**                                              |
| **Authentication attempts** | 60 requests per minute per IP address | Every API request, before the key is checked                        |

### Handle a `429`

When you exceed a limit, the API returns `429` with a `Retry-After` header — the number of seconds to wait. Every response also includes standard `RateLimit-*` headers so you can see how much of your allowance is left.

```json theme={null}
{
  "success": false,
  "error": "rate_limited",
  "message": "Too many requests. Try again in 12 second(s)."
}
```

Wait for the `Retry-After` period, then retry. For bulk work, spread requests out over time rather than sending them in a burst.

## Troubleshooting / Technical Notes

* **I hit a limit while sending messages.** Messaging endpoints allow 20 requests per minute. For larger sends, use a [campaign](/workspace/whatsapp/campaigns) instead.
* **I'm limited even though I'm under my endpoint's limit.** Invalid or missing keys count against the per-IP authentication limit. Fix the key first.
* **Limits are per API user.** They apply to the account that owns the key, not to individual requests or IP addresses.

## Related docs

* [Introduction](/api-reference/introduction)
* [Authentication](/api-reference/authentication)
* [Errors](/api-reference/errors)