Rate limits
The limits the server enforces today, read from the same constants it uses.
How limits work
Limits are counted in our database, so they hold across every Cloudflare location. A refused request gets HTTP 429. /api/auth answers carry an X-Retry-After header with the seconds to wait; /v1 answers use the code RATE_LIMITED. A window starts at the last allowed request.
Limits per account are keyed on a keyed hash of the email address, never the address itself.
Sign-in and new accounts
| What | Limit | Counted per |
|---|---|---|
| /api/auth/sign-in/email | 10 per 1 minute | Each client IP address |
| /api/auth/sign-up/email | 10 per 5 minutes | Each client IP address |
| /api/auth/sign-in/magic-link | 30 per 5 minutes | Each client IP address |
| /api/auth/verify-email | 10 per 5 minutes | Each client IP address |
| /api/auth/two-factor/* | 10 per 5 minutes | Each client IP address |
| /api/auth/passkey/* | 20 per 1 minute | Each client IP address |
| Any other /api/auth path | 100 per 1 minute | Each client IP address |
| Failed password sign-ins | 5 per 15 minutes | Account and client IP address |
| Failed password sign-ins | 20 per 15 minutes | Account |
| Emails sent (sign-in link, password reset, verification) | 3 per 15 minutes | Account and client IP address |
| Emails sent (sign-in link, password reset, verification) | 10 per 1 hour | Account |
| Emails sent (all kinds together) | 200 per 1 hour | Each client IP address |
| Wrong authenticator codes in a row | 10, then locked for 15 minutes | Account |
A correct password does not use up the failed-sign-in allowance.
Inside /v1
| What | Limit | Counted per |
|---|---|---|
| New referrals (POST /v1/cases/referrals) | 3 per 1 hour | Referring person |
| New referrals (POST /v1/cases/referrals) | 20 per 1 hour | Agency |
| Emailed step-up codes | 5 per 1 hour; each works for 10 minutes and 5 tries | Person |
| Wrong step-up authenticator codes in a row | 5, then locked for 15 minutes | Person |
| Wrong medicine-signing PINs in a row | 5, then locked for 15 minutes | Carer |
| Secure document sends | 3 per day | Document |
| Secure document sends | 25 per day | Agency |
| Mobile number codes (POST /v1/notifications/sms/phone) | 5 per 1 hour | Person |
| Mobile number codes (POST /v1/notifications/sms/phone) | 3 per 1 hour | Mobile number |
| Mobile number code checks (POST /v1/notifications/sms/phone/check) | 10 per 15 minutes | Person |
| Marking messages, announcements and notifications read (POST .../read, POST /v1/notifications/read-all) | 60 per 1 minute | Person |
| File links (POST /v1/files/:kind/:id/link) | 120 per 1 minute | Person |
| Opening files (GET /v1/files/open/:token) | 240 per 1 minute | Person |
API keys and webhooks
| What | Limit | Counted per |
|---|---|---|
| Requests with an API key | 120 per 1 minute | Key |
| API keys | 25 at once | Agency |
| Webhook endpoints | 10 at once | Agency |
Over the key or endpoint count, creating another answers 409 CONFLICT.
Secure document links
| What | Limit | Counted per |
|---|---|---|
| Link lifetime | 7 days | Link |
| One-time codes | 5 per 1 hour; each works for 10 minutes and 5 tries | Link |
| Code requests | 10 per 1 hour | Link |
| Document opens | 30 per 1 hour | Link |