Limits

Request limits

The API has no per-partner request rate limits or rate-limit headers; requests are limited only at the network edge (see Edge limits). Handle 503 (service-unavailable, db-unavailable, query-timeout) with Retry-After: wait for it and retry the same request.

Limit	Value
`perPage`	1-100 (default 25); else 400 `data-failed-validation`, constraint `invalid-page`
`page`	1-100,000 (default 1); else 400 `data-failed-validation`, constraint `invalid-page`
Sort fields per request	1; else 400 `data-failed-validation`, constraint `invalid-sort`
Filter parameters per request	20; else 400 `data-failed-validation`, constraint `invalid-filter`
Values per `in` filter	100; else 400 `data-failed-validation`, constraint `invalid-filter`
`search`	255 characters
`Idempotency-Key`	255 characters, kept 24 hours
`X-Request-Id`	100 characters of `[A-Za-z0-9._:-]`
Vouchers per `vouchers:batch`	1,000 (body up to 10 MiB)
Vouchers per `vouchers:revoke`	1,000
Analytics buckets per request	366 days, 260 weeks or 120 months; up to 50 voucher sets
Webhook payload	64 KiB
Webhook response time	15 seconds

Edge limits

The network edge in front of the API counts requests per source IP address. There are no per-partner or per-key quotas.

Traffic	Limit per source IP address	When exceeded
Authenticated API requests (every path except `/public/` and `/auth/`)	Up to 30,000 requests per 60 seconds (on average 500 per second)	`429` with `Retry-After`; the address is blocked for 60 seconds
Keyless endpoints under `/public/` and `/auth/`	Up to 1,200 requests per 60 seconds	`429` with `Retry-After`; the address is blocked for 60 seconds

A short burst above 500 requests per second is fine as long as the 60-second total stays under 30,000. The edge answers the 429 itself, so its body is not the error format: branch on the status and Retry-After only. If one egress IP address of yours needs more, contact your AllRide account manager or AllRide through the Support link at the top of this site.

Resource limits

Resource	Limit
Voucher upload file	100 MiB and 1,000,000 data rows
Open uploads per voucher set	10
Upload row errors stored	10,000 per upload
Voucher code value	1-256 printable ASCII characters, no spaces
Voucher link value	2,048 characters
`metadata` (`JsonMetadata`)	16 KiB, depth 5, 100 keys per object
`allowedLinkHosts` / `allowedLinkSchemes`	10 / 3 per voucher set
Brand assets	500 counted per partner; 2 MiB per image (hero 5 MiB)
Stock alert recipients	20 members and 5 extra addresses
API keys	20 active; lifetime up to 2 years
Webhook endpoints	10; 30 event types each
IP allowlist	100 entries
Schedules	At most 2 years ahead

Data retention

Data	Kept
Voucher sets, vouchers, redemptions	For the life of your partner; archived sets stay readable
Audit log	24 months
Webhook events and their deliveries (log and replay)	30 days
Idempotency keys	24 hours
Stock alert firings	13 months
Sandbox data	Until a sandbox reset, announced 14 days ahead by email to your technical contact (`contacts.technicalEmail`)

Get started

Authentication and security

API conventions

Webhooks

Provider guides

Workspace

Request limits

Edge limits

Resource limits

Data retention

​Request limits

​Edge limits

​Resource limits

​Data retention

​Related

Request limits

Edge limits

Resource limits

Data retention

Related