Rate Limit

Rate Limit Profiles control the API traffic allowed for a tenant. Administrators define limits for regular API traffic and for traffic from Service Account roles. Limits can target specific API endpoints and HTTP verbs. Administrators can also configure burst limits for short traffic spikes.

Rate limiting covers API2 endpoints and tenant-defined Custom Method endpoints included in a Rate Limit Profile. UI-initiated server calls outside these API surfaces are not covered by this enhancement.

Rate Limit Profiles have the following types:

Generic profiles

Generic Rate Limit Profiles apply to regular API traffic not associated with a Service Account role. Generic is the default profile type for a new Rate Limit Profile.

Service Account profiles

Service Account Rate Limit Profiles control API requests by service accounts. Assign the profile to the role used by the service account; API requests made through that role are subject to the profile’s limits.

Existing licenses now allow up to five Service Account users per license across the entire environment. The limit is shared across all tenants, rather than allowing five Service Account users per tenant.

Only master administrators can create, edit, clone, and delete Rate Limit Profiles. When tenant rate-limit visibility is enabled, tenant administrators can view profiles and assignments that apply to their tenant. Tenant administrators cannot create, edit, or delete Rate Limit Profiles from the tenant setup page.

Migration and backward compatibility

During migration, existing Rate Limit Profiles are consolidated into Generic Rate Limit Profiles. Existing endpoint selections remain available, and configurations created before HTTP verb and burst-limit settings continue to work without manual changes.

If duplicate endpoint configurations are found, the migration keeps a single configuration based on the endpoint’s canonical identity. After migration, Static API2 endpoint information comes from the OpenAPI configuration rather than a hard-coded list.

Creating or updating a Rate Limit Profile

To create or update a Rate Limit Profile:

Navigate to System Console > Control Panel > Rate Limit Profiles.
Select Add Rate Limit Profile, or select an existing profile and choose Edit.
On the Profile tab, enter the Profile Name and Profile Description.
Select the Profile Type as Generic for regular API traffic or Service Account for traffic from Service Account roles.

Selecting Profile Type while adding a Rate Limit Profile
On the End Points tab, configure the static API endpoints.
On the Custom Methods tab, configure tenant-defined Custom Method endpoints if required.
Select the Preview tab to review the configuration.
Select Save.

Note:

Meta endpoints are unavailable for selection when configuring a Service Account Rate Limit Profile.
A system endpoint can be assigned to only one profile type. You cannot include the same system endpoint in both Generic and Service Account Rate Limit Profiles.
To enable JWT-based API access for service accounts, explicitly add the Login and Logout API endpoints to the Service Account Rate Limit Profile.

Configuring an endpoint

On the End Points tab of adding a rate limit profile, administrators can configure the following values:

Default Requests: The number of requests used to populate newly added endpoint rows.
Default request interval: The default time interval used for newly added endpoint rows.
Endpoint: The API endpoint governed by the rule.
HTTP Verb: The HTTP method governed by the rule, such as GET, POST, PUT, DELETE, or ALL.
Rate Limit: The number of requests allowed during the configured interval.
Interval: The time window used for the rate limit.
Burst Threshold: The number of requests allowed during the shorter burst interval.
Burst Interval: The time window used for burst enforcement.

Configuring an endpoint while adding a Rate Limit Profile

If a service account requests an endpoint that is not configured in its Service Account Rate Limit Profile, the platform returns an HTTP 403 Forbidden response.

The default request interval supports second, minute, hour, and day values. If an endpoint supports more than one HTTP verb, the endpoint displays with the verb ALL by default. A rule using ALL applies to all supported HTTP verbs for that endpoint.

Endpoint-specific settings take precedence over the profile's default values for that endpoint. If burst settings are configured, the system evaluates both the normal rate limit and the burst limit.

When an endpoint is selected in a Generic Rate Limit Profile, its configured limits apply to that endpoint for every tenant assigned to the profile.

Configuring a Custom Method endpoint

To configure Custom Method endpoints:

From the Custom Methods tab of adding a rate limit, select one or more tenants.
Select the Custom Method endpoints available for the selected tenants.
Configure the HTTP verb, rate limit, interval, burst threshold, and burst interval for each endpoint.

Configuring a Custom Method Endpoint while adding a Rate Limit Profile
Review the configuration on the Preview tab.

Previewing the configuration while adding a Rate Limit Profile
Select Save.

Custom Method endpoint options are discovered from tenant metadata. Administrators do not need to maintain a separate static list of Custom Method endpoints. A Custom Method that is no longer available may remain visible as an unavailable endpoint but cannot be selected as a new endpoint.

When an API request is received, the platform determines the applicable Rate Limit Profile based on the request identity:
Regular API traffic is evaluated against the tenant's Generic Rate Limit Profile.
Service Account traffic is evaluated against the Service Account Rate Limit Profile assigned to the Service Account role.
Endpoint matching considers both the endpoint and HTTP verb.
A rule without a specific HTTP verb applies to all HTTP verbs.
An endpoint-specific rule overrides the profile default for that endpoint.
Burst limits are evaluated when configured.

Exceeding applicable rate or burst limit

When a request exceeds the applicable rate or burst limit, the API rejects the request and returns a throttling message identifying the exceeded period and allowed maximum. For example:

HTTP/1.1 429 Too Many Requests
Content-Type: application/json
Retry-After: 30
X-RateLimit-Limit: 2
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1710000030
{
"status": "error",
"message": "Number of API calls during past per Minute exceeded. Allowed maximum of 60"
}

Tenant administrators can navigate to Setup Home > Administrative Setup > Rate Limits Settings to view the Rate Limit Profiles assigned to the tenant when tenant rate-limit visibility is enabled by the master administrator. Tenant views are read-only and may include the profile type and endpoint summaries.

View Rate Limit Profiles assigned to Tenant

Rate Limit Profile changes are recorded in Activity Trail. Audit history includes profile creation, updates, deletion, endpoint configuration changes, customer profile assignment changes, and Service Account role assignment changes.

For customer updates, Activity Trail displays Rate Limit Profile names instead of raw profile IDs. Long profile change entries are summarised as Rate Limit Profile Change. Open the detailed view to review structured change information and endpoint-level details.

Add Rate Limit Profile fields to the Customer page

The following fields are available for the Customer object:

Generic Rate Limit Profile: Allows an administrator to assign one Generic Rate Limit Profile to a Customer.
Service Account Rate Limit Profiles: Allows an administrator to assign one or more Service Account Rate Limit Profiles to a Customer.

If these fields are not displayed on the Customer page, add them using the page editor.

To add the fields:

From the application switcher, select System Console.
Select the Customers tab.
Navigate to the Customer page on which you want the fields to appear.
Open the Page Options menu and select Design This Page. The page editor opens.

Page Editor
In the Available Components panel, locate Generic Rate Limit Profile, Service Account Rate Limit Profiles and Max Service Account Users.
Drag the components to the any desired section of the page.

Adding Components
Select Save.

If the page does not contain an appropriate section, add a new section before adding the fields.

Adding the fields to the page does not assign a Rate Limit Profile automatically. Assign profiles by editing the Customer record.

To display the fields on other Customer pages, repeat this procedure for each page or use Save and Synchronize, if available, to apply the changes to other pages for the Customer object.

Assign Rate Limit Profiles to a Customer

A customer can have one Generic Rate Limit Profile and multiple Service Account Rate Limit Profiles.

To assign profiles:

From the application switcher, select System Console.
Select the Customers tab.
Open an existing Customer record or select New Customer.
Locate the System Settings section.
- From Generic Rate Limit Profile, select the profile that will govern regular API traffic for the Customer.
- From Service Account Rate Limit Profiles, select one or more profiles that can be used by the Customer’s Service Account roles.
Select Save.

The selected Generic Rate Limit Profile applies to regular API requests made for the tenant associated with the Customer record.

When an endpoint is configured in a Generic Rate Limit Profile, its limits apply to that endpoint for every tenant assigned to the profile.

Assign a Rate Limit Profile to a Service Account role

Service Account Rate Limit Profiles control API requests made through Service Account roles.

To assign a profile:

From the Administration Setup menu, select Security > Roles.
Locate and open the Service Account role used for API access.
Select Edit.
From Service Account Rate Limit Profile, select the required profile.
Select Save.

API requests made through the Service Account role are evaluated against the selected profile.