Skip to main content
Public endpoints are throttled by IP and private endpoints by profile ID. Some endpoints (like /fills) may have custom rate limits. When a REST API rate limit is exceeded, a status of 429 Too Many Requests is returned.
Private endpoints are authenticated.

​
REST API Rate Limits

​
Public Endpoints

  • Requests per second per IP: 10
  • Requests per second per IP in bursts: Up to 15

​
Private Endpoints

  • Requests per second per profile: 15
  • Requests per second per profile in bursts: Up to 30

​
Private /fills Endpoint

  • Requests per second per profile: 10
  • Requests per second per profile in bursts: Up to 20

​
Private /loans Endpoint

  • Requests per second per profile: 10
Rate limits do not apply to List loan assets (/loans/assets) which is not private.

​
How Rate Limits Work

Rate-limiting for Exchange REST API uses a lazy-fill token bucket implementation. A TokenBucket stores a maximum amount of tokens, which is the burst size, and fills at a given rate called the refresh rate. The bucket starts full, and as requests are received, a token is removed for each request. Tokens are continuously added to the bucket at the refresh rate until full. When a user sends a request, the TokenBucket calculates whether to rate limit the user as follows:
  1. Fill the user’s TokenBucket to a token size based on the following formula: token_amount = min(burst, previous_token_amount + (current_time - previous_request_time) * refresh_rate)
  2. Remove 1 token if possible, otherwise rate limit the request.
  3. Repeat Steps 1 and 2 for each subsequent request.

​
TokenBucket Example

Let’s say you have a TokenBucket with burst = 3 and refresh_rate = 1. The table below represents the state of your token bucket after a series of requests: