API Rate Limits

To ensure fair and consistent access to our services while maintaining the highest level of performance for all users, we have implemented the following limits for our APIs:

• Authorized Endpoints: 500 requests per 60 seconds
• Unauthorized Endpoint (Get Token): 600 requests per 60 seconds

Exceeding rate limits

When a given rate limit has been exceeded, the server will respond with a 429 Too Many Requests status code. This response will include a Retry-After: n header indicating the number of seconds to wait before another request will be permitted. Example response body:

{
  "statusCode": 429,
  "message": "Rate limit is exceeded. Try again in 52 seconds."
}

Banks often set rate limits on the number of calls that can be made at once. If Atto exceeds these rate limits we will receive a 429 response from the banks. Since the limit is set by the bank, it is unfortunately out of Atto’s control. Furthermore, each bank has its own logic as to how it applies rate limits and varies widely, it is important to spread out your API calls throughout the day.