Rate Limits
Request rate limits for the G-Commerce API — global and login-specific caps, headers, and 429 handling.
Rate Limits
The API enforces per-IP rate limits to protect the platform. Limits are applied automatically — no configuration is required on your side.
Limits
| Scope | Limit | Window | Key |
|---|---|---|---|
| All HTTP endpoints | 10,000 requests | 10 minutes | Per IP |
POST /api/v1/auth/login | 10 requests | 15 minutes | Per IP |
The login endpoint uses a stricter override for brute-force protection. All other documented REST endpoints (including Vendor API) use the global limit.
When you exceed a limit
The API returns HTTP 429 with a JSON body:
{
"statusCode": 429,
"error": "Too Many Requests",
"message": "Rate limit exceeded, retry in 1 minute"
}The message includes how long to wait (retry in …).
Response headers
Every response includes rate-limit headers:
| Header | Meaning |
|---|---|
x-ratelimit-limit | Maximum requests allowed in the current window |
x-ratelimit-remaining | Requests remaining in the current window |
x-ratelimit-reset | When the window resets (Unix timestamp or duration, depending on the proxy) |
retry-after | Seconds until you can retry (present only on 429 responses) |
Handling 429s
- Read
retry-after(or the wait time in the errormessage). - Pause requests until that window elapses.
- Resume with backoff if you continue to hit the cap.
See Errors for the standard error format, and Login for the auth-specific limit.