Rate limits and pagination
Rate limits
Limits are per minute, sliding window, and configurable per deployment. Defaults:
| Scope | Default |
|---|---|
/v1/* per credential (API key or session) |
600 / min |
/v1/* per client IP |
3000 / min |
/public/* (hosted checkout) per shopper IP |
120 / min |
| Order lookup | 10 / min per IP or session, and 5 / day per email |
/webhooks/* (inbound) per IP |
600 / min |
/auth/* per IP |
20 / min |
POST /v1/health/evaluate |
once per 10 s per merchant (429 too_soon) |
Over the limit you get 429 with { "error": { "code": "rate_limited", "retryAfterSeconds": n } } and a Retry-After
header.
Pagination
Lists are small by design and most return a plain array. The large ones paginate:
| Endpoint | Style |
|---|---|
GET /v1/transactions |
Cursor: limit (1 to 200, default 50), response { data, nextCursor }; pass nextCursor as cursor with the same filters until it is null. |
GET /v1/audit-log |
Cursor: limit, response { items, nextCursor }. |
GET /v1/alerts, GET /v1/disputes |
Offset: limit (up to 200, default 100) and offset. |
GET /v1/carts |
limit and before (older than a timestamp). |
For bulk data use the exports: GET /v1/transactions/export.csv (streamed, up to 100,000 rows per call: split by date),
GET /v1/ledger/export (CSV or NDJSON).