> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.withverifa.com/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.withverifa.com/_mcp/server.

# Rate Limiting

> Rate limits, quotas, and handling 429 responses.

Verifa enforces two types of limits: **rate limits** (requests per minute) and
**product quotas** (resource creation per minute).

## Rate limits by plan

| Plan         | Requests per minute |
| ------------ | ------------------- |
| Free         | 300                 |
| Starter      | 600                 |
| Professional | 1,000               |
| Enterprise   | 1,000               |

## Product quotas

Product quotas limit how quickly you can create specific resources:

| Resource         | Free   | Starter | Professional | Enterprise |
| ---------------- | ------ | ------- | ------------ | ---------- |
| Session creation | 50/min | 100/min | 150/min      | 300/min    |
| API key creation | 10/min | 25/min  | 50/min       | Unlimited  |

### Daily verification limits

| Plan         | Verifications per day |
| ------------ | --------------------- |
| Free         | 50                    |
| Starter      | 1,000                 |
| Professional | 1,000                 |
| Enterprise   | Unlimited             |

## Response headers

Every API response includes rate limit headers:

| Header                  | Description                                    |
| ----------------------- | ---------------------------------------------- |
| `X-RateLimit-Limit`     | Maximum requests allowed in the current window |
| `X-RateLimit-Remaining` | Requests remaining in the current window       |
| `X-RateLimit-Reset`     | Unix timestamp when the window resets          |

When a product quota applies, additional headers are included:

| Header              | Description                           |
| ------------------- | ------------------------------------- |
| `X-Quota-Limit`     | Maximum quota in the current window   |
| `X-Quota-Remaining` | Quota remaining in the current window |
| `X-Quota-Reset`     | Unix timestamp when the quota resets  |

## Handling 429 responses

When you exceed a rate limit or quota, the API returns `429 Too Many Requests`
with a `Retry-After` header indicating how many seconds to wait:

```http
HTTP/1.1 429 Too Many Requests
Retry-After: 12
X-RateLimit-Limit: 300
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1738368012

{
  "error": "rate_limited",
  "detail": "Rate limit exceeded. Retry after 12 seconds.",
  "status_code": 429
}
```

**Best practice:** Implement exponential backoff with jitter. Respect the
`Retry-After` header value as the minimum wait time before retrying.

## Endpoint-specific limits

A few endpoints sit outside the per-plan request bucket and have dedicated
limits:

| Endpoint                        | Limit                                                                                 |
| ------------------------------- | ------------------------------------------------------------------------------------- |
| `/scim/v2/*`                    | Per-token bucket — SCIM provisioning calls share the standard per-API-key rate limit. |
| `/sso/*`                        | Per-IP bucket — SAML/OIDC sign-in endpoints are throttled per source IP.              |
| ComplyAdvantage inbound webhook | Dedicated token bucket: 300 capacity, refills at 5 requests per second.               |

These limits also return `429 Too Many Requests` with a `Retry-After` header.

## Related

* [Errors](/api-details/errors) — Full error response reference including 429
* [Authentication](/api-details/authentication) — API key types and plan tiers
* [Idempotency](/api-details/idempotency) — Safe retries with idempotency keys