Limits and quotas
Two budgets apply to every request made with a key: a rate limit (requests per minute, with a short burst) and the organization's daily quota (its plan). Anonymous requests share a rate limit per client address.
Rate limits
| Endpoint group | Anonymous, per address | With an API key |
|---|---|---|
| Public data (companies, directory, index, requirements) | 300/min, burst 60 | 20 × that, per key |
| Opportunities | 300/min, burst 60 | 20 × that, per key |
| Search | 120/min, burst 30 | 20 × that, per key |
/v1/org/... (organization records) | not available | 1200/min, burst 600 |
MCP (/mcp) | 60/min, burst 20 | 20 × that, per key |
/oauth/token | 30/min per address and per client, burst 10 | n/a |
| Partner risk signals | n/a | 60/min per key |
When a limit is reached the API answers 429 with Retry-After (seconds) and code rate_limited. Wait that long, then continue. Add jitter if several workers share a key.
Daily quotas
An organization's keys and OAuth tokens share one daily quota, set by its plan (10,000 requests a day on the free plan). The quota refills evenly through the day. When it runs out, requests get 429 with code quota_exceeded and Retry-After.
Usage
Requests are counted per key and day. GET /v1/orgs/{org_id}/api-usage?month=YYYY-MM sums a month per key and per OAuth client (its hour-long tokens counted together), next to the daily quota; GET /v1/orgs/{org_id}/api-keys/{key_id}/usage gives one key's days. Invoices for API use, when a plan prices it, are built from the same counts.
Being a good client
- Cache what you read. Company pages change slowly;
Cache-Controlsays how long a public answer stays fresh. - Prefer webhooks to polling for your organization's events.
- Retry
429and5xxwith backoff; do not retry other4xxwithout changing the request.