Rate limits
Counted over a sliding minute, per key or per token — never per company.
| Tier | Requests / minute | Routes |
|---|---|---|
light | 120 | Single-object and "me" reads: /users/me, /account, /presence/me, /calls/{id}/status |
medium | 60 | Everything else (the default tier): create, change, send |
heavy | 20 | Lists, media and exports: /calls, /messages, /recordings/{id}/media… |
Every response carries three headers; above the tier, 429 rate_limited with Retry-After in seconds.
HTTP/1.1 200 OK
X-RateLimit-Limit: 60
X-RateLimit-Remaining: 59
X-RateLimit-Reset: 1758816060
X-Request-Id: 8d1c…
HTTP/1.1 429 Too Many Requests
Retry-After: 17
X-RateLimit-Limit: 120
X-RateLimit-Remaining: 0
X-RateLimit-Reset: 1758816077
{"error": {"type": "rate_limited", "message": "Too many requests: 120 a minute on this route", "request_id": "8d1c…"}}X-RateLimit-Limit— the ceiling of this route's tier;X-RateLimit-Remaining— what you have left in the minute;X-RateLimit-Reset— the Unix time the oldest window slot frees up.- Each route's tier is in the reference (
x-rate-tier). - Requests without a token (
/oauth/token,/oauth/authorize) are counted per IP address. - Repeating a read to "see whether something changed" is almost always better served by a webhook or a sync token.