Rate limiting
Some Partner API endpoints are rate limited per API key. Additional endpoints will adopt the same limits over time.
Rate limit
All rate-limited endpoints allow 100 requests per 10 seconds per API key.
Each HTTP method and path combination has its own independent counter. For
example, GET and PATCH on customer assets are counted separately, as are
domain and email asset mutations.
How it works
Rate limits are enforced per SW-API-KEY header value. All requests
authenticated with the same API key share one counter for each rate-limited
endpoint.
Bursts above 100 calls within any 10-second window are rejected until the window resets.
If you exceed the limit, the API returns 429 Too Many Requests:
{
"success": false,
"error": "Rate limit exceeded"
}Integration guidance
- Throttle polling and bulk sync jobs to stay within the 100 requests per 10 seconds limit.
- Batch add and remove operations where possible instead of sending many single-item requests.
- Retry with exponential backoff when you receive
429responses.
Currently rate-limited endpoints
| Endpoint |
|---|
Onboard a new customer (POST) |
Get customer monitored assets (GET) |
Update customer monitored assets (PATCH) |
Add customer monitored domains (POST) |
Remove customer monitored domains (DELETE) |
Add customer monitored emails (POST) |
Remove customer monitored emails (DELETE) |
Rate limiting will eventually apply to all Partner API endpoints. This page will be updated as additional endpoints are included.
List partner customers GET
Returns a paginated list of customers for the authenticated partner, including customer reference, lifecycle status, breach summary, monitored domains, and monitored asset emails. Optionally filter by customer status.
Custom plans
How custom plans work for distributors and partners