Usage limits
Every Public API v1 request is counted against three windows at once: a 5-minute burst window, a UTC day, and a UTC calendar month. Exceeding any one of them answers 429.
Rate limits
The quota belongs to the account that created the key, not to the key itself. Every key that account issues draws on the same buckets, so issuing more keys does not add headroom.
| Plan | Per 5 minutes | Per day | Per month |
|---|---|---|---|
| Scale | 600 | 50,000 | 500,000 |
| Enterprise | 1,200 | 100,000 | 1,000,000 |
Counting happens at authentication, before any work. A rejected request never reads survey or response data, so a throttled integration cannot run up your read costs.
Fixed limits
- List endpoints return 25 items by default and at most 100 per page.
- externalUserId on an embed session accepts up to 256 characters.
- An embed session URL expires one hour after it is created.
- A webhook endpoint must answer within 5 seconds.
Handling a 429
A throttled request answers 429 with the code rate_limited and a Retry-After header holding the seconds until that window resets. Wait for that interval before retrying: a retry sent earlier is rejected again and tells you nothing new. Reading larger pages and caching what you already have reduces pressure far more than retrying harder.