# Limits

How many requests you can make and what limits apply to the data.

| Limit | Value |
|---|---|
| Requests from one IP (all except /health/api) | 600 per 15 minutes |
| Requests from one client (by key) | 150 per 15 minutes |
| Sandbox from one IP, on top | 30 per 15 minutes |
| Request body | 10 KB, application/json only |
| X-Entity-Key · idempotencyKey · webhookUrl | 128 · 128 · 2048 characters |

Exceeding a limit gives `429 Too many requests, try again later`. The window is fixed: the counter resets 15 minutes after the first request in the window. The values may change — don't build logic on the exact numbers.

## Staying under the limit

- Cache the catalog: `GET /products` is refreshed only every 10 minutes on our side anyway.
- Wait for the webhook instead of polling orders; if you poll, no more than once every 5–10 seconds.
- Don't check availability of every product in a row — only the one you're buying.

## Blocking

Repeated requests to non-existent paths without a valid key are treated as scanning: the IP is temporarily blocked (`403 IP banned`).

## Maintenance

During maintenance every request except `/health/api` gets `503` with `"code": "maintenance_mode"` and the header `X-Maintenance-Mode: 1`. Retry later.