InlineShield
Start free
Docs menu
Reference

Rate limits and quotas

Two kinds of limit apply: per-minute rate limits on each endpoint, and the monthly screening quota of your plan. Test traffic has its own limits and never uses the quota.

Last updated

Per-minute limits

EndpointLive limitTest limitHeaders
/verifyYour plan's limit, per account300 per accountX-RateLimit-*; Retry-After on 429
/checkYour plan's limit per account, and 30 per client IP300 per account, and 30 per client IPRetry-After on 429
/siteverifyThe key's own limit: 1,200 for a live key as created300 per test keyX-RateLimit-*; Retry-After on 429
/feedbackYour plan's limit, per keyYour plan's limit, per keyX-RateLimit-*; Retry-After on 429
/reviews/{reviewId}60 per key60 per keyRetry-After on 429

Your plan's per-minute limit:

PlanRequests per minuteScreenings per month
Free601,000
Starter60025,000
Pro600250,000
Enterprise1200Contact us

Live and test traffic use separate buckets, so tests never slow down production. /verify and /check have separate buckets too. Over a limit, the answer is 429 RATE_LIMIT_EXCEEDED; wait the Retry-After seconds.

Monthly quota

Each live screening by /verify or /check counts once against your plan's monthly quota. /siteverify, /feedback, /reviews and test traffic never count. The month is the UTC calendar month.

You get an email at 80% and 100% of the quota. Past 100% screening goes on in a grace margin; at 110% of the quota the API stops screening until the next month or an upgrade:

  • /verify and /check answer 402 QUOTA_EXCEEDED with used, limit and resetsAt.
  • /check issues no token, so /siteverify answers HTTP 200 with success: false and error: "QUOTA_EXCEEDED": a different shape from the 402, so handle both.
The shared snippets treat both as "InlineShield unavailable" and follow your fail-open or fail-closed choice.

Test mode

300 requests per minute per account on each of /verify and /check, 300 per minute per test key on /siteverify, and 10,000 test screenings (/verify and /check) per account per UTC day (then 429 TEST_LIMIT). See Test mode.

Headers

HeaderMeaning
X-RateLimit-LimitRequests allowed in the current one-minute window.
X-RateLimit-RemainingRequests left in the current window.
X-RateLimit-ResetSeconds until the current window ends.
X-Quota-LimitLive requests only: the monthly quota of the plan.
X-Quota-UsedLive requests only: screenings counted this month, this one included.
X-Quota-ResetLive requests only: when the count resets (the start of the next UTC month).
X-Quota-StateLive requests only: ok, warn (80% used), limit (100%), grace (over 100%, still served) or blocked.
Retry-AfterSeconds to wait before trying again.

Browser code can read these headers: they are listed in Access-Control-Expose-Headers.