reference
API Limits
How many API calls and sign-in attempts CadActive allows, and what happens when a limit is reached.
CadActive limits how often applications and people can call the API, and how often someone can try to sign in, register, reset a password, or request an unlock email. These limits protect your organization from repeated sign-in attempts and from short bursts of traffic.
CadActive Cloud applies the limits on this page. They are the same for every Cloud organization. If you run the CadActive server on your own network, a server administrator can change them. See On-Premise API Rate Limit Configuration under Deploying the CadActive Server On-Premise.
When a limit is reached
The request is rejected and does not complete.
The status is 429.
The message is "Too many requests. Please try again later."
The response includes a Retry-After value, in seconds. Wait at least that long before repeating the same action.
This is temporary. It is a different state from a locked account. A locked account stays blocked until the person opens the unlock email, or an organization admin unlocks it. See Unlock a user account.
Everyday API use
These limits apply to normal product and integration traffic, such as reading and saving data.
| Activity | Limit |
|---|---|
| Any API request from one IP address | 300 every 5 minutes |
| API requests that create, update, or delete data, from one IP address | 100 every 10 minutes |
| API requests from one signed-in session | 1,000 every hour |
One call can count toward more than one row. Saving a change counts as both a general request and a write.
People in the same office often share one public IP address, so they share the per-address limits.
Sign-in, registration, and account email
These limits are smaller. They apply when someone is signing in, creating an account, resetting a password, or requesting an unlock email.
| Activity | Limit |
|---|---|
| Sign-in and related account requests from one IP address | 20 every 5 minutes |
| Sign-in attempts for one email address | 5 every 20 minutes |
| Registration attempts for one email address | 10 every hour |
| Password-reset emails for one email address | 5 every hour |
| Unlock emails for one email address | 5 every hour |
Sign-in attempts include successful sign-ins and the step that checks the email address. Signing in several times in a short period can reach the limit even when the password is correct.
Signing in through the API also counts toward the everyday API limits. Signing in through the web app counts toward the sign-in limits only.
Locked accounts
Failed sign-ins can lock the account. That is separate from the temporary limits above.
On CadActive Cloud, an account locks after 5 failed sign-in attempts.
On a CadActive server that you host, the default is 10 failed sign-in attempts. A server administrator can change Auth - Max Login Attempts in the Admin Console.
The temporary sign-in limit can also stop further attempts before the account locks. Waiting out the temporary limit does not unlock an account that is already locked. See Unlock a user account.
What to do
Wait for the time given in the response, then try again.
If the account is locked, follow Unlock a user account.
If you host the CadActive server and need a higher limit, a server administrator can change it. See Deploying the CadActive Server On-Premise.