Skip to main content

Platform Limits

Default Rate Limits​

The Basis Theory API has rate limits applied to ensure the speed and consistency of our systems. Rate Limits will always apply to the lowest Rate available for a given request. For example, if a request is made to POST /tokens with on a Test Tenant the rate limit for that request is 50 Requests / 10 Seconds.

Tenant Type Rate Limits​

Test Tenant​

MethodResourceCounterRateAction
ANYANYIP and API Key50 req / 10 sThrottle

API Resource Rate Limits​

ResourceCounterRateAction
POST /tokens/searchAPI Key AND IP50 req / 10 sThrottle
GET /tokens OR POST /detokenizeAPI Key AND IP100 req / 10 sThrottle
POST /tokens OR /tokenizeAPI Key AND IP200 req / 10 sThrottle
PATCH /tokens/{id}API Key AND IP200 req / 10 sThrottle
DELETE /tokens/{id}API Key AND IP200 req / 10 sThrottle
ANY /account-updater/*API Key AND IP10 req / 10 sThrottle
POST /documentsAPI Key AND IP10 req / 1 minThrottle
GET /documents/{id}/dataAPI Key AND IP10 req / 1 minThrottle

Application Type Rate Limits​

Private Application​

ResourceCounterRateAction
ANYAPI Key OR IP2000 req / 10 sThrottle

Public Application​

ResourceCounterRateAction
ANYIP and API Key50 req / 1 min10s Block

Management Application​

ResourceCounterRateAction
ANYAPI Key200 req / 1 min60s Block

Proxies​

Unauthenticated / Whitelabel Proxies​

ResourceCounterRateAction
ANYProxy Key AND IP50 req / 10 sThrottle
ANYCustom Hostname AND IP50 req / 10 sThrottle

Additional Limits for Proxy Requests​

Limit TypeValueBehavior
Destination Timeout25 secondsReturns 408 if exceeded

IPs​

IP-Based Global Rate Limit​

ResourceCounterRateAction
ANYIP2000 req / 10 s30s Block

Legacy Rate Limits​

Legacy API Keys​

This only applies to keys without _prod_ or _test_ in the key or are denoted by a Legacy badge on your API Key in an Application on the Portal.

MethodResourceCounterRateAction
ANYANYIP and API Key100 req / 1 mThrottle

Error Codes​

Status CodeMeaning
429Request has been rate limited

Other Limits​

Default Quotas​

Quotas are Tenant specific limits that can be adjusted by Basis Theory. Below are some of the default Quota's applied to all tenants as they are created - to find the full list of Quota' or to request a change, please visit your tenant's Quota page.

Quota NameLimit
Rate LimitDefault
Log Retention24 hours
Tokenize Limit5 tokens
Detokenize Limit5 tokens
CVC Retention1 hour
Token Intent Retention24 hours

Code Execution​

Applicable to Reactors and Proxy Transforms.

MetricLimitNote
Maximum code length50K charactersPlease reach out if your use case requires more characters.
Payload Size1 MBPlease reach out if your use case requires larger payloads.
Hot concurrency1This will fan out and cold start additional Reactors if multiple requests happen concurrently.
Please reach out if you need additional hot concurrency
Synchronous Timeout30 secondsSynchronous Reactor Invoke and Pre-configured Proxy Invoke code executions will timeout after 30s.
Asynchronous Timeout300 secondsAsynchronous Reactor Invoke code executions will timeout after 300s.

Account Updater​

The maximum supported Batch Account Updater request file size is 30 MB per file (approx. 300k tokens).

If you need to update more than 300k tokens at a time, you can split your request into multiple files and create multiple jobs in parallel.

Last updated on